@@ -24,16 +24,17 @@ Example::
24
24
25
25
> source=json_test | eval is_valid = json_valid(json_string) | fields test_name, json_string, is_valid
26
26
fetched rows / total rows = 6/6
27
- +---------------------+---------------------------------+----------+
28
- | test_name | json_string | is_valid |
29
- |---------------------|---------------------------------|----------|
30
- | json nested object | {"a":"1","b":{"c":"2","d":"3"}} | True |
31
- | json object | {"a":"1","b":"2"} | True |
32
- | json array | [1, 2, 3, 4] | True |
33
- | json scalar string | "abc" | True |
34
- | json empty string | | True |
35
- | json invalid object | {"invalid":"json", "string"} | False |
36
- +---------------------+---------------------------------+----------+
27
+ +---------------------+-------------------------------------+----------+
28
+ | test_name | json_string | is_valid |
29
+ |---------------------|-------------------------------------|----------|
30
+ | json nested object | {"a":"1","b":{"c":"2","d":"3"}} | True |
31
+ | json nested list | {"a":"1","b":[{"c":"2"},{"c":"3"}]} | True |
32
+ | json object | {"a":"1","b":"2"} | True |
33
+ | json array | [1, 2, 3, 4] | True |
34
+ | json scalar string | "abc" | True |
35
+ | json empty string | | True |
36
+ | json invalid object | {"invalid":"json", "string"} | False |
37
+ +---------------------+-------------------------------------+----------+
37
38
38
39
JSON
39
40
----------
@@ -59,3 +60,49 @@ Example::
59
60
| json scalar string | "abc" | "abc" |
60
61
| json empty string | | null |
61
62
+---------------------+------------------------------+---------------+
63
+
64
+ JSON_EXTRACT
65
+ ____________
66
+
67
+ Description
68
+ >>>>>>>>>>>
69
+
70
+ Usage: `json_extract(doc, path [, path]...) ` Extracts a json value or scalar from a json document based on the path(s) specified.
71
+
72
+ Argument type: STRING, STRING
73
+
74
+ Return type: BOOLEAN/DOUBLE/INTEGER/NULL/STRUCT/ARRAY
75
+
76
+ - Returns a JSON array for multiple paths or if the path leads to an array.
77
+ - Return null if path is not valid.
78
+
79
+ Example::
80
+
81
+ > source=json_test | where json_valid(json_string) | eval json_extract=json_extract(json_string, '$.b') | fields test_name, json_string, json_extract
82
+ fetched rows / total rows = 6/6
83
+ +---------------------+-------------------------------------+-------------------+
84
+ | test_name | json_string | json_extract |
85
+ |---------------------|-------------------------------------|-------------------|
86
+ | json nested object | {"a":"1","b":{"c":"2","d":"3"}} | {c:"2",d:"3"} |
87
+ | json nested list | {"a":"1","b":[{"c":"2"},{"c":"3"}]} | [{c:"2"},{c:"3"}] |
88
+ | json object | {"a":"1","b":"2"} | 2 |
89
+ | json array | [1, 2, 3, 4] | null |
90
+ | json scalar string | "abc" | null |
91
+ | json empty string | | null |
92
+ +---------------------+-------------------------------------+-------------------+
93
+
94
+ > source=json_test | where test_name="json nested list" | eval json_extract=json_extract('{"a":[{"b":1},{"b":2}]}', '$.b[1].c')
95
+ fetched rows / total rows = 1/1
96
+ +---------------------+-------------------------------------+--------------+
97
+ | test_name | json_string | json_extract |
98
+ |---------------------|-------------------------------------|--------------|
99
+ | json nested list | {"a":"1","b":[{"c":"2"},{"c":"3"}]} | 3 |
100
+ +---------------------+-------------------------------------+--------------+
101
+
102
+ > source=json_test | where test_name="json nested list" | eval json_extract=json_extract('{"a":[{"b":1},{"b":2}]}', '$.b[*].c')
103
+ fetched rows / total rows = 1/1
104
+ +---------------------+-------------------------------------+--------------+
105
+ | test_name | json_string | json_extract |
106
+ |---------------------|-------------------------------------|--------------|
107
+ | json nested list | {"a":"1","b":[{"c":"2"},{"c":"3"}]} | [2,3] |
108
+ +---------------------+-------------------------------------+--------------+
0 commit comments