0

I am finding difficulty to extract all the same fields and it's values from objects where the objects are in array(array of objects in json).

I tried with |parse @message '"currency":"*"' as currencies

but getting only first match searched(a single first field) and not all the searches(the matched field from all the objects) from json.

Filter command is used to extract the log/@message from log group.....but not the fields from single json log or @message.

Can anyone help me out here.

Example Json:

.......

......

....

"body":
     {

     "totalSize":4,

     "done":true,

     "records":[

          {"city":"london",

           "currency":"GBP",

           "Country":"GB"
           },
          {"city":"london,

           "currency":"USD",

           "Country":"GB"
          },
          {"city":"Monaco,

           "currency":"EUR",

           "Country":"MC"
          },        

          {"city":"london,

           "currency":"GBP",

           "Country":"GB"

          }
        ]
}

Expected values:

currencies

GBP,USD,EUR,GBP

Actual values:

currencies

GBP

Getting only first value from message log

I tried

|Parse @message /\"currency\":\"(?<currencies>.*?)\"/

Or

|Parse @message /\"(?<field>currency)\":\"(?<currencies>.*?)\"/

What I tried

fields @message
|filter @message like 'totalSize'
|Parse @message /\"currency\":\"(?<currencies>.*?)\"/
|display currencies 

0 Answers0