I am finding difficulty to extract all the same fields and it's values from objects where the objects are in array(array of objects in json).
I tried with |parse @message '"currency":"*"' as currencies
but getting only first match searched(a single first field) and not all the searches(the matched field from all the objects) from json.
Filter command is used to extract the log/@message from log group.....but not the fields from single json log or @message.
Can anyone help me out here.
Example Json:
.......
......
....
"body":
{
"totalSize":4,
"done":true,
"records":[
{"city":"london",
"currency":"GBP",
"Country":"GB"
},
{"city":"london,
"currency":"USD",
"Country":"GB"
},
{"city":"Monaco,
"currency":"EUR",
"Country":"MC"
},
{"city":"london,
"currency":"GBP",
"Country":"GB"
}
]
}
Expected values:
currencies
GBP,USD,EUR,GBP
Actual values:
currencies
GBP
Getting only first value from message log
I tried
|Parse @message /\"currency\":\"(?<currencies>.*?)\"/
Or
|Parse @message /\"(?<field>currency)\":\"(?<currencies>.*?)\"/
What I tried
fields @message
|filter @message like 'totalSize'
|Parse @message /\"currency\":\"(?<currencies>.*?)\"/
|display currencies