LogViewPlus Support » LogViewPlus Support » Help & Support » Parsing nested json

Parsing nested json

tucan — Mon, 07 Feb 2022 07:10:58 GMT

Hi, we have nested json logfiles from our own equipment and I am trying to generate a parser using the wizard to handle them. If I remove the json root level from my log file manually then I can get the parser to work well, it correctly recognises the elements in the json. However this means manually editing the log file before feeding it to LVP, which kind of defeats the object .
So, how can I automatically ignore the json 'header' and 'result' sections in the sample below and only process the nested 'events' elements?

{
"request": "/api/v1/events?date=2022-01-29",
"responding_controller": {
   "name": "Location",
   "ip_address": "10.10.18.203",
   "serial_number": "0400430",
   "firmware_version": "3",
   "firmware_commit": "923cb3 (clean)"
},
"result": {
   "result_code": "0",
   "result_desc": "OK",
   "result_datetime": "2022-01-30T07:59:45.000+03:00"
},
"events": [
   {
    "id": 143455,
    "transition_type": "raised",
    "timestamp": "2022-01-29T04:14:35.000+03:00",
    "status": {
      "current_status": "active",
      "scope": "a_master",
      "name": "control.from",
      "status_type": "output_channel",
      "entity_type": "output_card",
      "entity_id": 3,
      "sub_entity_id": 8
    }
   },
   {
    "id": 143456,
    "transition_type": "raised",
    "timestamp": "2022-01-29T04:14:35.000+03:00",
    "status": {
      "current_status": "active",
      "scope": "a_master",
      "name": "AMP5 CH4",
      "status_type": "line_short",
      "entity_type": "amplifier",
      "entity_id": 20,
      "sub_entity_id": 0
    }
   }
]
}

RE: Parsing nested json

LogViewPlus Support — Mon, 07 Feb 2022 07:10:58 GMT

Hi Tucan,

We have just released LogViewPlus v2.5.55 as a BETA release. This release contains some enhancements to our JSON parser which will allow you to parse these log entries with something like:

[code]{
"events": [
   {
    "id": "%S{id}",
    "transition_type": "%S{transition_type}",
    "timestamp": "%d{yyyy-MM-ddT%H:mm:ss.fffzzzz}",
    "status": {
      "current_status": "%S{current_status}",
      "scope": "%S{scope}",
      "name": "%S{name}",
      "status_type": "%S{status_type}",
      "entity_type": "%S{entity_type}",
      "entity_id": "%S{entity_id}",
      "sub_entity_id": "%S{sub_entity_id}"
}
   }
]
}[/code]

The trick here is identifying the "events" as the root element from which the array should be read. To do this, we need to convert the "events" element into a full JSON object which we use to specify the conversion pattern.

Hope that helps. Please do let me know if you have any further questions or issues.

Thanks for reporting this issue,

Toby

RE: Parsing nested json

LogViewPlus Support — Tue, 01 Feb 2022 09:10:56 GMT

Hi Tucan,

There appears to be an outstanding issue with our JSON array handling. I will take a look at this issue today so we can get a fix in to our next BETA release scheduled for tomorrow. I will update this thread once the issue has been resolved.

Thanks for bringing this issue to our attention.

Toby