How to read property name which is inside JSON for alert?

Elastic Stack Elasticsearch
1

I am able pull the specific index infor by using ctx.results.0.hits.hits.0._source.log. This gives me desired result. Now this comes a JSON blob where I want to read particular property but not sure it is possible or not.

i.e. ctx.results.0.hits.hits.0._source.log gives me below object. I want to extract value of time or remote_addr from here. How can I do that?

"{ \"time\": \"2020-07-06T18:16:19+00:00\", \"remote_addr\": \"3.216.137.196\",\"x-forward-for\": \"12.189.103.34, 64.252.128.90, 3.216.137.196\", \"remote_user\":\"\", \"bytes_sent\": 99, \"request_time\": 0.007, \"status\":200, \"vhost\": \"api.a.rids.sit.tce.tillster.com\", \"request_proto\": \"HTTP/1.1\", \"request_query\": \"\", \"request_length\": 880, \"duration\": 0.007,\"method\": \"POST\", \"http_referrer\": \"\", \"http_user_agent\":\"Amazon CloudFront\" }\n"

2

Try ctx.results.0.hits.hits.0._source.time

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.