Json Filter


I have to parse a field which can be in a json format.
is it possible to parse it if json and copy it in a field named json_msg, or send it as text in a field named invalid_json if it's an invalid json ?

Thx for your help.

Not with the json filter alone, but if the JSON parsing fails the event will be tagged _jsonparsefailure and you can then use a mutate filter to copy the JSON string to the invalid_json field for events having that tag.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.