Edge Delta Parse JSON Node
2 minute read
Overview
The Parse JSON node parses fully structured JSON logs as attributes.
Custom Attributes
Custom attributes are flattened to create key value pairs of type (string, string), for example:
"attributes": {
"a": 1
"b": {
"bb": "cc"
}
}
These attributes will be flattened as follows:
"attributes": {
"a": "1",
"b.bb": "cc"
}
Note: In the case of conflicts, such as this example, the behavior is non-deterministic:
"attributes": {
"a.b": "foo"
"a": {
"b": "bar"
}
}
Example Configuration
nodes:
- name: parse_json_test
type: parse_json_attributes
process_field: item["body"]
Input Log
{
"timestamp": "2024-12-27T12:34:56.789Z",
"node_id":"node11",
"logLevel": "INFO",
"request": {
"method": "GET",
"endpoint": "/api/v1/users/42",
"headers": {
"Host": "api.myapp.com",
"Authorization": "[redacted token]]",
"Accept": "application/json"
}
},
"response": {
"status": 200,
"time_ms": 153,
"body": {
"id": 42,
"name": "[redacted name]",
"email": "[redacted email]"
}
},
"userId": 42
}
Output log
The log body is parsed into attributes that you can use as search facets:
Required Parameters
name
A descriptive name for the node. This is the name that will appear in Visual Pipelines and you can reference this node in the YAML using the name. It must be unique across all nodes. It is a YAML list element so it begins with a - and a space followed by the string. It is a required parameter for all nodes.
nodes:
- name: <node name>
type: <node type>
type: parse_json_attributes
The type parameter specifies the type of node being configured. It is specified as a string from a closed list of node types. It is a required parameter.
nodes:
- name: <node name>
type: <node type>
Optional Parameters
process_field
The process_field parameter defines a dot separated field path on which to apply parsing. It is specified as a string and is optional. The default is item["body"].
nodes:
- name: <node name>
type: parse_json_attributes
process_field: item["body"]