Edge Delta Parse JSON Node

Overview

The Parse JSON node parses fully structured JSON logs as attributes.

Custom Attributes

Custom attributes are flattened to create key value pairs of type (string, string), for example:

"attributes": {
  "a": 1
  "b": {
    "bb": "cc"
  }  
}

These attributes will be flattened as follows:

"attributes": {
  "a": "1",
  "b.bb": "cc"
}

Note: In the case of conflicts, such as this example, the behavior is non-deterministic:

"attributes": {
  "a.b": "foo"
  "a": {
    "b": "bar"
  }
}

Example Configuration

nodes:
- name: parse_json_test
  type: parse_json_attributes
  process_field: item["body"]

Input Log

{
  "timestamp": "2024-12-27T12:34:56.789Z",
  "node_id":"node11",
  "logLevel": "INFO",
  "request": {
    "method": "GET",
    "endpoint": "/api/v1/users/42",
    "headers": {
      "Host": "api.myapp.com",
      "Authorization": "[redacted token]]",
      "Accept": "application/json"
    }
  },
  "response": {
    "status": 200,
    "time_ms": 153,
    "body": {
      "id": 42,
      "name": "[redacted name]",
      "email": "[redacted email]"
    }
  },
  "userId": 42
}

Output log

The log body is parsed into attributes that you can use as search facets:

Required Parameters

name

A descriptive name for the node. This is the name that will appear in Visual Pipelines and you can reference this node in the yaml using the name. It must be unique across all nodes. It is a yaml list element so it begins with a - and a space followed by the string. It is a required parameter for all nodes.

nodes:
  - name: <node name>
    type: <node type>

type: parse_json_attributes

The type parameter specifies the type of node being configured. It is specified as a string from a closed list of node types. It is a required parameter.

nodes:
  - name: <node name>
    type: <node type>

Optional Parameters

process_field

The process_field parameter defines a dot separated field path on which to apply parsing. It is specified as a string and is optional. The default is item["body"].

nodes:
  - name: <node name>
    type: parse_json_attributes
    process_field: item["body"]