Writes data as a JSON object, and includes field values optionally. The specified fields will be formatted as JSON and assigned to the field specified in as, defaults to _json.

ParameterTypeRequiredDefault ValueDescription
asstringoptional[a] _json Name of output field.
field[b]array of stringsoptional[a] @rawstring Values and fields that should be converted to JSON. Accepts either a value or array of values. Values are interpreted as prefix matches, unless a globbing pattern with * is given (see following example).

[a] Optional parameters use their default value unless explicitly set.

[b] The parameter name field can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

writeJson() Syntax Examples

  • Multiple fields can be included. Given events where:

    json
    a.b.c=5,
a.b.e[0]=6,
a.d=7,
a.f.g=8

    use the query function to call:

    logscale
    writeJson(["a.b.c", "a.b.e[0]", "a.d", "a.f.g"])

    It will write the following JSON to each event, respectively:

    json
    {"a":{"b":{"c":5}}},
{"a":{"b":{"e":[6]}}},
{"a":{"d":7}},
{"a":{"f":{"g":8}}}

  • Arguments passed to the field parameter are interpreted as prefix matches. For example, the query:

    logscale
    writeJson(field=["a.b"])

    matches:

    json
    a.b.c
 a.bc
 a.b[0]
 a.b!
…

  • Array-glob patterns can be passed to the field parameter. For example, the query:

    logscale
    writeJson(field=["a.b[*]"])

    matches all fields in the event and it also matches anything else that starts with a:

    json Syntax
    a.b[0]
a.b[0]c
a.b[0].c
a.b[0][0]
a.b[0]!
...
a.b[1]c
a.b[1].c
a.b[1][0]
a.b[1]!
…

writeJson()Examples

Click + next to an example below to get the full details.

Convert Fields to JSON Format

Convert values and fields to JSON format using the writeJson() function

Query
logscale
writeJson(["a.b.c", "a.b.e[0]", "a.d", "a.f.g"])
Introduction

In this example, the writeJson() function is used to create a nested JSON structure from an array of field paths. The function handles both regular nested fields and array indexing.

Example incoming data might look like this:

@timestampa.b.ca.b.e[0]a.da.f.g
2023-06-15T10:30:00Zvalue1value2value3value4
2023-06-15T10:30:01Ztest1test2test3test4
2023-06-15T10:30:02Zdata1data2data3data4
Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    writeJson(["a.b.c", "a.b.e[0]", "a.d", "a.f.g"])

    Creates a JSON structure from the specified field paths and returns the JSON formatted results in a new field named _json.

    In this example, the writeJson() function:

    • Takes an array of field paths as input.

    • Handles nested field paths using dot notation.

    • Supports array indexing with square bracket notation.

    • Maintains the hierarchical relationship between fields in the resulting JSON.

  3. Event Result set.

Summary and Results

The query is used to transform flat field references into a structured JSON object, preserving the hierarchical relationships between fields.

This query is useful, for example, to reconstruct nested data structures from flattened fields, to prepare data for external systems that expect nested JSON or to create structured views of related fields

Sample output from the incoming example data:

_jsona.b.ca.b.e[0]a.da.f.g
{"a":{"b":{"c":"value1","e":["value2"]},"d":"value3","f":{"g":"value4"}}}value1value2value3value4
{"a":{"b":{"c":"test1","e":["test2"]},"d":"test3","f":{"g":"test4"}}}test1test2test3test4
{"a":{"b":{"c":"data1","e":["data2"]},"d":"data3","f":{"g":"data4"}}}data1data2data3data4