'Pretty prints' a JSON field. The function formats a JSON field for improved readability. This can be an expensive operation.
It is recommended to apply json:prettyPrint() after filtering your data at the end of the query. This prevents unnecessary formatting of data that will be discarded.
Default behaviour is as follows:
If the field does not contain
valid JSON, the unmodified input value is stored in the output
field.
If no field is specified, the
@rawstring field will be formatted.
Hide omitted argument names for this function
Show omitted argument names for this function
Omitted Argument NamesThe argument name for field can be omitted; the following forms of this function are equivalent:
json:prettyPrint("value")
and:
json:prettyPrint(field="value")
These examples show basic structure only.
Click + next to an example below to get the full details.
Format JSON in @rawstring field using the json:prettyPrint() function
#type=json
| account=123
| json:prettyPrint()
Starting with the source repository events.
Filters for events with the JSON type.
Filters for events related to account 123.
It is recommended to filter the event set as much as possible before
using the json:prettyPrint() function to prevent
unnecessary formatting of discarded data.
Formats the JSON content for improved readability.
Without a specified field, it formats the
@rawstring field.
Note that if input is not valid JSON, it returns unmodified values. To
prevent this, you can set a
strict
parameter. For an example of usage, see
Format Only Valid JSON.
Event Result set.
The query is used to make JSON data more readable in the results.
Formatting JSON in the @rawstring field after
filtering the data is very important as it is a resource-intensive
operation.
Format only JSON data that is considered valid using the json:prettyPrint() function
formattedJson := json:prettyPrint(field=message, strict=true)
In this example, the json:prettyPrint()
function is used to format the message field
as JSON with the
strict
parameter set to true to only process valid
JSON.
Starting with the source repository events.
formattedJson := json:prettyPrint(field=message, strict=true)
Uses the field
parameter to specify the message field as the
source of JSON data and the
strict parameter
set to true to only process valid JSON.
Formats the valid JSON data for improved readability and assigns the
results to a new field named
formattedJson.
Note that if the JSON in the message field is
invalid, the formattedJson
field will not be created for that event.
Event Result set.
The query is used to make valid JSON data more readable in the results.
Note that without
strict parameter
set to true, the
json:prettyPrint() function attempts to format even
invalid JSON, which might lead to unexpected results.
