Create Two Temporary Events for Troubleshooting - Example 2
Create two temporary events for testing or troubleshooting using the createEvents()
function with parseJson()
Query
createEvents(["{\"animal\":{\"kind\":\"dog\", \"weight\":7.0}}", "{\"animal\":{\"kind\":\"cat\", \"weight\":4.2}}"])
| parseJson()
Introduction
The createEvents()
function generates
temporary events as part of the query. The function is ideal for
generating sample data for testing or troubleshooting.
In this example, the createEvents()
function is combined with parseJson()
to
parse @rawstring as JSON.
Example incoming data might look like this:
animal |
---|
HASH(0x562e1f00e9d8) |
HASH(0x562e1f00e678) |
Step-by-Step
Starting with the source repository events.
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
createEvents(["{\"animal\":{\"kind\":\"dog\", \"weight\":7.0}}", "{\"animal\":{\"kind\":\"cat\", \"weight\":4.2}}"])
Creates two temporary events. An event with
dog
and an event withcat
. - flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
| parseJson()
Parses specified fields as JSON.
Event Result set.
Summary and Results
The query is used to create temporary events and parse the @rawstring as JSON.
Sample output from the incoming example data:
@rawstring | @timestamp | @timestamp.nanos | animal.kind | animal.weight |
---|---|---|---|---|
{"animal":{"kind":"dog", "weight":7.0}} | 1733311547717 | 0 | dog | 7.0 |
{"animal":{"kind":"cat", "weight":4.2}} | 1733311547717 | 0 | cat | 4.2 |