Create Two Temporary Events for Troubleshooting - Example 2

Create two temporary events for testing or troubleshooting using the createEvents() function with parseJson()

Query

logscale
createEvents(["{\"animal\":{\"kind\":\"dog\", \"weight\":7.0}}", "{\"animal\":{\"kind\":\"cat\", \"weight\":4.2}}"])
| parseJson()

Introduction

The createEvents() function generates temporary events as part of the query. The function is ideal for generating sample data for testing or troubleshooting.

In this example, the createEvents() function is combined with parseJson() to parse @rawstring as JSON.

Example incoming data might look like this:

animal
HASH(0x562e1f00e9d8)
HASH(0x562e1f00e678)

Step-by-Step

  1. Starting with the source repository events.

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    createEvents(["{\"animal\":{\"kind\":\"dog\", \"weight\":7.0}}", "{\"animal\":{\"kind\":\"cat\", \"weight\":4.2}}"])

    Creates two temporary events. An event with dog and an event with cat.

  3. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    | parseJson()

    Parses specified fields as JSON.

  4. Event Result set.

Summary and Results

The query is used to create temporary events and parse the @rawstring as JSON.

Sample output from the incoming example data:

@rawstring@timestamp@timestamp.nanosanimal.kindanimal.weight
{"animal":{"kind":"dog", "weight":7.0}}17333115477170dog7.0
{"animal":{"kind":"cat", "weight":4.2}}17333115477170cat4.2