Simple Log Service:JMESPath syntax

JMESPath is an enhanced query and computing language for JSON. You can use JMESPath to extract, compute, and convert JSON data. For more information, see JMESPath Tutorial.

json_select(Value, "JMESPath expression", ...)
e_json(Field name, jmes="JMESPath expression", ...)
e_split(Field name, ... jmes="JMESPath expression", ...)

Obtain a value by using the key of a field

• Raw log

  json_data: {"a":"foo","b":"bar","c":"baz"}

• Transformation rule

  # Obtain the value of a from the JSON expression. 
  e_set("a1", json_select(v("json_data"), "a"))
  # Obtain the value of b from the JSON expression. 
  e_set("b1", json_select(v("json_data"), "b"))
  # Obtain the value of c from the JSON expression. 
  e_set("c1", json_select(v("json_data"), "c"))

• Result

  a1:foo
  b1:bar
  c1:baz
  json_data:{"a":"foo","b":"bar","c":"baz"}

Obtain a nested value

• Raw log

  json_data:{"a": {"b":{"c":{"d":"value"}}}}

• Transformation rule

  # Obtain the value of d from the JSON expression. 
  e_set("e", json_select(v("json_data"), "a.b.c.d"))

• Result

  e:value
  json_data:{"a": {"b":{"c":{"d":"value"}}}}

Obtain a value by slicing data

• Raw log

  json_data:{"a": ["b", "c", "d", "e", "f"]}

• Transformation rule

  # Obtain the value of the a field starting from slice 2. The value at slice 0 is b, and the value at slice 1 is c. 
  e_set("key", json_select(v("json_data"), "a[2:]"))

• Result

  json_data:{"a": ["b", "c", "d", "e", "f"]}
  key:["d", "e", "f"]

Obtain a value by combining the preceding methods

• Raw log

  json_data:{"a": {"b": {"c": [{"d": [0, [1, 2]]}, {"d": [3, 4]}]}}}

• Transformation rule

  # c[0] specifies {"d": [0, [1, 2]]}. d[1] specifies [1, 2]]. The return value is 1. 
  e_set("key", json_select(v("json_data"), "a.b.c[0].d[1][0]"))

• Result

  json_data:{"a": {"b": {"c": [{"d": [0, [1, 2]]}, {"d": [3, 4]}]}}}
  key:1

Obtain a value by using projection

• Example 1
  • Raw log

    json_data:{"people": [{"first": "James", "last": "d"},{"first": "Jacob", "last": "e"},{"first": "Jayden", "last": "f"},{"missing": "different"}],"foo": {"bar": "baz"}}

  • Transformation rule

    # Obtain the values of the first fields from the people list. 
    e_set("key", json_select(v("json_data"), "people[*].first"))

  • Result

    json_data:{"people": [{"first": "James", "last": "d"},{"first": "Jacob", "last": "e"},{"first": "Jayden", "last": "f"},{"missing": "different"}],"foo": {"bar": "baz"}}
    key:["James", "Jacob", "Jayden"]

• Example 2
  • Raw log

    json_data:{"ops": {"functionA": {"numArgs": 2},"functionB": {"numArgs": 3},"functionC": {"variadic": true}}}

  • Transformation rule

    # Obtain the values of the numArgs fields from the ops list. 
    e_set("key", json_select(v("json_data"), "ops.*.numArgs"))

  • Result

    json_data:{"ops": {"functionA": {"numArgs": 2},"functionB": {"numArgs": 3},"functionC": {"variadic": true}}}
    key:[2, 3]

• Example 3
  • Raw log

    json_data:{"machines": [{"name": "a", "state": "running"},{"name": "b", "state": "stopped"},{"name": "c", "state": "running"}]}

  • Transformation rule

    # Obtain the values of the name fields for which the state field is running from the machines list. 
    e_set("key", json_select(v("json_data"), "machines[?state=='running'].name"))

  • Result

    json_data:{"machines": [{"name": "a", "state": "running"},{"name": "b", "state": "stopped"},{"name": "c", "state": "running"}]}
    key:["a", "c"]

Extract multiple values

• Raw log

  json_data:{"people": [{"name": "a","state": {"name": "up"}},{"name": "b","state": {"name": "down"}}]}

• Transformation rule

  # Obtain the values of the name and state fields from the people list. 
  e_set("key", json_select(v("json_data"), "people[].[name, state.name]"))

• Result

  json_data:{"people": [{"name": "a","state": {"name": "up"}},{"name": "b","state": {"name": "down"}}]}
  key:[["a", "up"], ["b", "down"]]

Calculate the number of elements in an array

• Raw log

  json_data:{"a": ["b", "c", "d", "e", "f"]}

• Transformation rule

  # Obtain the number of elements in the a array. 
  e_set("key", json_select(v("json_data"), "length(a)"))

  # Obtain the number of elements in the a array. If the result of length(a) is greater than 0, set the no-empty parameter to true. 
  e_if(json_select(v("json_data"), "length(a)", default=0), e_set("no-empty", true))

• Result

  json_data:{"a": ["b", "c", "d", "e", "f"]}
  key:5

  json_data:{"a": ["b", "c", "d", "e", "f"]}
  no-empty:true