Devo SOAR - jsonToColumns

Split a JSON (column) object into multiple fields, where the new field names consist of the input field name followed by underscore (_) followed by the JSON field ID.

Operator Usage in Easy Mode

1. Click + on the parent node.
2. Enter JSON to Columns operator in the search field and select the operator from the Results to open the operator form.
3. In the Input Table drop-down, enter or select the table containing the data to run this operator on.
4. In the JSON Field drop-down, enter or select the column that splits the JSON objects into multiple columns.
5. In the Defaults Field, click Add More to add a string of default field names.
6. Click Run to view the result.
7. Click Save to add the operator to the playbook.
8. Click Cancel to discard the operator form.

Usage Details

LQL Command

jsonToColumns(table, "jsonField")

-- with default fields
jsonToColumns(table, "jsonField", "a", "test_1")

Input:

table: Name of the input table.
"jsonField": Column (field) name that contains a JSON object (quotes are required).
"defaultFields": A comma-separated string of default field names. Only these fields that are mentioned here will be parsed and converted to columns. If a field does not exist in the JSON object, this operator will create the column and insert nulls.

Output:
A JSON object that is split into multiple columns. Each column is in the form jsonField__id, where jsonField is the input field and id is the JSON ID.

Example

Input
table = github_logs

LQL command

jsonToColumns(table, "jsonfield")

Output

Another Example With Default Fields

LQL command

jsonToColumns(table, "jsonField", "a", "test_1")

Output

Note: This operator is not recursive. It splits only the first layer. In the example, "b" and "u" or "b" and "v" are subfields of the "a" field, so they are not split into multiple columns.