Using the autoparser with JSON objects

[ 1 What permissions do I need? ] [ 2 Parsing options ] [ 3 Split option explained ]

What permissions do I need?

As explained in the Autoparser article, you need both the Finders and the Log Autoparser permissions.

Parsing options

The autoparser is able to detect JSON objects in unparsed events and extract individual key/value pairs in different columns if needed. To do it, access the unparsed my.app / my.upload table that contains the JSON objects and activate the autoparser as explained in Using the autoparser.

The value in the Type column will be automatically set to JSON object for the detected JSON objects. Click the dropdown selector to choose one of the available types:

JSON object - This is the default option, and transforms each JSON object into a json type value.
JSON split - Split the JSON object into different values, indicating the required depth level. The values in the list correspond to the available depth levels in the JSON objects. Learn more about this in the section below.
String - This option transforms each JSON object into a string type value.

Split option explained

Choose the JSON split option in the Type column to divide your JSON object into different values. Once the option is selected, a second dropdown box appears to indicate the required depth level you want to apply.

After applying the autoparser, you will always get a column that shows the whole JSON objects (in json data type), whose name is the one given in the Name field during the autoparsing creation process.

Apart form that, you will get as many additional columns as distinct keys you have in all your JSON objects, according to the given depth level. Not available levels in a specific JSON will be assigned null values. Learn more in the example below.

Field order

The order of the fields generated is random and may not follow the order of the JSON object.

Example

We sent two events to Devo, each of them containing one of the JSON objects below. In the autoparser configuration, we named the JSON object myJSON, and set the Type to JSON split. Let's see what happens when we select different depth levels:

{ 
"splitInt":1, 
"childObj": 
    { 
    "childKey":"childVal", 
    "childKey2":"childVal2", 
    "childKey3":"childVal3", 
    "childkey4": 
        { 
        "newlevel1":1, 
        "newlevel2":2 
        } 
    } 
}

Depth level 1

myJSON	myJSON_S1	myJSON_childObj	myJSON_splitInt

myJSON	myJSON_S1	myJSON_childObj	myJSON_splitInt
This cell will show the whole JSON object	null	`{"childKey":"childVal","childKey2":"childVal2","childKey3":"childVal3","childkey4":{"newlevel1":1,"newlevel2":2}}`	`1`

Depth level 2

myJSON	myJSON_S1_S2	myJSON_splitInt	myJSON_childObj_childkey	myJSON_childObj_childkey2	myJSON_childObj_childkey3	myJSON_childObj_childkey4

myJSON	myJSON_S1_S2	myJSON_splitInt	myJSON_childObj_childkey	myJSON_childObj_childkey2	myJSON_childObj_childkey3	myJSON_childObj_childkey4
This cell will show the whole JSON object	null	`1`	`childVal`	`childVal2`	`childVal3`	`{"newlevel1":1,"newlevel2":2}`

{ 
"S1":
    {
    "S2": 
        { 
        "S2_child":
            { 
            "int1": 4, 
            "int2": 5 
            } 
        } 
    } 
}

Depth level 1

myJSON	myJSON_S1	myJSON_childObj	myJSON_splitInt

myJSON	myJSON_S1	myJSON_childObj	myJSON_splitInt
This cell will show the whole JSON object	`{"S2_child":{"int1":4,"int2":5}}}`	null	null

Depth level 2

myJSON	myJSON_S1_S2	myJSON_splitInt	myJSON_childObj_childkey	myJSON_childObj_childkey2	myJSON_childObj_childkey3	myJSON_childObj_childkey4

myJSON	myJSON_S1_S2	myJSON_splitInt	myJSON_childObj_childkey	myJSON_childObj_childkey2	myJSON_childObj_childkey3	myJSON_childObj_childkey4
This cell will show the whole JSON object	`{"S2_child":{"int1":4,"int2":5}}}`	null	null	null	null	null