Dictionary and List Functions
Last updated: 2025-12-03 18:30:47
Function Dictionary
Function json_add
Function Definition
Add a node in json.
Syntax Description
json_add(key,data)
Parameter Description
Parameter Name | Parameter Description | Parameter Type | Required | Parameter Default Value | Parameter Value Range |
key | json key | string | Yes | - | - |
data | Add a new node | dict | Yes | - | - |
Example
Original logs:
{"content": "{\\"a\\":{\\"b\\":{\\"c\\":\\"cc\\"}}}"}
Processing rules:
json_add("content", {"a":{"b":{"d":"dd"}}})
Processing result:
{"content": "{\\"a\\":{\\"b\\":{\\"c\\":\\"cc\\",\\"d\\":\\"dd\\"}}}"}
Function json_edit
Function Definition
Add/modify/delete key-value pairs in the dictionary, and return dict.
Syntax Description
json_edit("result", path="", key="",value="333",index=1,mode="edit")
Parameter Description
Parameter | Description | Type | Required | Default Value | Value Range |
field | Nested json corresponding key | string | Yes | - | - |
path | Need to delete or modify the directory corresponding to the target field. When the field to be deleted or modified is at the first level of nested json, leave it blank; when operating on array elements, fill in up to the key corresponding to the array. Support JMES grammar. | string | No | - | - |
key | Target field that needs to be deleted or modified. No need to specify when performing operations on array elements. | string | No | - | - |
value | New value to be set, required when modifying a value | string | No | - | - |
index | Fill in this field when operating on an array. Array elements start from 1. | number | No | 0 | - |
mode | mode, edit: modify, move: delete, default move | string | No | move | - |
Example 1: Modify the Value of the Designated Node
Raw log:
{"content":"{\\"p9\\":[\\"0.0\\",\\"0.0\\"],\\"p18\\":\\"CN\\"}","time":"1650440364"}
Processing rule:
json_edit("content", path="", key="p18", value="hello", mode="edit")
Processing result:
{"content":"{\\"p9\\":[\\"0.0\\",\\"0.0\\"],\\"p18\\":\\"hello\\"}", "time":"1650440364"}
Example 2: Modify the Value of the Designated Node (Multi-Level)
Raw log:
{"content":"{\\"p9\\":[\\"0.0\\",\\"0.0\\"],\\"p18\\":\\"CN\\",\\"info\\":{\\"province\\":\\"hubei\\",\\"geo\\":{\\"long\\":\\"111\\",\\"lati\\":\\"222\\"}}}","time":"1650440364"}
Processing rule:
json_edit("content", path="info.geo", key="long", value="333", mode="edit")
Processing result:
{"content":"{\\"p9\\":[\\"0.0\\",\\"0.0\\"],\\"p18\\":\\"CN\\",\\"info\\":{\\"province\\":\\"hubei\\",\\"geo\\":{\\"long\\":\\"333\\",\\"lati\\":\\"222\\"}}}","time":"1650440364"}
Example 3: Delete Node
Raw log:
{"content":"{\\"p9\\":[\\"0.0\\",\\"0.0\\"],\\"p18\\":\\"CN\\",\\"info\\":{\\"province\\":\\"hubei\\",\\"geo\\":{\\"long\\":\\"111\\",\\"lati\\":\\"222\\"}}}","time":"1650440364"}
Processing rule:
json_edit("content", path="", key="p18", mode="move")
Processing result:
{"content":"{\\"p9\\":[\\"0.0\\",\\"0.0\\"],\\"info\\":{\\"province\\":\\"hubei\\",\\"geo\\":{\\"long\\":\\"111\\",\\"lati\\":\\"222\\"}}}","time":"1650440364"}
Example 4: Delete Array Element
Raw log:
{"content":"{\\"p9\\":[\\"0.0\\",\\"0.0\\"],\\"p18\\":\\"CN\\",\\"info\\":{\\"province\\":[\\"hello\\",\\"world\\"],\\"geo\\":{\\"long\\":[\\"1.0\\",\\"2.0\\"],\\"lati\\":\\"222\\"}}}","time":"1650440364"}
Processing rule:
json_edit("content", path="info.province", index=1, mode="move")
Processing result:
{"content":"{\\"p9\\":[\\"0.0\\",\\"0.0\\"],\\"p18\\":\\"CN\\",\\"info\\":{\\"province\\":[\\"world\\"],\\"geo\\":{\\"long\\":[\\"1.0\\",\\"2.0\\"],\\"lati\\":\\"222\\"}}}","time":"1650440364"}
Function json_select
Function Definition
With a JMES expression, extract the JSON field value and return the Jmes extracted node value (String).
Syntax Description
json_select(data, jmes="")
Parameter Description
Parameter | Description | Type | Required | Default Value | Value Range |
data | Field value, which can be extracted by other functions. | string | Yes | - | - |
jmes | string | Yes | - | - |
Example
Raw log:
{"field": "{\\"a\\":{\\"b\\":{\\"c\\":{\\"d\\":\\"success\\"}}}}", "status": "500"}
Processing rule:
fields_set("message", json_select(v("field"), jmes="a.b.c.d"))
Processing result:
{"field":"{\\"a\\":{\\"b\\":{\\"c\\":{\\"d\\":\\"success\\"}}}}","message":"success","status":"500"}
Function xml_to_json
Function Definition
Parse the XML value and convert it to a JSON string. The input value must be in the XML string structure; otherwise, the conversion will fail and return a dict.
Syntax Description
xml_to_json(data)
Parameter Description
Parameter | Description | Type | Required | Default Value | Value Range |
data | Field value. | string | Yes | - | - |
Example
Raw log:
{"xml_field": "<note><to>B</to><from>A</from><heading>Reminder</heading><body>Don't forget me this weekend!</body></note>", "status": "500"}
Processing rule:
fields_set("json_field", xml_to_json(v("xml_field")))
Processing result:
{"xml_field":"<note><to>B</to><from>A</from><heading>Reminder</heading><body>Don't forget me this weekend!</body></note>","json_field":"{\\"to\\":\\"B\\",\\"from\\":\\"A\\",\\"heading\\":\\"Reminder\\",\\"body\\":\\"Don't forget me this weekend!\\"}","status":"500"}
Function json_to_xml
Function Definition
Parse JSON string values and convert them to XML strings, and return a String.
Syntax Description
json_to_xml(data)
Parameter Description
Parameter | Description | Type | Required | Default Value | Value Range |
data | Field value. | string | Yes | - | - |
Example
Raw log:
{"json_field":"{\\"to\\":\\"B\\",\\"from\\":\\"A\\",\\"heading\\":\\"Reminder\\",\\"body\\":\\"Don't forget me this weekend!\\"}", "status": "200"}
Processing rule:
fields_set("xml_field", json_to_xml(v("json_field")))
Processing result:
{"json_field":"{\\"to\\":\\"B\\",\\"from\\":\\"A\\",\\"heading\\":\\"Reminder\\",\\"body\\":\\"Don't forget me this weekend!\\"}","xml_field":"<ObjectNode><to>B</to><from>A</from><heading>Reminder</heading><body>Don't forget me this weekend!</body></ObjectNode>","status":"200"}
Function if_json
Function Definition
Check whether it is a JSON string, and return TRUE/FALSE.
Syntax Description
if_json(data)
Parameter Description
Parameter | Description | Type | Required | Default Value | Value Range |
data | Field value. | string | Yes | - | - |
Example
Sample 1
Raw log:
{"condition":"{\\"a\\":\\"b\\"}","status":"500"}
Processing Statement:
t_if(if_json(v("condition")), fields_set("new", 1))
Processing result:
{"new":"1","condition":"{\\"a\\":\\"b\\"}","status":"500"}
Sample 2
Raw log:
{"condition":"haha","status":"500"}
Processing Statement:
t_if(if_json(v("condition")), fields_set("new", 1))
Processing result:
{"condition":"haha","status":"500"}
List Functions
Function Get Array
Function Definition
Retrieve the value of the array, return String.
Syntax Description
array_get(array, index_position)
Parameter Description
Parameter | Description | Type | Required | Default Value | Value Range |
Array | Array | string | Yes | - | - |
index_position | Get the value at a specific index in an array | int | Yes | - | - |
Sample 1
Raw log:
{"field1": "[1,2,3]"}
Processing rule:
fields_set("field2", array_get(v("field1"), 0))
Processing result:
{"field1":"[1,2,3]","field2":"1"}
Sample 2
Raw log:
{"field1": "['tom','jerry','bobo']"}
Processing rule:
fields_set("field2", array_get(v("field1"), 0))
Processing result:
{"field1":"['tom','jerry','bobo']","field2":"tom"}
Was this page helpful?
You can also Contact Sales or Submit a Ticket for help.
Yes
No
Feedback