Hello
I have a log like below,which is having JSON object
FEATURES=[
{
"featureName":"TOKEN_VALIDATION",
"addedIn":"1.0.7",
"description":"This feature is used to Validate the JWT token"
},
{
"featureName":"REQUETS_VALIDATION",
"addedIn":"1.0.7",
"description":"This feature is used to Validate request URL"
},
{
"featureName":"REQUEST_PAYLOAD_VALIDATION",
"addedIn":"1.0.7",
"description":"This feature is used to Validate request body"
},
{
"featureName":"RESPONSE_PAYLOAD_VALIDATION",
"addedIn":"1.0.7",
"description":"This feature is used to Validate response body"
},
{
"featureName":"AOP",
"addedIn":"1.0.6",
"description":"This feature is used to check method execution time"
},
{
"featureName":"TIBCO_COMMUNICATOR",
"addedIn":"1.0.8",
"description":"This feature is used to connect Benefits service "
},
{
"featureName":"SECRETS_SECURE",
"addedIn":"1.0.7",
"description":"This feature is used to Validate"
}
]
I want the out put table should be as shown in below
featureName addedIn description
TOKEN_VALIDATION 1.0.7 This feature is used to Validate the JWT token
REQUETS_VALIDATION 1.0.7 This feature is used to Validate request URL
REQUEST_PAYLOAD_VALIDATION 1.0.7 This feature is used to Validate request body
RESPONSE_PAYLOAD_VALIDATION 1.0.7 This feature is used to Validate response body
AOP 1.0.6 This feature is used to check method execution time
TIBCO_COMMUNICATOR 1.0.8 This feature is used to connect Benefits service
SECRETS_SECURE 1.0.7 This feature is used to Validate SECRETS
index=_internal | head 1 | fields _raw | eval FEATURES="[{\"featureName\":\"TOKEN_VALIDATION\",\"addedIn\":\"1.0.7\",\"description\":\"This feature is used to Validate the JWT token\"},{\"featureName\":\"REQUETS_VALIDATION\",\"addedIn\":\"1.0.7\",\"description\":\"This feature is used to Validate request URL\"},{\"featureName\":\"REQUEST_PAYLOAD_VALIDATION\",\"addedIn\":\"1.0.7\",\"description\":\"This feature is used to Validate request body\"},{\"featureName\":\"RESPONSE_PAYLOAD_VALIDATION\",\"addedIn\":\"1.0.7\",\"description\":\"This feature is used to Validate response body\"},{\"featureName\":\"AOP\",\"addedIn\":\"1.0.6\",\"description\":\"This feature is used to check method execution time\"},{\"featureName\":\"TIBCO_COMMUNICATOR\",\"addedIn\":\"1.0.8\",\"description\":\"This feature is used to connect Benefits service \"},{\"featureName\":\"SECRETS_SECURE\",\"addedIn\":\"1.0.7\",\"description\":\"This feature is used to Validate\"}]"
| spath input=FEATURES {} output=raw
| stats count by raw
| spath input=raw
| table featureName,addedIn,description
index=_internal | head 1 | fields _raw | eval FEATURES="[{\"featureName\":\"TOKEN_VALIDATION\",\"addedIn\":\"1.0.7\",\"description\":\"This feature is used to Validate the JWT token\"},{\"featureName\":\"REQUETS_VALIDATION\",\"addedIn\":\"1.0.7\",\"description\":\"This feature is used to Validate request URL\"},{\"featureName\":\"REQUEST_PAYLOAD_VALIDATION\",\"addedIn\":\"1.0.7\",\"description\":\"This feature is used to Validate request body\"},{\"featureName\":\"RESPONSE_PAYLOAD_VALIDATION\",\"addedIn\":\"1.0.7\",\"description\":\"This feature is used to Validate response body\"},{\"featureName\":\"AOP\",\"addedIn\":\"1.0.6\",\"description\":\"This feature is used to check method execution time\"},{\"featureName\":\"TIBCO_COMMUNICATOR\",\"addedIn\":\"1.0.8\",\"description\":\"This feature is used to connect Benefits service \"},{\"featureName\":\"SECRETS_SECURE\",\"addedIn\":\"1.0.7\",\"description\":\"This feature is used to Validate\"}]"
| spath input=FEATURES {} output=raw
| stats count by raw
| spath input=raw
| table featureName,addedIn,description
I am getting result as shown below
i am getting the order in alphabetical order.
if it come as in json object order,I mean Token_validation is first,Request_validation second so on.
But thanks for the solution
| stats count by raw → | mvexpand raw