Parse JSON with FilterX

To parse a JSON string, use the parse_json function. It returns a value of the matching FilterX type: a JSON object becomes a dict, an array becomes a list. To convert an object back to a JSON string, use the format_json function.

If the string isn’t valid JSON, the function returns an error, and the FilterX block evaluates to false.

For example, if the message contains a JSON object like {"user":"alice","action":"login","src":{"ip":"192.0.2.2"}}, the following FilterX block parses it and stores two of its fields in name-value pairs:

filterx {
    event = parse_json(${MESSAGE});
    ${USER} = event.user;
    ${SRC_IP} = event.src.ip;
};

After the block, ${USER} is alice, and ${SRC_IP} is 192.0.2.2. The event variable is a local variable, so it isn’t sent to the destination. For details, see FilterX variables in destinations .

To access the fields of the parsed object, see Complex types: lists, dicts, and JSON .