JSON extract processor

The JSON extract processor extracts values from a JSON-encoded string field using JSONPath-like selectors, and writes each extracted value to its own target field. Supported selector syntax includes dot notation (user.address.city), bracket notation (['user']['name']), and array indexing (items[0]), with an optional $ root prefix.

To extract values from a JSON string:

1. Select Create → Create processor.
2. Select JSON extract from the Processor menu.
3. Set Field with JSON string to the field containing the JSON string to parse.
4. For each value you want to extract, select Add extraction and set:
   • Selector: A JSONPath-like selector for the value to extract, for example user.id, $.metadata.client.ip, or items[0].name.
   • Target: The field to store the extracted value in.
   • Type: The data type for the extracted value: Keyword, Integer, Long, Double, or Boolean. Defaults to Keyword.

In YAML mode, configure the JSON extract processor using the following parameters. For the complete Streamlang syntax, refer to the Streamlang reference.

- action: json_extract
  field: attributes.message
  extractions:
    - selector: metadata.client.ip
      target_field: attributes.client.ip

Given a document with attributes.message set to {"metadata": {"client": {"ip": "192.168.1.1"}}}, the processor adds attributes.client.ip: "192.168.1.1".