CODEWITHSUNDEEP
datadoggrok
Josh Sharkey
Josh Sharkey

Reputation: 1038

Datadog: Remap a field from an array inside an attribute

The log has come into datadog as a JSON object and attributes have been parsed automatically.

Next I want to extract the owner field from an array nested in the JSON:

This syntax doesn't work does in datadog: @detail.resources[0].tags.owner

{
  name: "example_name"
  detail: { 
    resources: [
     /*0*/ { tags: {owner: "[email protected]"}}, 
     /*1*/ { tags: {owner: "[email protected]"}}
    ]
}

This syntax doesn't work does in datadog: @detail.resources[0].tags.owner

each value in the array should have the same owner. How can I use datadog processors to remap the first found email from this array to another attribute called @application.owner? Do I have to unparse the JSON somehow and use a Grok Processor?

Upvotes: 2

Views: 688

Answers (1)

Vladimir
Vladimir

Reputation: 534

I had the same issue. What has worked for me at the end is using a Remapper, for example:

Set attribute(s) or tag key to remap: detail.resources.0.tags.owner

Set target attribute or tag key: application.owner

Upvotes: 0

Related Questions