jmespath

Executes a JMESPath query on JSON documents and replaces the message with the resulting document.

# Common config fields, showing default values
jmespath:
query: ""

This processor is useful for performing large mappings in order to restructure JSON documents. In order to map documents using more advanced logic consider instead using the awk processor.

Fields

query

The JMESPath query to apply to messages.

Type: string
Default: ""

parts

An optional array of message indexes of a batch that the processor should apply to. If left empty all messages are processed. This field is only applicable when batching messages at the input level.

Indexes can be negative, and if so the part will be selected from the end counting backwards starting from -1.

Type: array
Default: []

Examples

With the following query:

jmespath:
query: locations[?state == 'WA'].name | sort(@) | {Cities: join(', ', @)}

If the initial contents of a message were JSON document of the form:

{
"locations": [
{"name": "Seattle", "state": "WA"},
{"name": "New York", "state": "NY"},
{"name": "Bellevue", "state": "WA"},
{"name": "Olympia", "state": "WA"}
]
}

Then the resulting contents would be:

{"Cities": "Bellevue, Olympia, Seattle"}

It is possible to create boolean queries with JMESPath, in order to filter messages with boolean queries please instead use the jmespath condition.