Processing specific text formats-Simple Log Service(SLS)-阿里云帮助中心

Convert and expand non-standard JSON objects

To expand nested dictionary-like data that is not valid JSON, convert it to JSON format and then use the parse-json function to expand it.

Raw log

content: {
  'referer': '-',
  'request': 'GET /phpMyAdmin',
  'status': 404,
  'data-1': {
    'aaa': 'Mozilla',
    'bbb': 'asde'
  },
  'data-2': {
    'up_adde': '-',
    'up_host': '-'
  }
}

SPL statement: Replace single quotes in the content field with double quotes to produce valid JSON.
```
* | extend content_json = replace(content, '''', chr(34))
```

Processing result

content: {
  'referer': '-',
  'request': 'GET /phpMyAdmin',
  'status': 404,
  'data-1': {
    'aaa': 'Mozilla',
    'bbb': 'asde'
  },
  'data-2': {
    'up_adde': '-',
    'up_host': '-'
  }
}
content_json:  {
  "referer": "-",
  "request": "GET /phpMyAdmin",
  "status": 404,
  "data-1": {
    "aaa": "Mozilla",
    "bbb": "asde"
  },
  "data-2": {
    "up_adde": "-",
    "up_host": "-"
  }
}

Expand the first level of the content_json field:
```
* | parse-json content_json
```

Expanded log fields:

data-1:{"aaa":"Mozilla","bbb":"asde"}
data-2:{"up_adde":"-","up_host":"-"}
referer:-
request:GET /phpMyAdmin
status:404

To further expand the data-1 and data-2 fields, use the following statement:

* | parse-json content_json
  | parse-json "data-1"
  | parse-json "data-2"

Fully expanded log fields:

aaa:Mozilla
bbb:asde
referer:-
request:GET /phpMyAdmin
status:404
up_adde:-
up_host:-

Complete SPL statement:

* | extend content_json = replace(content, '''', chr(34)) 
| parse-json content_json
| parse-json "data-1"
| parse-json "data-2"

Final processing result:

content:{'referer': '-', 'request': 'GET /phpMyAdmin', 'status': 404, 'data-1': {'aaa': 'Mozilla', 'bbb': 'asde'}, 'data-2': {'up_adde': '-', 'up_host': '-'}}
content_json:{"referer": "-", "request": "GET /phpMyAdmin", "status": 404, "data-1": {"aaa": "Mozilla", "bbb": "asde"}, "data-2": {"up_adde": "-", "up_host": "-"}}
data-1:{"aaa":"Mozilla","bbb":"asde"}
data-2:{"up_adde":"-","up_host":"-"}
aaa:Mozilla
bbb:asde
referer:-
request:GET /phpMyAdmin
status:404
up_adde:-
up_host:-

Expand other text formats

For non-standard formats, combine functions to reformat the data into JSON before expanding.

Raw log

content : {
  "pod" => {
    "name" => "crm-learning-follow-7bc48f8b6b-m6kgb"
  }, "node" => {
    "name" => "tw5"
  }, "labels" => {
    "pod-template-hash" => "7bc48f8b6b", "app" => "crm-learning-follow"
  }, "container" => {
    "name" => "crm-learning-follow"
  }, "namespace" => "testing1"
}

SPL statement: Use the replace function to replace => with :, then use parse-json to expand the data.
```
* | extend content_json = replace(content, '=>', ':')
|parse-json content_json
```

Processing result

content:{
  "pod" => {
    "name" => "crm-learning-follow-7bc48f8b6b-m6kgb"
  }, "node" => {
    "name" => "tw5"
  }, "labels" => {
    "pod-template-hash" => "7bc48f8b6b", "app" => "crm-learning-follow"
  }, "container" => {
    "name" => "crm-learning-follow"
  }, "namespace" => "testing1"
}
content_json:{
  "pod" : {
    "name" : "crm-learning-follow-7bc48f8b6b-m6kgb"
  }, "node" : {
    "name" : "tw5"
  }, "labels" : {
    "pod-template-hash" : "7bc48f8b6b", "app" : "crm-learning-follow"
  }, "container" : {
    "name" : "crm-learning-follow"
  }, "namespace" : "testing1"
}
container:{"name":"crm-learning-follow"}
labels:{"pod-template-hash":"7bc48f8b6b","app":"crm-learning-follow"}
namespace:testing1
node:{"name":"tw5"}
pod:{"name":"crm-learning-follow-7bc48f8b6b-m6kgb"}

Decode specially encoded text

To decode text containing hexadecimal escape sequences, use the ascii_unescape function.

Raw log
```
content : "\xe4\xbd\xa0\xe5\xa5\xbd"
```

SPL statement

* | extend decoded_content = ascii_unescape(content)

Processing result

content : "\xe4\xbd\xa0\xe5\a5\xbd"
decoded_content : "你好"