Using JSON Paths
I'm attempting to extract values from a JSON string field. However, it seems, that none of the below methods are working for referencing or obtaining the value using a JSON path or dot notation type of approach. I've even tried the "extract_json" function, but to no avail.
KQL in Azure has the bag_unpack function, but I noticed this is not supported in Cribl Search.
Below are my queries and results.
| extend json=parse_json(_raw)
| extend test1=_raw._raw.kubernetes.container_name
| extend test2=json._raw.kubernetes.container_name
| extend test3=json['_raw']['kubernetes']['container_name']
| extend test4=extract_json("$._raw.kubernetes.container_name", json, typeof(string))
| limit 10