spath

Extract fields from JSON data using path expressions.

Description

The spath command extracts a value from a JSON-formatted field using a path expression. Use it when logs contain embedded JSON that wasn't parsed at ingestion time.

Syntax

... | spath [input=<field>] [output=<field>] [path=<path>]

Optional Arguments

input
Syntax: input=<field>
Description: Field containing the JSON data
Default: metadata

output
Syntax: output=<field>
Description: Name for the extracted field
Default: spath_result

path
Syntax: path=<jsonpath>
Description: JSON path to extract (e.g., user.name, data[0].id). Without path, spath passes events through unchanged.

Examples

Extract specific path

* | spath path=user.email output=email

Extract from custom field

* | spath input=json_data path=response.status output=status

Extract nested value

* | spath path=metadata.user.id output=user_id

Extract array element

* | spath path=items[0].name output=first_item

Multiple extractions

* | spath path=user.name output=username
  | spath path=user.email output=email
  | spath path=user.role output=role

Usage Notes

Path required: Without a path, spath passes events through unchanged. Specify a path to extract a value.

JSON path: Use dot notation for nested objects, brackets for arrays.

Performance: Parsing JSON at query time is slower than ingestion-time parsing.

Alternative: Configure parsing at ingestion to avoid per-query extraction.

Related Commands

• rex - Extract with regex
• eval - Transform extracted values