average of a field inside of a text in kibana - json

I have some logs in kibana with this message:
message: '{ "Type": "successfully created", "Count": 6, "ElapsedTime": 2004, "Id": "189f6293-21a1-4a74-a332-34369a0ebd0d"}'
How i can create a chart with timelion that shows average value of ElapsedTime?

You would have to extract the fields/json-keys from the message field.
The message field itself is of type text, meaning you can do full-text searches on it. In order to use the values of ElapsedTime to build visualizations, it has to be an own field inside the document either with type integer or keyword.
If you use Logstash, you can set up a pipeline using the json filter plugin. It will extract the JSON object inside the message field and store the key-value-pairs as separate fields in your event/document.

Related

Pass json string having dynamic data as a source to primeNG datatable

I'll be getting json dynamically from service as follows:
{"items":[[{"key": "SerialID","value": "P1.M1.T1"},{ "key": "Description", "value": "Dummy Desc 1"},{ "key": "Label", "value": "A123"}],[{"key": "SerialID","value": "P1.M1.T2"},{ "key": "Description", "value": "Dummy Desc 2"},{ "key": "Label", "value": "B123"}]]}
Here, sample 2 rows in items array are given. I would get multiple such rows. Also, columns in every row may very (e.g.: Here, I am receiving 3 columns per row. I might receive n number. However, it'll be same for all rows in input).
I want to pass this json as a data source to primeNG table and render it in tabular format. So both, columns and rows, need to be generated dynamically. I tried parsing the json but somehow not able to form appropriate inputs for primeNG table.
Any help is highly appreciated.
I finally iterated my JSON, formed column and row arrays in the format which PrimeNG expects and passed it to component. It worked!

Error while adding new documents to Azure Search index

I have an index with a couple of fields of type Edm.String and Collection(Edm.String). I want to have another index with the same fields plus another field of type Edm.Double. When I create such an index and try to add the same values (plus the newly added Edm.Double value) as I did to the first index, I'm getting the following error:
{
"error": {
"code": "",
"message": "The request is invalid. Details: parameters : An unexpected 'StartArray' node was found when reading from the JSON reader. A 'PrimitiveValue' node was expected.\r\n"
}
}
Does anyone know what this error means? I tried looking for it on the Internet but I couldn't find anything related to my situation. A sample request I'm sending to the new index looks like this:
POST https://myservicename.search.windows.net/indexes/newindexname/docs/index?api-version=2016-09-01
{
"value": [{
"#search.action": "upload",
"keywords": ["red", "lovely", "glowing", "cute"],
"name": "sample document",
"weight": 0.5,
"id": "67"
}]
}
The old index is the same but it doesn't have the "weight" parameter.
Edit: I created the index using the portal, so I don't have the exact JSON to create the index, but the fields are roughly like this:
Field Type Attributes Analyzer
---------------------------------------------------------------------------------------
id Edm.String Key, Retrievable
name Edm.String Searchable, Filterable, Retrievable Eng-Microsoft
keywords Collection(Edm.String) Searchable, Filterable, Retrievable Eng-Microsoft
weight Edm.Double Filterable, Sortable
The reason I got the error was because I made a mistake and was trying to send a Collection(Edm.String) when the actual type on the index was Edm.String.

Check if JSON string in Orbeon repeating grid contains a specific value

Working with the repeating grids through the form builder.
I have a custom control that has a string value represented in json.
{
"data": {
"type": "File",
"itemID": "12345",
"name": "Annual Summary",
"parentFolderID": "fileID",
"owner": "Owner",
"lastModifiedDate": "2016-10-17 22:48:05Z"
}
}
In the controls outside of the repeating grid, i need to check if name = "Annual Summary"
Previously, i had a drop down control and using Calculated Value $dropdownControl = "Annual Summary" it was able to return true if any of the repeated rows contained the value. My understanding is that using the = operator, it will validate against all rows.
Now with the json output of the control, I am attempting to use
contains($jsonStringValue, 'Annual Summary')
However, this only works with one entry and will be null if there are multiple rows.
2 questions:
How would validate whether "Annual Summary" (or any other text) is present within any of the repeated rows?
Is there any way to navigate the json or parse it to XML and navigate it?
Constraint:
within the Calculated Value or Visibility fields within form builder
manipulating the source that is generated by the form builder
You probably want to parse the JSON string first. See also this other Stackoverflow question.
Until Orbeon Forms 2016.3 is released, you would write:
(
for $v in $jsonStringValue
return converter:jsonStringToXml($v)
)//name = 'Annual Summary'
With the above, you also need to scope the namespace:
xmlns:converter="org.orbeon.oxf.json.Converter"
Once Orbeon Forms 2016.3 is released you can switch to:
$jsonStringValue/xxf:json-to-xml()//name = 'Annual Summary'

Yahoo YQL API - How to select a JSON field whose name is a reserved YQL keywords?

For example, I got following JSON from a URL
{ "time": "2014-05-10 06:23:36 UTC",
"values": [
{
"time_timetable_utc": "2014-05-10T06:25:00Z",
"time_realtime_utc": null,
"flags": ""
},
{
"time_timetable_utc": "2014-05-10T06:45:00Z",
"time_realtime_utc": null,
"flags": ""
},
]
}
This will work on YQL
select time from json where url="{url}"
It will return me only time field
{"time": "2014-05-10 06:23:36 UTC"}
But if I only want to get "values" array field with following
select values from json where url="{url}"
I will get this error message
Query syntax error(s) [line 1:7 expecting fields_or_star got 'values']
Just want to ask is that possible to select a JSON field whose name is a reserved Yahoo YQL keywords?
I know this will work
select * from json where url="{url}" and itemPath="json.values"
But is that possible to do it without using "itemPath" condition?
How to escape reserved word like "values" in YQL select?
Just want to ask is that possible to select a field names "values"?
No. (Sorry!)

receiving string literals and storing it in the integer column in the database

Sendgrid says that the Categories are in the form of String data type as follows:
[
{
"email": "john.doe#sendgrid.com",
"timestamp": 1337966815,
"category": [
"newuser",
"transactional"
],
"event": "open"
},
{
"email": "jane.doe#sendgrid.com",
"timestamp": 1337966815,
"category": "olduser"
"event": "open"
}
]
So, if someone sends a numerical number , say 11111 for category, sendgrid will treat it as a string and send it back .
I always use numerical values to send and when I get the same value back, I store it in an integer column in my database. For example I will be storing
11111 value in my column category_int and it's data type is int(11).
Since, I am always storing it in an integer column, whenever someone sends category in the form of actual string just like above olduser , I get an error.
My Question:
Am I seeing error because,my category_int column is intended to receive integer values and not string values? But if this is true then, isn't the value that sendgrid is sending , in case of numbers(in my case 11111) is
treated as string and perhaps, I should be getting error in this case as well. Where as I get errors only when I send category in the form of some descriptive words like olduseretc.
Please advise.
The problem is that an int(11) column cannot contain a string. MySQL is able to understand that "11111" as a string can be changed to the int 11111 and knows how to convert it. But it doesn't know how to make olduser into an int, so it throws an error.
You could change your data type to varchar, and then that column would be able to handle both 11111 and olduser.
You could also check the value in your code before you pass it to the database, and throw out values that cannot be made into ints.