0.4 - i'm trying to make the value of /message become the whole body of the json. I've tried updateattribute, updaterecord, groovyscript. I cannot find a good example of this anywhere. my snipped json looks like this, I'm happy about all other fields being lost.
{
"@timestamp": "2024-07-29T10:01:33.774Z",
...
"message": "{\"Heap_Occupancy\":68.54,\"Thread_Count\":95,\"monitoringType\":\"JVMHealth\",\"@timestamp\":\"2024\\/07\\/29 10:01:31\",\"Subsystem_Type\":\"CICS\",\"Job_Name\":\"TQCL01\",\"Threads_Blocked\":0,\"region\":\"TQCL01\",\"GCs_per_Minute\":0.0}",
"input": {
"type": "log"
}
}
what I want to end up with is
{
\"Heap_Occupancy\":68.54,\"Thread_Count\":95,\"monitoringType\":\"JVMHealth\",\"@timestamp\":\"2024\\/07\\/29 10:01:31\",\"Subsystem_Type\":\"CICS\",\"Job_Name\":\"TQCL01\",\"Threads_Blocked\":0,\"region\":\"TQCL01\",\"GCs_per_Minute\":0.0
}
can anyone help me with how to do this?
In Apache NiFi 2.x you can use EvaluateJsonPath with a user-defined property. Set the key to message (although it's arbitrary as long as the Destination property is set to flowfile-content) and the value to $.message. Make sure the Max String Length property is set high enough for the anticipated maximum message string.
I'm not sure if this (by itself) works on 1.x releases or not. If not and the message field won't be super-large (hopefully < 1 MB), you can try setting Destination to flowfile-attribute then adding a ReplaceText with the default search value and the Replacement Strategy property to Literal Replace and Replacement Value of ${message:unescapeJson()}. That should let you process the string as JSON but I haven't tried that though. Also you already have the last-resort solution :)