I log messages that are JSON objects. The JSON has an array that contains objects with id:
{
...
"arr": [{"typeId": 1, "foo": "bar"}, {"typeId": 10, "foo": "other"}, ...],
...
}
Now I want to count usage of objects by type by counting all occurrences of their corresponding ID in the array.
I've tried the following query:
filter @message like '"typeId":'
| parse @message '"typeId":*,' as id
| stats count(id) as objCount by id
| sort objCount desc
Which produces a result:
| id | objCount |
|---|---|
| 113 | 28 |
| 1 | 12 |
| 296 | 10 |
| 2 | 9 |
But it looks wrong. It seems to extract only the very first ID value from each message. I know it because if I search logs by filter @message like '"typeId":113,' I get 44 occurrences.
How can I extract all matches by using parse?