import type { FunctionDefinition } from '../../definition_types'; /** * Extracts a value from a JSON string using a subset of * JSONPath syntax. * * @example * ROW log = """{"severity":"ERROR","body":"Payment processing failed"}""" * | EVAL severity = JSON_EXTRACT(log, "severity") * * @example * ROW log = """{"severity":"ERROR","body":"Payment processing failed"}""" * | EVAL severity = JSON_EXTRACT(log, "$.severity") * * @example * ROW log = """{"resource":{"service":{"name":"order-service"}}}""" * | EVAL svc = JSON_EXTRACT(log, "resource.service.name") * * @example * FROM json_logs * | EVAL svc = JSON_EXTRACT(payload, "resource['service.name']") * | KEEP @timestamp, source, svc * | SORT @timestamp * | LIMIT 3 * * @example * ROW log = """{"spans":[{"name":"auth","duration":12},{"name":"db-query","duration":45}]}""" * | EVAL span = JSON_EXTRACT(log, "spans[1].name") * * @example * ROW log = """{"resource":{"service.name":"api-gateway","host.name":"api-server-03"},"severity":"INFO"}""" * | EVAL resource = JSON_EXTRACT(log, "resource") * * @example * ROW json = """["a","b","c"]""" * | EVAL val = JSON_EXTRACT(json, "$[1]") * | KEEP val * * @example * ROW log = """{"trace":{"spans":[{"name":"auth","events":[{"type":"start"},{"type":"end"}]},{"name":"db","events":[{"type":"query"}]}]}}""" * | EVAL event = JSON_EXTRACT(log, "trace.spans[0].events[1].type") * | KEEP event */ declare const definition: FunctionDefinition; export default definition; //# sourceMappingURL=json_extract.d.ts.map