Configuring the JSON parser

The Message Bus Probe JSON parser can be configured to process different JSON event structures according to the endpoint set by the probe's transport module. This is useful when the event source system sends different JSON data structure depending on the API. For example, some event sources supports alarm query for clients to pull or re-synchronize alarms will return a batch or array of alarms while notification events are usually sent individually.

The JSON parser has several configurable property in order to traverse the JSON event and extract data to create an event. The following table shows the configurable parameters of the parser:

Table 1. Configurable parser parameters

Parameter name

Description

endpoint

The endpoint name. This value must match the endpoint set by the probe's transport module and may vary between transport types. Some of the probe helm charts may not expose this parameter,and it is preconfigured in the helm chart template.

messagePayload

Specifies the JSON tree to be identified as message payload.

messageHeader

Specifies the JSON tree to be identified as a message header. Attributes from the headers will be added to the generated event.

jsonNestedPayload

Specifies JSON tree within a nested JSON or JSON string to be identified as message payload. messagePayload is used to specify the path to the attribute which value has the nested JSON string.

jsonNestedHeader

Similar to jsonNestedPayload, this parameter specifies the JSON tree within a nested JSON or JSON string to be identified as message header. messagePayload is used to specify the path to the attribute which value has the nested JSON string.

messageDepth

Specifies the number of levels in the message to traverse during parsing.

Parsing a JSON event with child nodes

The following sample shows a JSON event with child nodes.


{
    "message" : {
        "alarm": {
            "type":1,
            "title":"Bluemix Alert SEV2 - ibm.env5_syd.fabric.bosh.memoryPercent : st_bosh_mem_high memory percent > 93",
            "message":"Metrics: ibm.env5_syd.fabric.bosh.memoryPercent, Situation: st_bosh_mem_high ",
            "target":"ibm.env5_syd.fabric.bosh.memoryPercent",
            "situation":"st_bosh_mem_high",
            "isrecovered":false,
            "severity":2,
            "receivers":"administrator@mydomain.com",
            "timestamp":1481871659514
        }
    }
}

Given the sample JSON event as shown above, the parser can be configured to produce the following output for further rules files parsing and mapping to Object Server fields.

Table 2. Parser configuration for a JSON event with child nodes

Parser configuration

Parser output (key=value)

messagePayload= json.message.alarm

 
isrecovered=false
message=Metrics: ibm.env5_syd.fabric.bosh.memoryPercent, 
   Situation: st_bosh_mem_high
receivers=administrator@mydomain.com
resync_event=false
severity=2
situation=st_bosh_mem_high
target=ibm.env5_syd.fabric.bosh.memoryPercent
timestamp=1481871659514
title=Bluemix Alert SEV2 - ibm.env5_syd.fabric.bosh.memoryPercent : 
   st_bosh_mem_high memory percent > 93
type=1

messagePayload=json.message

 
alarm.isrecovered=false
alarm.message=Metrics: ibm.env5_syd.fabric.bosh.memoryPercent, 
   Situation: st_bosh_mem_high 
alarm.receivers=administrator@mydomain.com
alarm.severity=2
alarm.situation=st_bosh_mem_high
alarm.target=ibm.env5_syd.fabric.bosh.memoryPercent
alarm.timestamp=1481871659514
alarm.title=Bluemix Alert SEV2 - ibm.env5_syd.fabric.bosh.memoryPercent : 
   st_bosh_mem_high memory percent > 93
alarm.type=1
resync_event=false

Parsing a JSON event with an array

The sample JSON below contains a data attribute which is an array of data elements.


{
  "data": [
    {
      "id": "1222383102379613532",
      "type": "FilteredAlarm",
      "attributes": {
        "id": "1234567",
        "node-id": "node01",
        "state": "ACTIVE",
        "resource": "SWITCH",
        "condition-severity": "CRITICAL",
        "first-raise-time": "2017-07-06T13:43:19.000+0000",
        "last-raise-time": "2017-07-06T13:43:19.000+0000",
        "number-of-occurrences": 1,
        "acknowledge-state": "NOT_ACKNOWLEDGED"
        }
    },
    {
      "id": "-4067638085156070319",
      "type": "FilteredAlarm",
      "attributes": {
        "id": "7654321",
        "node-id": "node02",
        "state": "ACTIVE",
        "resource": "SWITCH",
        "condition-severity": "CRITICAL",
        "first-raise-time": "2017-07-06T13:42:59.000+0000",
        "last-raise-time": "2017-07-06T13:42:59.000+0000",
        "number-of-occurrences": 1,
        "acknowledge-state": "NOT_ACKNOWLEDGED"
        }
    }
  ]
}

Given the previous sample JSON event, the parser can be configured with the following.

Note: If the messagePayload is set to the parent attribute of the payload (json or the root), the array element will be indexed. When messagePayload is pointed to an array node, each array element becomes a single event.
Table 3. Parser configuration for a JSON event with an array

Parser configuration

Parser output (key=value)

messagePayload=json.data

 
attributes.acknowledge-state=NOT_ACKNOWLEDGED
attributes.condition-severity=CRITICAL
attributes.first-raise-time=2017-07-06T13:43:19.000+0000
attributes.id=1234567
attributes.last-raise-time=2017-07-06T13:43:19.000+0000
attributes.node-id=node01
attributes.number-of-occurrences=1
attributes.resource=SWITCH
attributes.state=ACTIVE
id=1222383102379613532
resync_event=false
type=FilteredAlarm

messagePayload=json

 
data.0.attributes.acknowledge-state=NOT_ACKNOWLEDGED
data.0.attributes.condition-severity=CRITICAL
data.0.attributes.first-raise-time=2017-07-06T13:43:19.000+0000
data.0.attributes.id=1234567
data.0.attributes.last-raise-time=2017-07-06T13:43:19.000+0000
data.0.attributes.node-id=node01
data.0.attributes.number-of-occurrences=1
data.0.attributes.resource=SWITCH
data.0.attributes.state=ACTIVE
data.0.id=1222383102379613532
data.0.type=FilteredAlarm
data.1.attributes.acknowledge-state=NOT_ACKNOWLEDGED
data.1.attributes.condition-severity=CRITICAL
data.1.attributes.first-raise-time=2017-07-06T13:42:59.000+0000
data.1.attributes.id=7654321
data.1.attributes.last-raise-time=2017-07-06T13:42:59.000+0000
data.1.attributes.node-id=node02
data.1.attributes.number-of-occurrences=1
data.1.attributes.resource=SWITCH
data.1.attributes.state=ACTIVE
data.1.id=-4067638085156070319
data.1.type=FilteredAlarm
resync_event=false

Parsing a JSON event with a Nested JSON String

The following sample JSON contains a value attribute which has a nested JSON string.


{
  "payload": {
    "id": 1,
    "body": {
      "value": "{\"header\":{\"timestamp\":\"2017-07-06T09:07:56Z\",\"event\":{\"alarm\":{\"id\":\"1234567\",\"resource\":
       \"4\",\"node-id\":\"node01\",\"condition-type\":\"Link Down\",\"condition-severity\":\"WARNING\",\"condition-source\":
       \"NETWORK\",\"condition-state\":\"ACTIVE\",\"additional-text\":\"Link 
       Down\",\"first-raise-time\":\"2000-01-01T00:00:58.000+0000\",\"last-raise-time\":\"2000-01-01T00:00:58.000+0000\",\
       "number-of-occurrences\":1,\"acknowledge-state\":\"ACKNOWLEDGED\",\"acknowledge-update-time\":
       \"2017-07-06T09:07:56.463+0000\",\"additional-attrs\":{\"source\":\"EMS-1\"}},\"_type\":\"alarmAcknowledged\"}}}",
      "attributes": 1
    }
  },
  "event": "sample_alarm"
}

The following table shows several configurations and the generated output of the probe parser for rules files parsing.

Note: The messagePayload parameter is set to the attribute which value contains a JSON string and jsonNestedPayload is set to the attribute within the JSON string to be treated as a payload to create an event.
Table 4. Parser configuration for a JSON event with a nested JSON string

Parser configuration

Parser output (key=value)

messagePayload=json.payload.body.value jsonNestedPayload=json.header.event.alarm

 
acknowledge-state=ACKNOWLEDGED
acknowledge-update-time=2017-07-06T09:07:56.463+0000
additional-attrs.source=EMS-1
additional-text=Link Down
condition-severity=WARNING
condition-source=NETWORK
condition-state=ACTIVE
condition-type=Link Down
first-raise-time=2000-01-01T00:00:58.000+0000
id=1234567
last-raise-time=2000-01-01T00:00:58.000+0000
node-id=node01
number-of-occurrences=1
resource=4
resync_event=false

messagePayload=json.payload.body.value jsonNestedPayload=json.header.event

 
type=alarmAcknowledged
alarm.acknowledge-state=ACKNOWLEDGED
alarm.acknowledge-update-time=2017-07-06T09:07:56.463+0000
alarm.additional-attrs.source=EMS-1
alarm.additional-text=Link Down
alarm.condition-severity=WARNING
alarm.condition-source=NETWORK
alarm.condition-state=ACTIVE
alarm.condition-type=Link Down
alarm.first-raise-time=2000-01-01T00:00:58.000+0000
alarm.id=1234567
alarm.last-raise-time=2000-01-01T00:00:58.000+0000
alarm.node-id=node01
alarm.number-of-occurrences=1
alarm.resource=4
resync_event=false