Datadog: Remap a field from an array inside an attribute

Question

The log has come into datadog as a JSON object and attributes have been parsed automatically.

Next I want to extract the owner field from an array nested in the JSON:

This syntax doesn't work does in datadog: @detail.resources[0].tags.owner

{
  name: "example_name"
  detail: { 
    resources: [
     /*0*/ { tags: {owner: "[email protected]"}}, 
     /*1*/ { tags: {owner: "[email protected]"}}
    ]
}

This syntax doesn't work does in datadog: @detail.resources[0].tags.owner

each value in the array should have the same owner. How can I use datadog processors to remap the first found email from this array to another attribute called @application.owner? Do I have to unparse the JSON somehow and use a Grok Processor?

Answer 1

I had the same issue. What has worked for me at the end is using a Remapper, for example:

Set attribute(s) or tag key to remap: detail.resources.0.tags.owner

Set target attribute or tag key: application.owner