Forum Discussion
Unwinding nested JSON-serialized strings at the root value level
Hi, dudeed
This totally works for me:
let d='{"a":123, "b":{"c":456}}';
let d_b_c=parse_json(d).b.c;
print d_b_c;
Have you mixed two different problems in the same script?
By the way: There is no KQL in the "insert code samples" window here on the forum! 
Kind Regards,
Dennes
DennesTorres Yes, that works because that JSON is not composed of separately nested serializations.
I want to get that output with this specific input (the extra double-quotes and escapes are significant and illustrate the core issue I meant). Another words, the value of "b" was serialized first, then sometime later the entire object containing "a" and "b" was serialized to get this payload logged:
'{"a":123, "b":"{\\"c\\":456}"}' // normal one-level deser would think b = the string literal "{\"c\":456}"
I want a one-liner, if you will, that produces exactly this fully deserialized JSON from the above:
{ "a" : 123, "b" : { "c" :456 } }
One can imagine if this trick works for this simple example, it should extrapolate to deeper nestings as well; my guess is there is no simple way to do this atm - you'd need Gson or Newtonsoft-like deserialization parsing support).
Goal: add a single column to my output which is the fully-unwound deserialization of the nested source value like my example. I expect to specify that the value "b" is a serialization point in some way, to not complicate the scenario with the additional chore of auto-detecting the serialization seams.
hthHi, dudeed ,
You can use string manipulation to change the string and only after all the changes you will de-serialize the json.
I'm talking about remove the slashes ("\\") remove some quotes and so on. The KQL string replace function even supports regex.
Kind Regards,
Dennes
