Error in Parsing Arrays in JSON Logs for UDM Mapping

[vishnu_manu]

Hello , 

I have been trying to parse an array from JSON log, where the size of the array is varies in different logs. I have attached the sample of the log below.

I’ve run into an issue that I haven’t been able to resolve when trying to parse "name" from the log and  merge it to the UDM "security_result.threat_feed_name", which accepts string (repeated) values.

Here's the screenshot of the code and error:

 

 

At a high level, the code uses a "for loop" to fetch all JSON elements from the array as "elem." The "elem.name" is used to parse only the name and then merge it into the UDM.

Similarly I'm facing the same error when trying to parse the "confidenceLevel" as "security_result.confidence_score" in the UDM, which accepts float (repeated) values.

I’ve tried various possibilities to solve the error to the best of my knowledge, but I haven’t found a solution yet.

If anyone has a solution or suggestion that I can use to resolve this, please share it in a reply.