Accessing nested JSON values in the config


#1 gportnoy

Can't find this in the documentation and it seems like it should be fairly obvious, so apologies if this is a dumb question. Given the below JSON, if I perform parse_json($raw_event) with Flatten set to the default value of FALSE, how do I access the $header.time_seconds_epoch value, or any other nested value within the config? If Flatten is set to TRUE, then $header.time_seconds_epoch has the expected value in it, but with it set to FALSE, $header.time_seconds_epoch is NULL.

{ "event_severity": 0, "header": {"event_name": "test", "time_seconds_epoch": 1588267608},"host_info": {"host_name": "test"}}