title: Datadog Grok Parsing - extracting array attribute from nested JSON
body: <p>Using Datadog Parsing rule, I am trying to extract an attribute which is present inside an array.</p>
  <p>Sample I've been work on:</p>
  <pre><code>{&quot;messageHeader&quot;:{&quot;serviceId&quot;:&quot;aad1&quot;,&quot;requestType&quot;:&quot;MM&quot;},&quot;data&quot;:{&quot;code&quot;:&quot;400&quot;,&quot;reason&quot;:&quot;Bad Request&quot;,&quot;message&quot;:[{&quot;responseCode&quot;:&quot;E111&quot;,&quot;description&quot;:&quot;Unable to reserve request type&quot;}]}}
  </code></pre>
  <p>what I wanted to achieve is:</p>
  <pre><code>{
      &quot;description&quot;: &quot;Unable to reserve request type&quot;,
      &quot;responseCode&quot;: &quot;E111&quot;
  }
  </code></pre>
  <p>I tried using this method - <a href="https://stackoverflow.com/a/62096791/8552537">https://stackoverflow.com/a/62096791/8552537</a>
  but in log explorer I'm not getting the result.</p>
  <p>Following the method explained in given link. First Grok parser:-</p>
  <pre><code>parsing_rule1 %{data::json}
  </code></pre>
  <p>Output:</p>
  <pre><code>{
    &quot;data&quot;: {
      &quot;reason&quot;: &quot;Bad Request&quot;,
      &quot;code&quot;: &quot;400&quot;,
      &quot;message&quot;: [
        {
          &quot;description&quot;: &quot;Unable to reserve request type&quot;,
          &quot;responseCode&quot;: &quot;E111&quot;
        }
      ]
    },
    &quot;messageHeader&quot;: {
      &quot;requestType&quot;: &quot;MM&quot;,
      &quot;serviceId&quot;: &quot;aad1&quot;
    }
  }
  </code></pre>
  <p>To create a custom log-based metrics, First we need to create a facet for responseCode but facet type doesn't support an array.</p>
  <p>Now the goal is to pull out the details from that message field. With Grok parsers you can specify a specific attribute to parse further.</p>
  <p>So in that same pipeline I've added another grok parser processor, right after our first.</p>
  <p>And then configured the advanced options section to run on <strong>data.message</strong>, since that is what we called the attribute.
  <a href="https://i.stack.imgur.com/qQOba.png" rel="nofollow noreferrer">helper grok parser</a></p>
  <p>Result:
  <a href="https://i.stack.imgur.com/xlDdR.png" rel="nofollow noreferrer">helper grok parser result</a></p>