Solved

Hello Im Having Issues With Json Unroll And I'm Not Sure Why It's Not Working. I've Tried Everything Imaginable Path…

Forum|Forum|4 hours ago
May 15, 2026
4 replies
4 views

steven.youngkin597
New Participant

This message originated from Cribl Community Slack.
Click here to view the original link.

hello im having issues with JSON Unroll and I'm not sure why it's not working. I've tried everything imaginable path with quotes, without quotes, etc. but it still does not work. total.in_bytes is the name of the array every element of which should be extracted to a field test as a new event. But it is not working

Links for this message:
image.png

Best answer by Jon Rust

2 issues. 1. Unroll is likely what you want, not JSON unroll. I'm not clear on the history behind the distinction, but JSON Unroll is intended for stringified JSON inside _raw i think. 2. You're going to have some pain from the dot in the field name. You can use the __e[] notation to get around it

Links for this message:
image.png

Jon Rust
Employee
Answer
Forum|Forum|4 hours ago
May 15, 2026

2 issues. 1. Unroll is likely what you want, not JSON unroll. I'm not clear on the history behind the distinction, but JSON Unroll is intended for stringified JSON inside _raw i think. 2. You're going to have some pain from the dot in the field name. You can use the __e[] notation to get around it

Links for this message:
image.png

Like

Jon Rust
Employee
Forum|Forum|4 hours ago
May 15, 2026

I always recommend the destination field match the source field. Otherwise you'll end of with a copy of the original field in all the unrolled events. COuld blow up memory and processing usage.