From 121082c50a04d2b5b908404a22d00ea7c67a6fed Mon Sep 17 00:00:00 2001
From: Sampras Lopes <lsampras@protonmail.com>
Date: Wed, 19 Oct 2022 12:12:21 +0530
Subject: [PATCH] Add support for parsing json log bodies in transform
 processor

Signed-off-by: Sampras Lopes <lsampras@protonmail.com>
---
 ...son_log_parse_for_transform_processor.yaml | 16 ++++++++++++
 pkg/ottl/contexts/ottllogs/logs.go            | 25 +++++++++++++++++++
 2 files changed, 41 insertions(+)
 create mode 100755 .chloggen/json_log_parse_for_transform_processor.yaml

diff --git a/.chloggen/json_log_parse_for_transform_processor.yaml b/.chloggen/json_log_parse_for_transform_processor.yaml
new file mode 100755
index 000000000000..b61d69c173d3
--- /dev/null
+++ b/.chloggen/json_log_parse_for_transform_processor.yaml
@@ -0,0 +1,16 @@
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: 'enhancement'
+
+# The name of the component, or a single word describing the area of concern, (e.g. filelogreceiver)
+component: transformprocessor
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Support extracting values from json log bodies
+
+# One or more tracking issues related to the change
+issues: [14938]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
diff --git a/pkg/ottl/contexts/ottllogs/logs.go b/pkg/ottl/contexts/ottllogs/logs.go
index 306149a36e9f..c985dac50a08 100644
--- a/pkg/ottl/contexts/ottllogs/logs.go
+++ b/pkg/ottl/contexts/ottllogs/logs.go
@@ -20,6 +20,8 @@ import (
 	"fmt"
 	"time"
 
+	jsoniter "github.com/json-iterator/go"
+
 	"go.opentelemetry.io/collector/component"
 	"go.opentelemetry.io/collector/pdata/pcommon"
 	"go.opentelemetry.io/collector/pdata/plog"
@@ -35,6 +37,7 @@ type TransformContext struct {
 	logRecord            plog.LogRecord
 	instrumentationScope pcommon.InstrumentationScope
 	resource             pcommon.Resource
+	json                 jsoniter.API
 }
 
 func NewTransformContext(logRecord plog.LogRecord, instrumentationScope pcommon.InstrumentationScope, resource pcommon.Resource) TransformContext {
@@ -42,6 +45,7 @@ func NewTransformContext(logRecord plog.LogRecord, instrumentationScope pcommon.
 		logRecord:            logRecord,
 		instrumentationScope: instrumentationScope,
 		resource:             resource,
+		json:                 jsoniter.ConfigFastest,
 	}
 }
 
@@ -120,6 +124,12 @@ func newPathGetSetter(path []ottl.Field) (ottl.GetSetter[TransformContext], erro
 		return accessSeverityNumber(), nil
 	case "severity_text":
 		return accessSeverityText(), nil
+	case "json_body":
+		mapkey := path[0].MapKey
+		if mapkey == nil {
+			return nil, fmt.Errorf("json_body needs a field to extract.")
+		}
+		return accessJsonBody(mapkey), nil
 	case "body":
 		return accessBody(), nil
 	case "attributes":
@@ -203,6 +213,21 @@ func accessSeverityText() ottl.StandardGetSetter[TransformContext] {
 	}
 }
 
+func accessJsonBody(mapKey *string) ottl.StandardGetSetter[TransformContext] {
+	return ottl.StandardGetSetter[TransformContext]{
+		Getter: func(ctx TransformContext) interface{} {
+			var parsedValue map[string]interface{}
+			err := ctx.json.UnmarshalFromString(ctx.GetLogRecord().Body().AsString(), &parsedValue)
+			if err != nil {
+				return nil
+			}
+			return parsedValue[*mapKey]
+		},
+		Setter: func(ctx TransformContext, val interface{}) {
+			// TODO: Remove this setter and throw an error during config parsing
+		},
+	}
+}
 func accessBody() ottl.StandardGetSetter[TransformContext] {
 	return ottl.StandardGetSetter[TransformContext]{
 		Getter: func(ctx TransformContext) interface{} {