JSONPath Quick Reference

Common JSONPath Patterns

Basic Property Access

• $.status - Access top-level property
• $.detail.eventName - Access nested property
• $.metrics.cpu.usage - Access deeply nested property

Array Access

• $.items[0] - Access first element of array
• $.items[*] - Access all elements of array
• $[*] - Access all elements of root array (when the root is an array)
• $.items[0].name - Access property of array element

Filtered Access

• $.items[?(@.type=='security')] - Filter array by property value
• $.items[?(@.score>80)] - Filter array by numeric comparison
• $.items[?(@.active==true)] - Filter array by boolean value
• $..status - Find status fields at any depth

Common Mistakes to Avoid

❌ Invalid Patterns

• $.[*].status - Invalid syntax (empty property name)
• $.items[?type=='security'] - Filters must use ?(@...)
• $.items[] - Use [*] instead of empty brackets
• $items - Must start with $ or $.

✅ Correct Alternatives

• $[*].status - For root array
• $.items[*].status - For named array
• $.items[*].name - Access all names in items array
• $.items[?(@.type=='security')] - Filter items by type
• $.items - Access the items property

Examples by Use Case

Event-Based Monitoring

// Event structure:
{
  "detail": {
    "eventName": "DeleteBucket",
    "eventSource": "s3.amazonaws.com"
  },
  "status": "success"
}

// JSONPath examples:
$.detail.eventName     // "DeleteBucket"
$.detail.eventSource   // "s3.amazonaws.com"
$.status              // "success"

Resource Validation

// Resource structure:
{
  "resources": [
    { "id": "bucket-1", "encrypted": true },
    { "id": "bucket-2", "encrypted": false }
  ]
}

// JSONPath examples:
$.resources[*].encrypted    // [true, false]
$.resources[0].id          // "bucket-1"
$.resources[?(@.encrypted==false)].id  // ["bucket-2"]

Metrics and Monitoring

// Metrics structure:
{
  "metrics": {
    "cpu": { "usage": 45.5, "limit": 80 },
    "memory": { "usage": 78.2, "limit": 90 }
  }
}

// JSONPath examples:
$.metrics.cpu.usage     // 45.5
$.metrics.memory.limit  // 90

Tips for Writing JSONPath Expressions

1. Start Simple: Begin with basic paths and test them
2. Use the Examples: The UI provides example JSONPaths as placeholders
3. Test with Sample Data: Verify your JSONPath matches your actual event structure
4. Array Operations: Remember to specify array match mode (all/any) for wildcard paths
5. Validation Feedback: The UI will show errors for invalid JSONPath syntax immediately