> ## Documentation Index
> Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Decode JSON

> Learn about the decode JSON processing rule in Palo Alto Networks Telemetry Pipeline.

export const entity_0 = "decode JSON processing rule"

<Info>
  This information is for Palo Alto Networks Telemetry Pipeline, which is a standalone
  product separate from Palo Alto Networks Cortex XCOR.
</Info>

The decode JSON [processing rule](/ingest/pipeline/processing-rules) transforms an
escaped JSON string into a structured JSON object. The resulting output includes both
the original string and a new JSON object assigned to the key of your choosing.

## Configuration parameters

Use the parameters in this section to configure the {entity_0}. The
Palo Alto Networks Telemetry Pipeline web interface uses the items in the **Name** column to
describe these parameters. [Pipeline configuration files](/ingest/pipeline/v2/configure/config-files)
use the items in the **Key** column as YAML keys.

| Name | Key | Description | Default |
| - | - | - | - |
| **Source key** | `src` | Required. The key that contains the escaped JSON string to transform. | `log` |
| **Destination key** | `dst` | Required. The key to store your transformed JSON object. If a key with this name already exists, the decode JSON rule will overwrite it. | `decoded_json` |
| **Comment** | `comment` | A custom note or description of the rule's function. This text is displayed next to the rule's name in the **Actions** list in the processing rules interface. | *none* |

## Example

Using the decode JSON rule lets you extract embedded data from a string and turn
it into parsable key-value pairs. You can then use these key-value pairs in other
processing rules or for general storage and analysis.

For example, given the following sample website log data:

```json theme={null}
{"log": "{\"timestamp\":\"2023-03-28T09:08:41.64283645Z\",\"user_id\":3,\"page_id\":30,\"action\":\"purchase\"}\n"}
{"log": "{\"timestamp\":\"2023-03-28T09:08:42.643343109Z\",\"user_id\":4,\"page_id\":10,\"action\":\"purchase\"}\n"}
{"log": "{\"timestamp\":\"2023-03-28T09:08:48.643600498Z\",\"user_id\":1,\"page_id\":50,\"action\":\"click\"}\n"}
{"log": "{\"timestamp\":\"2023-03-28T09:08:50.643773688Z\",\"user_id\":5,\"page_id\":40,\"action\":\"purchase\"}\n"}
{"log": "{\"timestamp\":\"2023-03-28T09:08:51.643932272Z\",\"user_id\":1,\"page_id\":30,\"action\":\"purchase\"}\n"}
{"log": "{\"timestamp\":\"2023-03-28T09:08:56.644080944Z\",\"user_id\":2,\"page_id\":40,\"action\":\"click\"}\n"}
{"log": "{\"timestamp\":\"2023-03-28T09:09:03.64425954Z\",\"user_id\":3,\"page_id\":30,\"action\":\"click\"}\n"}
{"log": "{\"timestamp\":\"2023-03-28T09:09:03.644317046Z\",\"user_id\":1,\"page_id\":20,\"action\":\"view\"}\n"}
{"log": "{\"timestamp\":\"2023-03-28T09:09:10.64447719Z\",\"user_id\":2,\"page_id\":50,\"action\":\"purchase\"}\n"}
{"log": "{\"timestamp\":\"2023-03-28T09:09:17.644810963Z\",\"user_id\":2,\"page_id\":10,\"action\":\"view\"}\n"}
{"log": "{\"timestamp\":\"2023-03-28T09:09:20.644994805Z\",\"user_id\":1,\"page_id\":50,\"action\":\"view\"}\n"}
```

A processing rule with the **Source key** value `log` and the **Destination key**
value `output` returns the following result:

```json theme={null}
{"output":{"page_id":30,"action":"purchase","timestamp":"2023-03-28T09:08:41.64283645Z","user_id":3},"log":"{\"timestamp\":\"2023-03-28T09:08:41.64283645Z\",\"user_id\":3,\"page_id\":30,\"action\":\"purchase\"}\n"}
{"output":{"page_id":10,"action":"purchase","timestamp":"2023-03-28T09:08:42.643343109Z","user_id":4},"log":"{\"timestamp\":\"2023-03-28T09:08:42.643343109Z\",\"user_id\":4,\"page_id\":10,\"action\":\"purchase\"}\n"}
{"output":{"page_id":50,"action":"click","timestamp":"2023-03-28T09:08:48.643600498Z","user_id":1},"log":"{\"timestamp\":\"2023-03-28T09:08:48.643600498Z\",\"user_id\":1,\"page_id\":50,\"action\":\"click\"}\n"}
{"output":{"page_id":40,"action":"purchase","timestamp":"2023-03-28T09:08:50.643773688Z","user_id":5},"log":"{\"timestamp\":\"2023-03-28T09:08:50.643773688Z\",\"user_id\":5,\"page_id\":40,\"action\":\"purchase\"}\n"}
{"output":{"page_id":30,"action":"purchase","timestamp":"2023-03-28T09:08:51.643932272Z","user_id":1},"log":"{\"timestamp\":\"2023-03-28T09:08:51.643932272Z\",\"user_id\":1,\"page_id\":30,\"action\":\"purchase\"}\n"}
{"output":{"page_id":40,"action":"click","timestamp":"2023-03-28T09:08:56.644080944Z","user_id":2},"log":"{\"timestamp\":\"2023-03-28T09:08:56.644080944Z\",\"user_id\":2,\"page_id\":40,\"action\":\"click\"}\n"}
{"output":{"page_id":30,"action":"click","timestamp":"2023-03-28T09:09:03.64425954Z","user_id":3},"log":"{\"timestamp\":\"2023-03-28T09:09:03.64425954Z\",\"user_id\":3,\"page_id\":30,\"action\":\"click\"}\n"}
{"output":{"page_id":20,"action":"view","timestamp":"2023-03-28T09:09:03.644317046Z","user_id":1},"log":"{\"timestamp\":\"2023-03-28T09:09:03.644317046Z\",\"user_id\":1,\"page_id\":20,\"action\":\"view\"}\n"}
{"output":{"page_id":50,"action":"purchase","timestamp":"2023-03-28T09:09:10.64447719Z","user_id":2},"log":"{\"timestamp\":\"2023-03-28T09:09:10.64447719Z\",\"user_id\":2,\"page_id\":50,\"action\":\"purchase\"}\n"}
{"output":{"page_id":10,"action":"view","timestamp":"2023-03-28T09:09:17.644810963Z","user_id":2},"log":"{\"timestamp\":\"2023-03-28T09:09:17.644810963Z\",\"user_id\":2,\"page_id\":10,\"action\":\"view\"}\n"}
{"output":{"page_id":50,"action":"view","timestamp":"2023-03-28T09:09:20.644994805Z","user_id":1},"log":"{\"timestamp\":\"2023-03-28T09:09:20.644994805Z\",\"user_id\":1,\"page_id\":50,\"action\":\"view\"}\n"}
```

This rule retained the original `log` string and created a new JSON object
called `output` that contains a structured version of the same key-value pairs
that are embedded in `log`.

## Related rules

For a processing rule with the opposite effect, see
[encode JSON](/ingest/pipeline/processing-rules/encode-json).
For a processing rule with a similar effect that works for any string, see
[extract keys/values](/ingest/pipeline/processing-rules/extract-keys-values).


## Related topics

- [Encode JSON](/ingest/pipeline/processing-rules/encode-json.md)
- [Extract keys/values](/ingest/pipeline/processing-rules/extract-keys-values.md)
- [Processing rules](/ingest/pipeline/processing-rules.md)
- [Decode CSV](/ingest/pipeline/processing-rules/decode-csv.md)
- [Encode CSV](/ingest/pipeline/processing-rules/encode-csv.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.