Replace Nest Key

[ruiminhu]

Hey @repeatedly , I want to redact my value, the key is nested. However, just some record has both 2 level of nested keys. { "properties": { "messageTracingId": 12345, "connectionId": "ABCDE", "traceId": "akhsb:01", "hub": "chatsamplehub", "userId": "eyJAdlhopWkXY.eyJuKXE4gp4QP.hlGrujNIvT" }, "resourceId": "balabal", "time": "2023-07-10T10:45:29Z" }

I want to replace value of the [properties][userId], if it's pattern match. But not every record has properties and not each properties has userId. How should I check before I do the following?

filter mdsdlog.asrs.customer> @type record_modifier

expression /(?-i)eyJ(?i)[a-z0-9\-_%]+\.(?-i)eyJ(?i)[a-z0-9\-_%]+\.[a-z0-9\-_%]+/ key **$.properties.userId** replace "[REDACTED]"