> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/json_extract.md).

# json\_extract

{% hint style="info" %}

### Important

Before using this JSON function, it's important that you understand how Cortex XDR treats a JSON in the Cortex Query Language. For more information, see [JSON functions](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/get-started-with-xql/json-functions.md).
{% endhint %}

**Syntax**

<details>

<summary>Regular Syntax</summary>

```programlisting
json_extract(<json_object_formatted_string>, <json_path>)
```

When a field in the \<json\_path> contains characters, such as a dot (.) or colon (:), use the syntax:

```programlisting
json_extract(<json_object_formatted_string>, "['<json_field>']")
```

</details>

<details>

<summary>Syntactic Sugar Format</summary>

To make it easier for you to write your XQL queries, you can also use the following syntactic sugar format.

```programlisting
<json_object_formatted_string> -> <json_path>{}
```

When a field in the `<json_path>` contains characters, such as a dot (.) or colon (:), use the syntax:

```programlisting
<json_object_formatted_string> -> ["<json_field>"]{}
```

</details>

**Description**

The `json_extract()` function extracts inner JSON objects by retrieving the value from the identified field. The returned datatype is always a string. If the input string does not represent a JSON object, this function fails to parse. To convert a string field to a JSON object, use the [to\_json\_string](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/to_json_string.md) function.

{% hint style="info" %}

### Important

JSON field names are case sensitive, so the key to field pairing must be identical in an XQL query for results to be found. For example, if a field value is `"TIMESTAMP"` and your query is defined to look for "timestamp", no results will be found.
{% endhint %}

{% hint style="info" %}

### Note

The field value is always returned as a string. To return the scalar values, which are not an object or an array, use [json\_extract\_scalar](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/json_extract_scalar.md).
{% endhint %}

**Examples**

Return the `storage_device_name` value from the `action_file_device_info` field.

```programlisting
dataset = xdr_data 
| fields action_file_device_info as afdi 
| alter sdn = json_extract(to_json_string(afdi), "$.storage_device_name") 
| filter afdi != null
```

Using Syntactic Sugar Format

The same example above with a syntactic sugar format.

```programlisting
dataset = xdr_data
| fields action_file_device_info as afdi
| alter sdn = to_json_string(afdi)->storage_device_name{}
| filter afdi != null
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/json_extract.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.