Hive’s get_json_object is quiet handy to query for key-value pairs if data column is a json string.
Problem comes when the key you want to look has special characters. I tumbled upon the same kind of issue very recently. Here is my json string
{"req.httpVersion":"1.0","req.method":"GET","req.ip":"4.79.64.50","req.protocol":"http","req.headers.connection":"close","req.headers.te":"deflate,gzip;q=0.3","meta.duration":null,"meta.xduration":0,"meta.state":3,"level":"info","message":"","timestamp":"2013-11-18T04:25:41.288Z"}Extracting ‘message’ or ‘timestamp’ is straight forward with get_json_object. When you query for say ‘req.headers.connection’ it considers ‘req’ and ‘headers’ to be array and looks for ‘connection’ parameter inside it.
Here is small workaround to get its value
SELECT get_json_object(regexp_replace(`data`, 'req.headers.connection', 'connection'), '$.connection') FROM unstructured_traffic_table WHERE hour = 0 LIMIT 1;