This rule is more specific than the previous ones mentioned. With JSON extract, you’ll take an existing JSON field from JSON data and pass it into one of the Coralogix metadata fields. The Coralogix metadata fields are as listed; category, class, method, severity, and thread ID. 

JSON Extract ruling takes out all the guesswork, and once you set it up, Coralogix will automatically pull the desired information from the JSON data and automatically have it on display within the Coralogix platform.