List of possible expressions used along with the previously mentioned operators, based on above JSON input payload.

For Sample 1:
  1. Contains:
    $.network[?(@.type =~ /^.*ip.*$/i)]

    The expression looks for the element "type" under "network" that contains the "ip" string.

  2. Match on prefix:
    $.network[?(@.direction =~ /^.*inbound-.*$/i)

    The expression looks for the element "direction" under "network" that contains the prefix "inbound-" string.

  3. Match on suffix:
    $.network[?(@.direction =~ /^.*-outbound.*$/i)

    The expression looks for the element "direction" under "network" that contains the suffix "-outbound" string.

  4. Match on numeric value:
    $.network[?(@.iana_number > 10 )

    The expression looks for the element "iana_number" under "network" that contains values greater than "10".

  5. Match on string value:
    $.network[?(@.type == 'ipv6')

    The expression looks for the element "type" under "network" that contains exactly the "ipv6" string.

  6. Match on value and suffix regex:
    $.network[?(@.iana_number < 10 || @.direction =~ /^.*-outbound.*$/i)

    The expression looks for the element "iana_number" smaller than "10" and for the element "direction" that contains the suffix "-outbound" string, both under "network".

Note: For more information, refer to the JSONPath documentation. You can evaluate the expressions using the Jayway JsonPath Evaluator open source tool.
For Sample 2:
  1. Set ACTIVE, INACTIVE value based on key-value of input data using concat:
    $.concat(($.[?(@.clearTime == '')].concat(\"ACTIVE\")), ($.[?(@.clearTime != '')].concat(\"INACTIVE\")))
  2. Calculate timestamp by adding offset time using concat and transform time stamp using custom function transform_date:
    $.concat(@.alarmTime, @.alarmTimeOffset).transform_date(\"yyyy-MM-dd HH:mm:ssXXX\")
  3. Applying mathematical functions like min(), max(), avg(), stddev() on array like object:
    $.parameters.avg()