// Creating Rdd    
val vals = sc.parallelize(
  """{"time":"sometext1","host":"somehost1","event":  {"category":"sometext2","computerName":"somecomputer1"}}""" ::
    Nil)

// Creating Schema   
val schema = (new StructType)
  .add("time", StringType)
  .add("host", StringType)
  .add("event", (new StructType)
    .add("category", StringType)
    .add("computerName", StringType))

import sqlContext.implicits._
val jsonDF = sqlContext.read.schema(schema).json(vals)

jsondf.printschema

root
 |-- time: string (nullable = true)
 |-- host: string (nullable = true)
 |-- event: struct (nullable = true)
 |    |-- category: string (nullable = true)
 |    |-- computerName: string (nullable = true)

// selecting columns
val df = jsonDF.select($"event.*",$"time",
  $"host")

df.printschema格式

root
 |-- category: string (nullable = true)
 |-- computerName: string (nullable = true)
 |-- time: string (nullable = true)
 |-- host: string (nullable = true)

测向显示

+---------+-------------+---------+---------+
| category| computerName|     time|     host|
+---------+-------------+---------+---------+
|sometext2|somecomputer1|sometext1|somehost1|
+---------+-------------+---------+---------+