Here’s the related configuration of my Grafana Agent:
scrape_configs:
- job_name: integrations/messages
static_configs:
- targets:
- localhost
labels:
instance: server1.company
unit: api-messages
__path__: /var/log/company/company-api.log
job: integrations/node_exporter
pipeline_stages:
- replace:
expression: "(.*org.zalando.logbook.Logbook[ ]*:[ ]*)"
replace: ""
- template:
source: message
template: '{{ omit (mustFromJson .) "body" | mustToJson }}'
- json:
expressions:
origin: origin
type: type
correlation: correlation
duration: duration
protocol: protocol
status: status
headers: headers
remote: remote
method: method
uri: uri
host: host
path: path
scheme: scheme
port: port
- labels:
origin:
type:
correlation:
duration:
protocol:
status:
headers:
remote:
method:
uri:
host:
path:
scheme:
port:
Basically I have a log line which starts with a prefix (and removed in replace stage). The rest is a nested json, where I want to remove body from being transferred to Grafana Cloud:
{"origin":"local","type":"response","correlation":"94268499157e62c9","duration":8,"protocol":"HTTP/1.0","status":200,"headers":{"Cache-Control":["no-cache, no-store, max-age=0, must-revalidate"],"Connection":["close"],"Content-Type":["application/json"],"Date":["Sun, 01 Jun 2025 19:24:33 GMT"],"Expires":["0"],"Pragma":["no-cache"],"X-Content-Type-Options":["nosniff"],"X-Frame-Options":["SAMEORIGIN"],"X-XSS-Protection":["1; mode=block"]},"body":"SOME_ACTUAL_NESTED_JSON_REQUEST_BODY HERE"}
The body is not parsed, and no label named body is created, but it is visible in Log Context, (i.e. raw log line is being transferred to Grafana Cloud, after the replace. Replaced part is not visible.)
What am I doing wrong, how do I skip body (or replace it with XXX) before the Log context is even created? The body might be nested JSON.