Extracting a value (string) from a structured JSON log

Grafana Loki
,
1

Hello everyone,

I have been trying to parse a single (string) value from a structured JSON log, but with no success.

Environment: Grafana Cloud (Grafana v10.2.0-60139 (5b28e0b5))

If the value is a number this can be achieved easily with the unwrap function, but this function does not support string value.

Log example:

image

If I want to parse Assets_count:

last_over_time({cluster="$cluster", job="adapters"} | json | Asset = `Substation` | Action = `Write` | Script_name = `adapt_gis.py` | unwrap Assets_count [168h])

How can I extract a value from the log, that is a string/datetime format (such as "default log Time or a Timestamp inside the JSON)?

2

Did you try line_format?

3

Yes, I did, but that gives me just a custom format of a log line (can’t really make a chart from this).

4

Precisely what are you trying to do? Are you trying to parse the timestamp of your logline and use that for your x-axis? If so, I don’t know if that’s possible, and even if it is it most certainly won’t be ideal.

What I’d recommend is to parse the timestamp at the time when you send the log to Loki so that it is written into Loki (or Grafana Cloud) in the correct time.

5

I would like to use a value (string) from a JSON log.

In this case, I would use it in a Stat (just a string text inside). But there are more cases where I would parse those log values and use it in a simple line chart (so y-axis).

PS: How can I parse the timestamp at the time when I send the log to Loki?

6

Hello everyone,

I have managed to get the information via Extract fields transformation and Log QL | json | keep Timestamp | line_format "{{.Timestamp}}" .

I have used a Table view and it did the job perfectly.

7

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.