How can i extract a nested json key where the key includes a hyphen (-)?

Grafana Loki
, ,
1

Hi,
I’m trying to extract multiple fields into labels across a JSON log entry.
My data looks like this:

{
    "request": {
        "headers": {
            "Connection": [
                "keep-alive"
            ],
            "X-Forwarded-Proto": [
                "https"
            ]
        }
    }
}

Extracting request.headers.Connection works fine using:

json request_headers_connection="request.headers.Connections"

Trying the same thing with X-Forwarded-Proto produces the following error:

rpc error: code = Unknown desc = parse error : stage ‘| json request_header_proto=“request.headers.X-Forwarded-Proto”’ : cannot parse expression [request.headers.X-Forwarded-Proto]: unexpected char -

Trying combinations of:

json request_headers=`request.headers.["X-Forwarded-Proto"]`
json request_headers="request.headers.[`X-Forwarded-Proto`]"

fail with:

rpc error: code = Unknown desc = parse error : stage ‘| json request_headers=“request.headers.[X-Forwarded-Proto]”’ : cannot parse expression [request.headers.[X-Forwarded-Proto]]: syntax error: unexpected LSB, expecting FIELD

Trying:

json request_headers=`["request.headers.X-Forwarded-Proto"]`

Produces an empty result (ie couldn’t find it).

On the other hand, this does work, but makes it harder to extract other fields:

json request_headers="request.headers" | line_format "{{.request_headers}}"  | json proto=`["X-Forwarded-Proto"]`

Is there currently no way to extract such a nested key directly, or is there some other way to escape that would work in this situation?

Any direction would be great, thanks!

2

Figured it out after spending way too much time on it.
For the next person that encounters this, the correct format is:

json proto=`request.headers["X-Forwarded-Proto"]`
3 Likes