How to parse data into json once more

[leelax22]

In the screenshot I uploaded, I parsed the data into json once and got the key and value in the field, but since the log entries [properties_log] are in json, I want to parse them once again, so how can I manipulate them?

[tonyswumac]

You might try something like this:

{<LABEL_SELECTOR>} | JSON | line_format "{{.log}}" | JSON

I would recommend you to adjust your log ingestion a bit though. Looking at your screenshot, it seems that your real “log” is in the field properties.log (similar to what one might see from Docker log driver, where the actual log is enclosed in a subfield with other JSON keys that provide metadata), so you should try to preserve that, meaning your log line should be just that.

So I’d recommend to parse your log line a little bit on the ingestion agent, turn all the top level keys into labels (and get rid of the ones you don’t care about as well), and use the property.log as your message body. It’ll make your logs much cleaner on Loki, and easier to parse. Just my opinions.

[leelax22]

Thank you for your response. I’m trying grafana agent flow as the injection agent and re-labeling it. I’ll have to try line_format as well, it seems to be quite tricky. Thanks so much for the insight.

[dannykopping]

JSON is not a valid LogQL pipeline; it should be json.