JSON inside log

[raicum]

Hi guys,

My log is JSON format, and inside the “message” label i have some other JSON formatted text, but it is not displayed as JSON. It is displayed like this:

“@timestamp”: “2023-01-11T12:49:35.456Z”,

“@version”: “1”,

“logger”: “example”,

“level”: “infoerrordebug”,

“message”: “key: value { \n class Example { \n timestamp: 2023-01-11T12:49:34Z eventType:exampleValue \n key: value \n key:value \n } key4: value4 \n key5:value5 \n key6:value6 \n key7:value7 \n info: value \n key8:value8 \n ErrorCode: 15 \n dateErrorOverriden: null \n}”,*

“stacktrace”: “”,

“thread”: “eventsExecutor-33”

How can i make the text in the “message” label to also be displayed also as JSON?

Thanks!

[raicum]

activating the escapenewline feature, somehow works, but i think there may be a better solution.

[pooh]

I would suggest that the content of the “message” field is not in fact JSON
because there are no commas separating the key:value pairs.

Antony.

[raicum]

@pooh thanks for the explanation. I am currently having another issue. I am trying to display some labels and their values in a table and i can’t figure it out. In splunk was enough to write: table label1 label2 label3.

Please help. Thank you!

[tonyswumac]

As someone above already pointed out, the message field isn’t actually json formatted because it doesn’t have the comma separator nor does it have the double quote (which should be escaped) that normally enclose all json fields.

But, if it’s indeed JSON format and you were just trying to put down some example by hand, you should be able to double parse your log lines. For example:

{logger="example"}
  | line_format "{{.message}}"
  | json
  | __error__ = ""

Or if it’s indeed not JSON, then you can substitute the json part with some sort of patterns.