I would like to use the log fields in json with the mapped fields. The logs are as per the attached image. What am I doing wrong?
promtail:2.8.2
loki:2.8.2
grafana:9.5.2
1 Like
Your first screenshot shows that you have nested JSON in your log, so you need to also layer your json parser:
{job="traefik/traefik"} | json | line_format "{{.log}}" | json
A better solution would be to parse the json during ingestion. It’s obvious that your actual log lines is inside under log json element, the rest are tags from probably Docker. So you should, during log ingestion, parse the json, set logline to be log, and turn the rest of the Docker tags to labels and discard the ones you don’t need so you have clean log lines to work with while retaining useful information.
1 Like