# Json logs labels

**URL:** <https://community.grafana.com/t/json-logs-labels/90356>\
**Category:** Grafana Loki\
**Tags:** json, loki\
**Created:** [June 26, 2023, 7:30pm UTC](https://community.grafana.com/t/json-logs-labels/90356 "2023-06-26T19:30:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![marcossoares](https://avatars.discourse-cdn.com/v4/letter/m/ea666f/32.png) [@marcossoares](https://community.grafana.com/u/marcossoares)\
**Post date:** [June 26, 2023, 7:30pm UTC](https://community.grafana.com/t/json-logs-labels/90356/1 "2023-06-26T19:30:13Z")

</div>

I would like to use the log fields in json with the mapped fields. The logs are as per the attached image. What am I doing wrong?  
promtail:2.8.2  
loki:2.8.2  
grafana:9.5.2

 ![json-log-1](https://us1.discourse-cdn.com/grafana/original/3X/c/b/cbd9a2725eb4204649d46a2afc25054951aa74b9.jpeg)  
 ![json-log-2](https://us1.discourse-cdn.com/grafana/original/3X/6/d/6d653a8042260488ad4db09f7215b31790434471.jpeg)

---

<div class="post-metadata">

**Author:** ![tonyswumac](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/tonyswumac/32/22401_2.png) [@tonyswumac](https://community.grafana.com/u/tonyswumac)\
**Post date:** [June 26, 2023, 8:02pm UTC](https://community.grafana.com/t/json-logs-labels/90356/2 "2023-06-26T20:02:06Z")

</div>

Your first screenshot shows that you have nested JSON in your log, so you need to also layer your json parser:

```auto
{job="traefik/traefik"} | json | line_format "{{.log}}" | json

```

A better solution would be to parse the json during ingestion. It’s obvious that your actual log lines is inside under `log` json element, the rest are tags from probably Docker. So you should, during log ingestion, parse the json, set logline to be `log`, and turn the rest of the Docker tags to labels and discard the ones you don’t need so you have clean log lines to work with while retaining useful information.

---

<div class="post-metadata">

**Author:** ![marcossoares](https://avatars.discourse-cdn.com/v4/letter/m/ea666f/32.png) [@marcossoares](https://community.grafana.com/u/marcossoares)\
**Post date:** [June 27, 2023, 4:47pm UTC](https://community.grafana.com/t/json-logs-labels/90356/3 "2023-06-27T16:47:36Z")

</div>

Thank you @tonyswumac . I’ll check how I should handle the data during ingestion.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/grafana/original/2X/e/ef5308cc58c9e5a13187b5012eb99f406928462f.png) [@system](https://community.grafana.com/u/system)\
**Post date:** [June 26, 2024, 4:48pm UTC](https://community.grafana.com/t/json-logs-labels/90356/4 "2024-06-26T16:48:21Z")

</div>

Closed on June 26, 2024, 4:48pm UTC

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.