Parsing JSON Logs from Falco

Dear, I searched for a post with this problem but did not find any. That is why I come to you.

I have this FALCO log, in Loki.

How do I parse the JSON? I understand that it should be something like this:

{namespace="falco"} | json "" as namespace

Where am I going wrong?


I found!

{namespace=“falco”} | json | output_fields_k8s_ns_name=“falco”

1 Like