Parsing JSON Logs from Falco

[santiagoagustinferna]

Dear, I searched for a post with this problem but did not find any. That is why I come to you.

I have this FALCO log, in Loki.

How do I parse the JSON? I understand that it should be something like this:

{namespace="falco"} | json "output_fields.k8s.ns.name" as namespace

Where am I going wrong?

Thanks!!!

[santiagoagustinferna]

I found!

{namespace=“falco”} | json | output_fields_k8s_ns_name=“falco”