If you use Logtail to collect logs, you can use the processor_packjson plug-in to encapsulate one or more fields into a JSON object-formatted field. This topic describes the parameters of the processor_packjson plug-in. This topic also provides examples on how to configure the plug-in.

Important You can use form configuration to add Logtail plug-ins only if you select Kubernetes - Standard Output in the Import Data section.

Entry point

If you want to use a Logtail plug-in to process logs, you can add a Logtail plug-in configuration when you create or modify a Logtail configuration. For more information, see Entry point.

Usage notes

Important Logtail V0.16.28 and later support the processor_packjson plug-in.

Form configuration

  • Parameters
    Set Processor Type to Encapsulate Fields. Then, configure other parameters based on the following table.
    ParameterDescription
    Original FieldThe original fields to encapsulate.
    New FieldThe new field after encapsulation.
    Retain Original FieldSpecifies whether to retain the original fields in the new log that is obtained after parsing.
    Report Original Field Missing ErrorSpecifies whether to report an error if the raw log does not contain the original fields.
  • Configuration example
    The following example shows how to encapsulate the a and b fields into the d_key JSON field.
    • Raw log
      "a":"1"
      "b":"2"
    • Logtail plug-in configuration for data processing Encapsulate fields
    • Results
      "a":"1"
      "b":"2"
      "d_key":"{\"a\":\"1\",\"b\":\"2\"}"

Editor configuration in JSON

  • Parameters
    Set type to processor_packjson. Then, configure other parameters in detail based on the following table.
    ParameterTypeRequiredDescription
    SourceKeysString arrayYesThe original fields to encapsulate.
    DestKeyStringNoThe new field after encapsulation.
    KeepSourceBooleanNoSpecifies whether to retain the original fields in the new log that is obtained after parsing. Valid values:
    • true: retains the original fields. This is the default value.
    • false: does not retain the original fields.
    AlarmIfIncompleteBooleanNoSpecifies whether to report an error if the raw log does not contain the original fields. Valid values:
    • true: reports an error. This is the default value.
    • false: does not report an error.
  • Configuration example
    The following example shows how to encapsulate the a and b fields into the d_key JSON field.
    • Raw log
      "a":"1"
      "b":"2"
    • Logtail plug-in configuration for data processing
      {
        "processors":[
          {
            "type":"processor_packjson",
            "detail": {
              "SourceKeys": ["a","b"],
              "DestKey":"d_key",
              "KeepSource":true,
              "AlarmIfEmpty":true
            }
          }
        ]
      }
    • Results
      "a":"1"
      "b":"2"
      "d_key":"{\"a\":\"1\",\"b\":\"2\"}"