You can encapsulate one or more fields into a JSON-formatted field by using the processor_packjson plug-in. This topic describes the parameters of the processor_packjson plug-in. This topic also provides examples to show how to configure the plug-in.

Parameters

The following table describes the parameters that you can specify in the detail parameter when you set the type parameter to processor_packjson.
Note Only Logtail V0.16.28 or later supports the plug-in.
Parameter Type Required Description
SourceKeys String array Yes The string array-formatted field to be encapsulated.
DestKey String No The destination JSON-formatted field.
KeepSource Boolean No Specifies whether to retain the source field. Default value: true. This value indicates that the source field is retained.
AlarmIfIncomplete Boolean No Specifies whether to trigger an alert if the source field is not found. Default value: true. This value indicates that an alert is triggered if the source field is not found.

Configuration example

The following example shows how to encapsulate the a and b fields into the d_key field.
  • Raw log entry
    "a":"1"
    "b":"2"
  • Logtail configurations for data processing
    {
      "processors":[
        {
          "type":"processor_packjson",
          "detail": {
            "SourceKeys": ["a","b"],
            "DestKey":"d_key",
            "KeepSource":true,
            "AlarmIfEmpty":true
          }
        }
      ]
    }
  • Result
    "a":"1"
    "b":"2"
    "d_key":"{\"a\":\"1\",\"b\":\"2\"}"