JSON logs

Last Updated: Oct 01, 2017

A JSON formatted log can be written in two types of structures:

  • Object: A collection of name–value pairs.
  • Array: An ordered list of values.

Logtail supports JSON logs of the object type. Logtail automatically extracts the keys and values from the first layer of an object as the names and values of fields, respectively. The field value belongs to the object, array, or basic type, for example, a string or number.

Logtail does not support automatic parsing of non-object data (for example, JSON arrays). You can use regular expressions for field extraction or use the simple mode for log collection by line.

Sample log

  1. {"url": "POST /PutData?Category=YunOsAccountOpLog&AccessKeyId=U0UjpekFQOVJW45A&Date=Fri%2C%2028%20Jun%202013%2006%3A53%3A30%20GMT&Topic=raw&Signature=pD12XYLmGxKQ%2Bmkd6x7hAgQ7b1c%3D HTTP/1.1", "ip": "10.200.98.220", "user-agent": "aliyun-sdk-java", "request": {"status": "200", "latency": "18204"}, "time": "05/May/2016:13:30:28"}
  2. {"url": "POST /PutData?Category=YunOsAccountOpLog&AccessKeyId=U0UjpekFQOVJW45A&Date=Fri%2C%2028%20Jun%202013%2006%3A53%3A30%20GMT&Topic=raw&Signature=pD12XYLmGxKQ%2Bmkd6x7hAgQ7b1c%3D HTTP/1.1", "ip": "10.200.98.210", "user-agent": "aliyun-sdk-java", "request": {"status": "200", "latency": "10204"}, "time": "05/May/2016:13:30:29"}

Collect JSON logs using Logtail

For details about the standard process, refer to Quick start. Choose the corresponding configuration based on your network deployment and actual situation. This doucumentaion only shows detailed complete configuration of second step Specify Collection Mode.

  1. Enter the configuration name, log path, and choose JSON Mode for Specify Collection Mode.

  2. Choose if you need to Use System Time.

Choose if you need to Use System Time as log time based on your needs. You can choose to open or close the Use System Time fuction.

  • Open Use System Time fuction

    Use System Time means do not extract time fields of logs, and take the current time when Log Service collect this log as it’s log time.

  • Close Use System Time fuction

    Closing Use System Time fuction means extract time fields of logs and take it as log time.

    If you close the Use System Time fuction, you need to define the Key, which is extracted as time field, and define the time conversion format. For example, time field in JSON Object (05/May/2016:13:30:29) can be extracted as log time. For more information of log time format configuration, refer to Logtail time format.

1

Thank you! We've received your feedback.