You can use the processor_json plug-in to expand JSON fields. This topic describes the parameters of the processor_json plug-in. This topic also provides an example on how to configure the plug-in.
Parameters
If you set type to processor_json, you can configure the parameters in detail based on the following table.
Note Only Logtail V0.16.28 and later support the processor_json plug-in.
Parameter | Type | Required | Description |
---|---|---|---|
SourceKey | String | Yes | The name of the raw field. |
NoKeyError | Boolean | No | Specifies whether to report an error if the raw field is not matched. If you do not include this parameter in the configuration, the value true is used by default. This value indicates that an error is reported if the raw field is not matched. |
ExpandDepth | Int | No | The depth of JSON expansion. If you do not include this parameter in the configuration, the value 0 is used by default. This value indicates the depth of JSON expansion is unlimited. If the value is n, the depth of JSON expansion is n. |
ExpandConnector | String | No | The character that is used to connect expanded keys. You can leave this parameter empty. If you do not include this parameter in the configuration, an underscore (_) is used by default. |
Prefix | String | No | The prefix that is added to expanded keys. If you do not include this parameter in the configuration, this parameter is considered empty. |
KeepSource | Boolean | No | Specifies whether to retain the raw field. If you do not include this parameter in the configuration, the value true is used by default. This value indicates that the raw field is retained. |
UseSourceKeyAsPrefix | Boolean | No | Specifies whether to add the name of the raw field as a prefix to all expanded keys. If you do not include this parameter in the configuration, the value false is used by default. This value indicates that the name of the raw field is not added. |
KeepSourceIfParseError | Boolean | No | Specifies whether to retain the raw log if the log fails to be parsed. If you do not include this parameter in the configuration, the value true is used by default. This value indicates that the raw log is retained. |
Configuration example
The following example shows how to expand the JSON field s_key and add j and the name of the raw field s_key as a prefix to the expanded keys.
- Raw log
"s_key":"{\"k1\":{\"k2\":{\"k3\":{\"k4\":{\"k51\":\"51\",\"k52\":\"52\"},\"k41\":\"41\"}}})"
- Logtail plug-in configurations for data processing
{ "processors":[ { "type":"processor_json", "detail": { "SourceKey": "s_key", "NoKeyError":true, "ExpandDepth":0, "ExpandConnector":"-", "Prefix":"j", "KeepSource": false, "UseSourceKeyAsPrefix": true } } ] }
- Result
"js_key-k1-k2-k3-k4-k51":"51" "js_key-k1-k2-k3-k4-k52":"52" "js_key-k1-k2-k3-k41":"41"