You can use a Logtail plug-in to parse JSON logs of the object type into key-value pairs.
Limits
JSON logs can be written in the object or array structure. A log in the object structure contains key-value pairs. A log in the array structure contains an ordered list of values.
In JSON mode, Logtail parses raw JSON logs of the object type and extract key-value pairs from the first layer of each object. The extracted keys are used as field names, and the extracted values are used as field values. Logtail cannot parse JSON logs of the array type in JSON mode.
Entry point
If you want to use a Logtail plug-in to process logs, you can add a Logtail plug-in configuration when you create or modify a Logtail configuration. For more information, see Overview.
Configuration description
Parameter | Description |
Original Field | The original field that is used to store the content of a log before the log is parsed. Default value: content. |
Retain Original Field if Parsing Fails | If you select the Retain Original Field if Parsing Fails parameter and parsing fails, the original field is retained. |
Retain Original Field if Parsing Succeeds | If you select the Retain Original Field if Parsing Succeeds parameter and parsing is successful, the original field is retained. |
New Name of Original Field | If you select the Retain Original Field if Parsing Fails or Retain Original Field if Parsing Succeeds parameter, you can rename the original field to store the original log content. |
Configuration example
Raw log
{"url": "POST /PutData?Category=YunOsAccountOpLog&AccessKeyId=U0Ujpek********&Date=Fri%2C%2028%20Jun%202013%2006%3A53%3A30%20GMT&Topic=raw&Signature=pD12XYLmGxKQ%2Bmkd6x7hAgQ7b1c%3D HTTP/1.1", "ip": "10.200.98.220", "user-agent": "aliyun-sdk-java", "request": {"status": "200", "latency": "18204"}, "time": "05/Jan/2020:13:30:28"}Logtail plug-in configuration
Parsing result
