You can use a Logtail plug-in to parse JSON logs of the object type into key-value pairs.
Limits
JSON logs can be written in the object or array structure. A log in the object structure contains key-value pairs, and a log in the array structure contains an ordered list of values.
You can use a Data Parsing (JSON Mode) plug-in, which is a native plug-in, to parse JSON logs of the object type and extract key-value pairs from the first layer of each object. The extracted keys are used as field names, and the extracted values are used as field values. You cannot use a Data Parsing (JSON Mode) plug-in to parse JSON logs of the array type.
Entry point
If you want to use a Logtail plug-in to process logs, you can add a Logtail plug-in configuration when you create or modify a Logtail configuration. For more information, see Overview.
Configuration description
Parameter | Description |
Original Field | The original field that stores the log content before parsing. Default value: content. |
Retain Original Field if Parsing Fails | Specifies whether to retain the original field in the new log that is obtained after the raw log fails to be parsed. |
Retain Original Field if Parsing Succeeds | Specifies whether to retain the original field in the new log that is obtained after parsing. |
New Name of Original Field | The new name of the original field that you want to retain. If you select Retain Original Field if Parsing Fails or Retain Original Field if Parsing Succeeds, you can rename the original field that stores the original log content. |
Configuration example
Raw log
{"url": "POST /PutData?Category=YunOsAccountOpLog&AccessKeyId=U0Ujpek********&Date=Fri%2C%2028%20Jun%202013%2006%3A53%3A30%20GMT&Topic=raw&Signature=pD12XYLmGxKQ%2Bmkd6x7hAgQ7b1c%3D HTTP/1.1", "ip": "10.200.98.220", "user-agent": "aliyun-sdk-java", "request": {"status": "200", "latency": "18204"}, "time": "05/Jan/2020:13:30:28"}Logtail plug-in configuration
Parsing result
