All Products
Search
Document Center

Simple Log Service:Parsing in JSON mode

Last Updated:Dec 20, 2023

You can use a Logtail plug-in to parse JSON logs of the object type into key-value pairs.

Limits

JSON logs can be written in the object or array structure. A log in the object structure contains key-value pairs. A log in the array structure contains an ordered list of values.

In JSON mode, Logtail parses raw JSON logs of the object type and extract key-value pairs from the first layer of each object. The extracted keys are used as field names, and the extracted values are used as field values. Logtail cannot parse JSON logs of the array type in JSON mode.

Entry point

If you want to use a Logtail plug-in to process logs, you can add a Logtail plug-in configuration when you create or modify a Logtail configuration. For more information, see Overview.

Configuration description

Parameter

Description

Original Field

The original field that is used to store the content of a log before the log is parsed. Default value: content.

Retain Original Field if Parsing Fails

If you select the Retain Original Field if Parsing Fails parameter and parsing fails, the original field is retained.

Retain Original Field if Parsing Succeeds

If you select the Retain Original Field if Parsing Succeeds parameter and parsing is successful, the original field is retained.

New Name of Original Field

If you select the Retain Original Field if Parsing Fails or Retain Original Field if Parsing Succeeds parameter, you can rename the original field to store the original log content.

Configuration example

  • Raw log

    {"url": "POST /PutData?Category=YunOsAccountOpLog&AccessKeyId=U0Ujpek********&Date=Fri%2C%2028%20Jun%202013%2006%3A53%3A30%20GMT&Topic=raw&Signature=pD12XYLmGxKQ%2Bmkd6x7hAgQ7b1c%3D HTTP/1.1", "ip": "10.200.98.220", "user-agent": "aliyun-sdk-java", "request": {"status": "200", "latency": "18204"}, "time": "05/Jan/2020:13:30:28"}
  • Logtail plug-in configurationimage.png

  • Parsing resultimage.png