Help with nested json parser for fluentd + kubernetes collector
Hi,
I'm quite new to using sumologic collector with kubernetes. I'm trying to unpack a log attribute that contains a json message.
I used the code below to configure my elasticsearch with kibana, however I'm not sure how to make similar changes for sumologic.
<filter **>
@type parser
<parse>
@type json
json_parser json
</parse>
replace_invalid_sequence true
emit_invalid_record_to_error false
key_name message
</filter>
<filter **>
@type parser
<parse>
@type json
json_parser json
keep_time_key true
</parse>
replace_invalid_sequence true
emit_invalid_record_to_error false
key_name log
</filter>
This is a sample of the message column displayed in sumologic
{
timestamp: 1661346107025,
log : "2022-08-24T13:01:47.001331339Z stdout F {\"time\":\"2022-08-24T09:01:46.989-04:00\",\"msg\":\"An error has happened.\",\"X-REQ-SESSION-ID\":\"d8ed7bd4-5bfc-4eb4-b1da-4c4d35acbcd2\",\"traceId\":\"-\",\"spanId\":\"-\",\"parentSpanId\":\"-\",\"clientId\":\"-\",\"reqSessionId\":\"d8ed7bd4-5bfc-4eb4-b1da-4c4d35acbcd2\",\"userSessionId\":\"-\"}",
stream: null,
time: null
}
The only information that I care about is what is inside {\"time ... }
Is there a simple way to configure sumologic to unwrap that portion as the real message instead of the standard one above?
I appreciate any help.
Best,
Eduardo
Please sign in to leave a comment.
Comments
0 comments