String + JSON format
Automatic JSON extraction from strings
We automatically recognize when a field contains a generic string followed by a JSON, and we expand it so that you can search it easily.
Unsure if this applies to your logs? Send us a message at [email protected]!
Example of payloads Logtail supports:
1
// Simple text string
2
{"message": "Hello, Logtail!"}
3
​
4
// ... will be parsed into this
5
{
6
"message_string": "Hello, Logtail!"
7
}
8
​
9
​
10
// ---
11
​
12
​
13
// String followed by JSON
14
{"message": "Nov 30 11:22:34 localdomain sudo[14170]: {\"metadata\":{\"server_name\":\"Optimus\",\"local_time_zone\":\"GMT+1\",\"created_at\":1631689974}}"
15
​
16
// ... will be parsed into this
17
{
18
"message_string": "Nov 30 11:22:34 localdomain sudo[14170]: ",
19
"message.metadata.server_name_string": "Optimus",
20
"message.metadata.local_time_zone_string": "GMT+1",
21
"message.metadata.created_at_integer": 1631689974
22
}
23
​
24
​
25
// ---
26
​
27
// We support this automatic JSON expansion in all string fields, e.g.
28
{
29
"request": "Started GET /api/v1/heartbeat/sUTvXxY2c6yaA91RcAkxA8c5 {\"context\":{\"thread_id\":1234,\"pid\":123},\"level\":\"INFO\"}",
30
"response": "204 No Content {\"context\":{\"thread_id\":1234,\"pid\":456},\"duration\":35.63}"
31
}
32
​
33
// ... will be parsed into this
34
{
35
"request_string": "Started GET api/v1/heartbeat/sUTvXxY2c6yaA91RcAkxA8c5",
36
"request.context.thread_id_integer": 1234,
37
"request.context.pid_integer": 123,
38
"request.level_string": "INFO",
39
"response_string": "204 No Content",
40
"response.context.thread_id_integer": 1234,
41
"response.context.pid_integer": 456,
42
"response.duration_float": 35.63
43
}
44
45
​
Copied!
​
Last modified 1mo ago
Copy link