JSON fields pretty-printing

maximvl · February 7, 2019, 9:29am

Ok, I found these discussions, seems like I should try Graylog 3.0

github.com/Graylog2/graylog-plugin-pipeline-processor

Add support for JsonNode to ´set_fields()`

Graylog2:master ← Graylog2:set_fields_json

opened 02:23PM - 28 Nov 17 UTC

joschi

+147 -1

Sometimes users might want to parse and merge the JSON payload of a message wit…h the Graylog message without knowing the complete structure of the payload or without having a fixed structure which could be selectively merged by using the `json_path()` method. This commit essentially adds the possiblity to create a pipeline rule emulating the existing JSON extractor: rule "json" when // some condition then let json = parse_json(to_string($message.some_field)); set_fields(json); end Refs: https://community.graylog.org/t/parse-unknown-json-with-pipelines/3293/7

Topic		Replies	Views
Parse unknown JSON with pipelines Graylog Central (peer support)	7	4539	November 28, 2017
Parsing JSON in a pipeline Graylog Central (peer support)	3	2615	September 10, 2018
Parsing json pipeline not working Graylog Central (peer support)	0	54	April 8, 2025
Parsing nested json from JSON path HTTP API input Graylog Central (peer support) pipeline-rules , regex-special-charac	2	2133	January 14, 2022
Graylog 4.X Not Parsing All JSON Fields with parse_json() Graylog Central (peer support) pipeline-rules	1	913	April 13, 2021

JSON fields pretty-printing

Related topics