JSON fields pretty-printing

maximvl · February 7, 2019, 9:29am

Ok, I found these discussions, seems like I should try Graylog 3.0

github.com/Graylog2/graylog-plugin-pipeline-processor

Add support for JsonNode to ´set_fields()`

Graylog2:master ← Graylog2:set_fields_json

opened 02:23PM - 28 Nov 17 UTC

joschi

+147 -1

Sometimes users might want to parse and merge the JSON payload of a message wit…h the Graylog message without knowing the complete structure of the payload or without having a fixed structure which could be selectively merged by using the `json_path()` method. This commit essentially adds the possiblity to create a pipeline rule emulating the existing JSON extractor: rule "json" when // some condition then let json = parse_json(to_string($message.some_field)); set_fields(json); end Refs: https://community.graylog.org/t/parse-unknown-json-with-pipelines/3293/7

Topic		Replies	Views
Parsing JSON in a pipeline Graylog Central (peer support)	4	2532	September 24, 2018
Creating fields from query (pipelines?) Graylog Central (peer support)	5	1912	March 19, 2019
Data output from json by fields Graylog Central (peer support) pipeline-rules	13	1558	August 17, 2021
JSON parsing in pipeline Graylog Central (peer support) pipeline-rules	11	5290	April 17, 2020
Parse_json - problems with multiline parsing? Graylog Central (peer support)	3	1233	September 24, 2019

JSON fields pretty-printing

Related Topics