JSON fields pretty-printing

maximvl · February 7, 2019, 9:29am

Ok, I found these discussions, seems like I should try Graylog 3.0

github.com/Graylog2/graylog-plugin-pipeline-processor

Add support for JsonNode to ´set_fields()`

Graylog2:master ← Graylog2:set_fields_json

opened 02:23PM - 28 Nov 17 UTC

joschi

+147 -1

Sometimes users might want to parse and merge the JSON payload of a message wit…h the Graylog message without knowing the complete structure of the payload or without having a fixed structure which could be selectively merged by using the `json_path()` method. This commit essentially adds the possiblity to create a pipeline rule emulating the existing JSON extractor: rule "json" when // some condition then let json = parse_json(to_string($message.some_field)); set_fields(json); end Refs: https://community.graylog.org/t/parse-unknown-json-with-pipelines/3293/7

Topic		Replies	Views
Parse unknown JSON with pipelines Graylog Central (peer support)	8	4513	December 12, 2017
Parsing JSON in a pipeline Graylog Central (peer support)	4	2600	September 24, 2018
JSON extraction in pipeline rules Graylog Central (peer support) pipeline-rules	7	5547	November 9, 2017
Failing JSON Extractor Graylog Central (peer support) pipeline-rules , debuggingpl	14	6025	December 28, 2018
Graylog 4.X Not Parsing All JSON Fields with parse_json() Graylog Central (peer support) pipeline-rules	2	894	April 27, 2021

JSON fields pretty-printing

Related topics