JSON pipeline paser

[hlayson (Heather Layson)]

I’m trying to parse this JSON object that is being displayed in the message field.

{“version”:“1.1”,“timestamp”:1615840787659,"_GL_timestamp":“2021-03-15T20:39:47.47Z”,"_GL_eventID":null,"_GL_correlation_id":null,"_GL_useragent":“kube-probe/1.18”,"_GL_env":“dev”,"_GL_sourceIP":null,“host”:“DigitalClient”,"_GL_userid":null,"_GL_appid":“Notification”,"_GL_appclass":“com.primerica.dc.notifications.mailapi.config.Profiler$$EnhancerBySpringCGLIB$$a25cd80f”,"_GL_appfunction":“healthCheck”,“level”:6,"_GL_loglevel":null,“short_message”:"",“full_message”:“After execution of healthCheck - Total execution time in milliseconds : 0”,"_GL_latency":0}

I’ve created this pipeline to parse the json, but it is not working. What am I doing wrong?

rule “K8 JSON Parser”
when
has_field(“message”)
then
set_fields(
fields:
key_value(
value: to_string($message.message),
trim_value_chars: “”,
trim_key_chars:"",
delimiters:" “,
kv_delimiters:”:"
)
);
end

[ttsandrew]

Hello @hlayson, welcome!

Why not use a JSON extractor?

That being said, are those stylized double quotes actually present in the rule? Or only as you’ve pasted the rule here? If they are present in the rule as it is installed in Graylog then they are a problem. You will need to replace U+201C and U+201D with U+0022.

[hlayson (Heather Layson)]

Thank you! That worked.