Parse_json - problems with multiline parsing?

Hi there,

is it currently possible to use the standard parse_json functionality to parse a JSON multiline object?
In our case we would like to parse also stacktraces in Java application logs.
We do that by parsing it in a pipeline function:

  let json = parse_json(to_string($message.message));
  let map = to_map(json);
  set_fields(map);   

This works for all messages, except the message contains a multiline message - transmitted via filebeat - the message is shown in graylog as full-message, but none of the fields are interpreted as JSON message.
Do we need to force this in the pipeline function?

Thanks!

I guess you actually hit a bug on this parsing. Would you mind opening a bug report over in the server repository?

1 Like

Filled a bug, thanks @jan
find it here: https://github.com/Graylog2/graylog2-server/issues/6425