Hi there,
is it currently possible to use the standard parse_json functionality to parse a JSON multiline object?
In our case we would like to parse also stacktraces in Java application logs.
We do that by parsing it in a pipeline function:
let json = parse_json(to_string($message.message));
let map = to_map(json);
set_fields(map);
This works for all messages, except the message contains a multiline message - transmitted via filebeat - the message is shown in graylog as full-message, but none of the fields are interpreted as JSON message.
Do we need to force this in the pipeline function?
Thanks!