Parse_json - problems with multiline parsing?

Hi there,

is it currently possible to use the standard parse_json functionality to parse a JSON multiline object?
In our case we would like to parse also stacktraces in Java application logs.
We do that by parsing it in a pipeline function:

  let json = parse_json(to_string($message.message));
  let map = to_map(json);

This works for all messages, except the message contains a multiline message - transmitted via filebeat - the message is shown in graylog as full-message, but none of the fields are interpreted as JSON message.
Do we need to force this in the pipeline function?


I guess you actually hit a bug on this parsing. Would you mind opening a bug report over in the server repository?

1 Like

Filled a bug, thanks @jan
find it here:

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.