1. Describe your incident: I have pre-normalized json-formatted logs that I’m trying ingest into Graylog. I have to use the pipeline to process the logs because that’s the only way I can do the right thing based on the pod/namespace/image that generated the log. The problem is that when I use the …

I am not good at tracking down json formatting issues but when I did have to play around in there I found this site very helpful in validating json info. Also - with a little hunting around, there is this community post here that really gets some more detail about json - in particular in your code …

Thank you! The prenormalized_debug_map is not valid json, but I also don’t know if it should be. OTOH, prenormalized_debug_json is valid json, and matches the input message, so I’m confident that it works. As a point of comparison, the same message works properly when handled by an extractor. The …

Pipeline processing json logs

Graylog Central (peer support)

tmacgbay (Tmacgbay) May 12, 2022, 9:17pm 4

Another bit of poking around - here is a post that talks about using regex to extract just the json from a message. It may clean up messages that have extra and are causing errors.

Topic		Replies	Views
Extract Json via Pipeline Graylog Central (peer support)	5	3779	July 25, 2022
Failing JSON Extractor Graylog Central (peer support) pipeline-rules , debuggingpl	13	6146	December 14, 2018
Syslog -> input -> stream -> pipeline: JSON sources appear to be problematic Graylog Central (peer support)	2	62	February 1, 2026
Pipeline rule to extract json not working Graylog Central (peer support)	6	1207	June 13, 2022
Parse unknown JSON with pipelines Graylog Central (peer support)	7	4550	November 28, 2017

Pipeline processing json logs

Related topics