Split huge nested JSON message with repeatble fields on Raw/Plaintext AMQP input to multiple small

Problem description
Hello i edited and i have a problem with huge messages from RabbitMQ on Raw/Plaintext AMQP Graylog input .The problem is in the huge received nested json with repeatable key names on graylog input. I want to split this huge json message to multiple small messages on Raw/Plaintext AMQP Graylog input and sight his in search table as separated messages.

Steps to try resolve problem
To separate messages I’m tried use input extractors but I didn’t get anything

Graylog version : 4.1.3+9d79c05, codename Noir

This is part of my json:

[

{

        "Level": "Information",

        "Date": "2021-07-24T04:01:21",

        "Server": "srv"

    },


        "Level": "Information",

        "Date": "2021-07-24T04:01:21",

        "Server": ""

    },

    {

        "Level": "Information",

        "Date": "2021-07-24T04:01:27",

        "Server": "srv"

    },

    {

        "Level": "Information",

        "Date": "2021-07-24T04:01:27",

        "Server": "srv"

    }

]

This is what in search query (one huge message but I need split this message to multiple)

Hello,
Is this a duplicate from here?

1 Like

Hello, not at all because past post did’t describe the problem correctly.

How did you ingest messages to rabitmq? From syslog, or directly from application?
There is howto with rsyslog and logstash here:

Rsyslog has also support for rabbitmq as output:

1 Like

Getting messages from application

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.