JSON parser

JSON parser is used for parsing events (or events parts) with a JSON structure.

parser_json.yaml

define:
    name: JSON parser
    type: parsec/parser/json
    field: <custom_field>
    target: <custom_target>

When field is specified, parsing is applied to that field; by default, it is applied to the original event.

When target is specified, the parsed object is stored in the designated target field; by default, it is stored with json key. The custom target field must adhere to the regular expression json[0-9a-zA-Z] (beginning with "json" followed by any alphanumeric character).

Example

1. The following original event with a JSON structure is parsed by the JSON parser with the default settings:

   {
       "key": {
           "foo": 1,
           "bar": 2
       }
   }
   

   10_parser.yaml

   define:
       name: JSON parser
       type: parsec/parser/json
   

   The result event will be:

   {
       "json": <JSON object>,
   }
   

2. The following event includes JSON part inside, so JSON parser can be applied on this preparsed field and the result will be stored in the custom jsonMessage field:

   <14>1 2023-05-03 15:06:12 {"key": {"foo": 1, "bar": 2}}
   

   20_parser_message.yaml

   define:
       name: JSON parser
       type: parsec/parser/json
       field: message
       target: jsonMessage
   

   The result event will be:

   ```json
   {
       "log.syslog.priority": 14,
       "@timestamp": 140994182325993472,
       "message": "{"key": {"foo": 1, "bar": 2}}",
       "jsonMessage": <JSON object>
   }
   ```