Logtail JSON parsing plugin - Simple Log Service - Alibaba Cloud Documentation Center

The Logtail JSON parsing plugin parses JSON logs of the object type into key-value pairs.

Limits

JSON logs have two structures: the object type (a collection of key-value pairs) and the array type (an ordered list of values).

The Logtail JSON parsing plugin is a native plugin that parses JSON logs structured as objects. The plugin uses the top-level keys of the JSON object as field names and their corresponding values as field values. This plugin does not support parsing JSON logs structured as arrays.

Entry point

If you want to use a Logtail plug-in to process logs, you can add a Logtail plug-in configuration when you create or modify a Logtail configuration. For more information, see Overview.

Configuration parameters

Parameter	Description
Original Field	The field that contains the original log content to be parsed. The default value is content.
Retain Original Field If Parsing Fails	If you select Retain Original Field When Parsing Fails, the original field is retained if the parsing operation fails.
Retain Original Field If Parsing Succeeds	Select Retain Original Field On Successful Parsing to retain the original field after it is successfully parsed.
New Name Of Original Field	The new name for the original field. This parameter is available only if you select Retain Original Field If Parsing Fails or Retain Original Field If Parsing Succeeds.

Configuration example

Input log

{"url": "POST /PutData?Category=YunOsAccountOpLog&AccessKeyId=U0Ujpek********&Date=Fri%2C%2028%20Jun%202013%2006%3A53%3A30%20GMT&Topic=raw&Signature=pD12XYLmGxKQ%2Bmkd6x7hAgQ7b1c%3D HTTP/1.1", "ip": "10.200.98.220", "user-agent": "aliyun-sdk-java", "request": {"status": "200", "latency": "18204"}, "time": "05/Jan/2020:13:30:28"}

Logtail plugin configuration
Parsing result

References

Configure a Logtail pipeline using API operations:
Configure a processor plugin in the console:
- Collect text logs from a host
- Collect container logs from a cluster in the console (stdout/file)
Collect container logs from a Kubernetes cluster using a CRD (stdout/file)