JSON in message field is no parsed

[michael-aldridge]

Kibana just shows the message fields as a JSON blob instead of pulling out each of the fields. Think this is an issue related to this.

See fluent/fluentd#2021

[idohalevi]

@michael-aldridge
Can you please share a sample of the log the is not parsed?

[michael-aldridge]

In my (node.js) app if I run

console.log(JSON.stringify({event: 'starting request', thing: 'other'}));

I get this as part of my kibana log (viewing the log using the JSON tab)

 "message": "{\"event\":\"starting request\",\"thing\":\"other\"}\n",

[idohalevi]

@michael-aldridge
I'll take a look.

[bdashrad]

We had the same issue. One problem we ran into is that some of the docker logs are in json format and some are not, and trying to deal with this conditionally in fluentd was problematic. We ended up not parsing the json on the fluentd side and having logz.io parse it conditionally after shipping.

[bdashrad]

It's because of this change made to fluent-plugin-kubernetes_metadata_filter, where they stopped parsing nested json.

[idohalevi]

@bdashrad @michael-aldridge
I read the thread you both mentioned. For now, we will keep parsing it on our (Logz.io) side - contact support.
If you feel in any way you prefer otherwise let me know or send a PR here with the solution.

[bahtou]

@michael-aldridge what was the solution for you?