Log output of query parameters as proper JSON

[darkshade9]

• Neo4j version: 3.1.0
• Operating system: Ubuntu 14.04
• API/Driver: dotnet 1.1

I'm working on a Grok parser for Neo4j Query Logs so ELK can consume them in an efficient manner and we can find our slowest queries more easily.

Here's a gist I'm working on

An issue is that the parameter output is not valid JSON, and it would be extremely easy for Logstash to parse it via the json parse filter if it were so.

Example:
2017-03-27 16:09:38.851+0000 INFO 1 ms: bolt-session bolt publisher neo4j-dotnet/1.1 client/10.xx.8.x:61654 server/10.xxx.2.x:7687> publisher - MATCH (c:secretsauce) ****sanitized query**** as user, ll is not null as liked, b is not null as blocked ORDER BY rows.position - {chainId: '868e6d27-e264-4431-a7da-70769b2c3f28', userId: '5fbdecf1-28cf-48bb-99bc-f77773ae985c', offsetLinkId: 'e25378f9-4193-474e-969a-0f056ff7e11c'} - {}

The parameter portion:
{ chainId: '868e6d27-e264-4431-a7da-70769b2c3f28', userId: '5fbdecf1-28cf-48bb-99bc-f77773ae985c', offsetLinkId: 'e25378f9-4193-474e-969a-0f056ff7e11c' }
is invalid JSON, but it's very close. Could this be updated to something such as:
{ "chainId": "868e6d27-e264-4431-a7da-70769b2c3f28", "userId": "5fbdecf1-28cf-48bb-99bc-f77773ae985c", "offsetLinkId": "e25378f9-4193-474e-969a-0f056ff7e11c" }

[technige]

Hi @darkshade9. What you're actually seeing there is Cypher, rather than JSON. While they do have a lot of superficial similarity, the differences go deeper than just quoting. Given also that what we're logging here is actually Cypher parameters, conversion to JSON would necessarily be lossy. For that reason, I'm afraid I'll have to close this as wontfix.