apFileSystem.json

{
  "jsonFields": [
    "Action",
    "Body",
    "Method",
    "StatusCode",
    "caller",
    "code",
    "deletionTimestamp",
    "endpoint",
    "error",
    "errors",
    "id",
    "kind",
    "name",
    "path",
    "status",
    "status_code",
    "uri",
    "url",
    "userAgent",
    "user_agent"
  ],
  "method": "advanced",
  "jsonLogScript": "// Function called to extract date, level, app name and message\n//\n// @param preJSONString: string - optional non-JSON string proceeding JSON object\n// @param jsonObject: {} - JSON log data\n// @returns {date: Date, level: string, category: string, appName: string, message: string, rawLine: string, additionalJSON: {} }\n//\n// category is the availability zone\n// appName is the pod name\n//\nconst extractDateLevelCategoryAppNameMessage = function (preJSONString, jsonObject) {\n    let level = 'info';\n    let date = new Date();\n    let category = '';\n    let kind = '';\n    let message = \"Message field not defined - click '?'\";\n    let additionalJSON = {};\n    const ignoreFields = [];\n    const typeahead = [];\n    // Kube object?\n    if (jsonObject.kind && jsonObject.metadata) {\n        kind = jsonObject.kind;\n        message = jsonObject.metadata.name;\n        if (jsonObject.metadata.creationTimestamp) {\n            date = new Date(jsonObject.metadata.creationTimestamp);\n        }\n        level = '';\n        additionalJSON['level'] = undefined;\n        // Errors detected by the parseJson plugin?\n        if (jsonObject['errors']) {\n            level = 'error';\n            additionalJSON['level'] = level;\n        }\n    }\n    else { // Try to dynamically find fields\n        let dateSet, levelSet, kindSet, messageSet = false;\n\n        const fieldValues = []; // array of {field, value} pairs  \n\n        // Recursively traverse JSON and build fieldValues array\n        function traverseJson(obj) {\n            for (let field in obj) {\n                const value = obj[field];\n                if (typeof field === 'string' && (typeof value === 'string' || typeof value === 'number')) {\n                    field = field.toLowerCase();\n                    fieldValues.push({ field, value });\n                } else if (typeof value === 'object' && !Array.isArray(value)) {\n                    traverseJson(value);\n                }\n            }\n        }\n        traverseJson(jsonObject);\n\n        // Check each JSON field,value pair looking for date, info, kind and message\n        for (const fieldValue of fieldValues) {\n            const field = fieldValue.field;\n            const value = fieldValue.value;\n\n            checkForDateLevelKindMessage(field, value);\n\n            if (dateSet && levelSet && kindSet && messageSet) break;\n        }\n\n        // Check for data, level, kind and message fields\n        function checkForDateLevelKindMessage(field, value) {\n            if (!dateSet) {\n                if ((field.includes('ts') || field.includes('time') || field.includes('date')) && isValidDate(value)) {\n                    dateSet = true;\n                    date = new Date(value);\n                    return;\n                }\n            }\n\n            if (typeof value !== 'string') return;\n\n            if (!levelSet) {\n                if (field === 'level') {\n                    levelSet = true;\n                    level = value;\n                    if (value.startsWith('err')) typeahead.push(field + ':' + value);\n                    return;\n                } else if (field === 'severity') {\n                    level = value;\n                    return;\n                } else if (field === 'error') {\n                    level = 'error';\n                    return;\n                }\n            }\n\n            if (field === 'error' && value.length > 0) typeahead.push(field + ':*');\n\n            if (!kindSet) {\n                if (field === 'kind' || field === 'app' || field === 'appname' || field === 'applicationname' || field === 'actionname') {\n                    kindSet = true;\n                    kind = value;\n                    return;\n                } else if (field.length <= 64 && (field.startsWith(\"thread\") ||\n                    field.startsWith('app') || field.endsWith('app'))) {\n                    kind = value;\n                    return;\n                }\n            }\n\n            if (!messageSet) {\n                if (field === 'message' || field === 'msg' || field === 'error') {\n                    messageSet = true;\n                    message = value;\n                    return;\n                } else if (field.startsWith('message')) {\n                    message = value;\n                    return;\n                }\n            }\n\n        }\n\n        // Returns true, if this is a valid date\n        function isValidDate(value) {\n            try {\n                let date = new Date(value);\n                if (date.toString() === 'Invalid Date' && typeof value === 'string') {\n                    const tokens = value.split(':', 2);\n                    if (tokens.length === 2) {\n                        let d = new Date(tokens[0]);\n                        date = new Date(d.getFullYear() + '-' + (d.getMonth() + 1) + '-' + d.getDate() + ':' + tokens[1]);\n                    }\n                }\n                if (date.toString() === 'Invalid Date') return false;\n            } catch (e) {\n                return false;\n            }\n            return true;\n        }\n    }\n\n    return { date, level, category, kind, message, rawLine: undefined, additionalJSON, ignoreFields, typeahead };\n};",
  "queries": {},
  "briefJsonFields": "{\n    \"action\": true,\n    \"status_code\": true,\n    \"StatusCode\": true,\n    \"error\": true,\n    \"errors\": true,\n    \"Method\": true,\n    \"url\": true,\n    \"uri\": true,\n    \"path\": true,\n    \"metadata.deletionTimestamp\": true\n}",
  "jsonSubQueries": "[]",
  "jsonQueries": "[]"
}