How to parse nested json in Promtail

Question

I am having the following log which is in nested JSON

{"level":30,"time":1627625600625,"pid":15676,"hostname":"admin-hp-elitebook-840-g2","reqId":"req-2","req":{"method":"POST","url":"/v1/login","hostname":"127.0.0.1:3000","remoteAddress":"127.0.0.1","remotePort":55884},"msg":"incoming request"}

From that, i would like to create labels for method, URL, host i have tried the JSON expression like below in promtail.I have tried to parse the JSON i was able to extract the req but i don't know how to parse the nested one in promtail

scrape_configs:
- job_name: plainlog
  pipeline_stages:
  - json:
      expressions:
        req: req
  - labels:
      req:
  - output:
      source: req
  static_configs:
  - targets:
      - localhost
    labels:
      job: plainlog
      __path__: /home/nidhin/Desktop/plainlog/*log

score 0 · Answer 1 · answered Sep 02 '21 at 05:02

You need to add another json stage. For every level of nested json, you add one more stage to parse data from the extracted data from the level above. EG:

  - json:
      expressions:
        req: 
  - json:
      expressions:
        method: 
      source: req

More info here: https://grafana.com/docs/loki/latest/clients/promtail/stages/json/#using-extracted-data

How to parse nested json in Promtail

1 Answers1