0

I using logstash-logback-encoder 6.3. I want write structured arguments in Kibana. My code:

Map<String, String> extractHeaders = ...
log.debug(Markers.append("http", Map.of("url", request.getUrl(), "headers", extractHeaders)),"Some message");

And in Kibana I see this:

enter image description here

But why? Why Kibana flattened json keys? I expect this view:

"fields": {
    ....
    "http": {
        "headers": {
          "X-Auth-Token": "ew0KICAiY2xpZW50SWQiIDog",
          .....
        },
        "url": "some url"
    }
    ....
}

How I can put nested object?

My logback.xml:

<appender name="STASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <destination>${logstashHost}:${logstashPort}</destination>
        <encoder class="net.logstash.logback.encoder.LogstashEncoder">
            <provider class="net.logstash.logback.composite.loggingevent.ArgumentsJsonProvider" />
        </encoder>
</appender>
All_Safe
  • 1,339
  • 2
  • 23
  • 43
  • 2
    Which version are you using? From version 7.12 the way kibana shows the fields in the JSON tab on discover was changed, showing everything as flattened, this doesn't mean that your fields are flattened, Kibana is just the visualization tool, your data is in elasticsearch. You can change how kibana shows the json document by turning on the setting `discover:searchFieldsFromSource` in the advanced settings in Kibana. – leandrojmp Sep 21 '21 at 14:27
  • 1
    @leandrojmp is right. Other thing you can do, which is what I do usually, is to use `DEV` tool and send direct queries to elasticsearch. It renders json the way you expect it to. – Filip Sep 22 '21 at 06:21
  • Thank for you comments. They helped me to clarify everything – All_Safe Sep 22 '21 at 10:48

0 Answers0