Nested logs are not parsed correctly

TKelly — Mon, 08 Nov 2021 22:33:12 GMT

I have nested events that look like this in Splunk:

container_id: 13243d84e63d8d5b56c5
container_name: /ecs-stg-compute-instances-226-ur-2-c499f4ac
log: {"module": "ur.uhg", "functions": ["unlock_user_processing"], "session-id": "XUHWnDAAkR3AwrsXxtL339z9rEf-l", "email": "xxx@gmail.com", "user-id": 3, "user-account-id": 3, "start-time": "2021-11-08T19:59:36.711483", "end-time": null, "callback-function": "calculate_metrics", "emails-processed": 316, "emails-left-to-process": 0, "images-processed": 316, "iterations": 5, "iteration-times": [56.61728, 162.878587, 43.512794, 24.918005, 0.954233], "event": "chained_functions() called.", "level": "debug", "timestamp": "2021-11-08T20:04:25.905376Z"}
source: stdout

and a 'log' value is seen like a string even so it's a JSON object. How can I parse "log" value into key/value pairs??

Re: Nested logs are not parsed correctly

ITWhisperer — Mon, 08 Nov 2021 23:10:52 GMT

| spath input=log

topic Nested logs are not parsed correctly in Getting Data In

Nested logs are not parsed correctly

Re: Nested logs are not parsed correctly