<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Why are my JSON logs getting combined together in Splunk when using Bunyan? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Why-are-my-JSON-logs-getting-combined-together-in-Splunk-when/m-p/384144#M69108</link>
    <description>&lt;P&gt;I am using Bunyan (&lt;A href="https://www.npmjs.com/package/bunyan"&gt;https://www.npmjs.com/package/bunyan&lt;/A&gt;) as a logger for my node Java Script application and the log output is in the below format.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;{"name":"Product list page","hostname":"plist","pid":24,"level":30,"msg":"Time:  1537221680271","time":"2018-09-17T22:01:20.271Z","v":0}
{"name":"Product list page","hostname":"plist","pid":24,"level":30,"msg":"Cache flag is set to===&amp;gt; true","time":"2018-09-17T22:01:20.272Z","v":0}
{"name":"Product list page","hostname":"plist","pid":24,"level":30,"msg":"Response status---&amp;gt; 200","time":"2018-09-17T22:01:20.272Z","v":0}
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The data gets to logstash and then to Splunk. When I pull the data in to Splunk, I see them as below (grouped together)&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;10:01:25.505 PM 
{   [-] 
     @timestamp:     2018-08-17T22:01:25.505Z   
     LOGLEVEL:   UNKNOWN    
     kubernetes:    {   [+] 
    }   
     log:    {"name":"Product list page","hostname":"plist","pid":24,"level":30,"msg":"Time:  1537221680271","time":"2018-09-17T22:01:20.271Z","v":0}
{"name":"Product list page","hostname":"plist","pid":24,"level":30,"msg":"Cache flag is set to===&amp;gt; true","time":"2018-09-17T22:01:20.272Z","v":0}
{"name":"Product list page","hostname":"plist","pid":24,"level":30,"msg":"Response status---&amp;gt; 200","time":"2018-09-17T22:01:20.272Z","v":0}
tags:   [   [+] 
    ]   
     type:   ms_Log 
}
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I want each log entry to appear separately in Splunk as below (even better if it can be formatted). Any inputs are appreciated?&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; @timestamp:     2018-09-17T22:01:20.271Z
 LOGLEVEL:   INFO   
 kubernetes:    {   [+] 
}   
 log:   {"name":"Product list page","hostname":"plist","pid":24,"level":30,"msg":"Time:  1537221680271","time":"2018-09-17T22:01:20.271Z","v":0}
 tags:  [   [+] 
]   
 type:   Microservice_Log   



 @timestamp:     2018-09-17T22:01:20.272Z
 LOGLEVEL:   INFO   
 kubernetes:    {   [+] 
}   
 log:   {"name":"Product list page","hostname":"plist","pid":24,"level":30,"msg":"Cache flag is set to===&amp;gt; true","time":"2018-09-17T22:01:20.272Z","v":0}
 tags:  [   [+] 
]   
 type:   Microservice_Log   
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Mon, 17 Sep 2018 22:38:53 GMT</pubDate>
    <dc:creator>bbarani</dc:creator>
    <dc:date>2018-09-17T22:38:53Z</dc:date>
    <item>
      <title>Why are my JSON logs getting combined together in Splunk when using Bunyan?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Why-are-my-JSON-logs-getting-combined-together-in-Splunk-when/m-p/384144#M69108</link>
      <description>&lt;P&gt;I am using Bunyan (&lt;A href="https://www.npmjs.com/package/bunyan"&gt;https://www.npmjs.com/package/bunyan&lt;/A&gt;) as a logger for my node Java Script application and the log output is in the below format.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;{"name":"Product list page","hostname":"plist","pid":24,"level":30,"msg":"Time:  1537221680271","time":"2018-09-17T22:01:20.271Z","v":0}
{"name":"Product list page","hostname":"plist","pid":24,"level":30,"msg":"Cache flag is set to===&amp;gt; true","time":"2018-09-17T22:01:20.272Z","v":0}
{"name":"Product list page","hostname":"plist","pid":24,"level":30,"msg":"Response status---&amp;gt; 200","time":"2018-09-17T22:01:20.272Z","v":0}
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The data gets to logstash and then to Splunk. When I pull the data in to Splunk, I see them as below (grouped together)&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;10:01:25.505 PM 
{   [-] 
     @timestamp:     2018-08-17T22:01:25.505Z   
     LOGLEVEL:   UNKNOWN    
     kubernetes:    {   [+] 
    }   
     log:    {"name":"Product list page","hostname":"plist","pid":24,"level":30,"msg":"Time:  1537221680271","time":"2018-09-17T22:01:20.271Z","v":0}
{"name":"Product list page","hostname":"plist","pid":24,"level":30,"msg":"Cache flag is set to===&amp;gt; true","time":"2018-09-17T22:01:20.272Z","v":0}
{"name":"Product list page","hostname":"plist","pid":24,"level":30,"msg":"Response status---&amp;gt; 200","time":"2018-09-17T22:01:20.272Z","v":0}
tags:   [   [+] 
    ]   
     type:   ms_Log 
}
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I want each log entry to appear separately in Splunk as below (even better if it can be formatted). Any inputs are appreciated?&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; @timestamp:     2018-09-17T22:01:20.271Z
 LOGLEVEL:   INFO   
 kubernetes:    {   [+] 
}   
 log:   {"name":"Product list page","hostname":"plist","pid":24,"level":30,"msg":"Time:  1537221680271","time":"2018-09-17T22:01:20.271Z","v":0}
 tags:  [   [+] 
]   
 type:   Microservice_Log   



 @timestamp:     2018-09-17T22:01:20.272Z
 LOGLEVEL:   INFO   
 kubernetes:    {   [+] 
}   
 log:   {"name":"Product list page","hostname":"plist","pid":24,"level":30,"msg":"Cache flag is set to===&amp;gt; true","time":"2018-09-17T22:01:20.272Z","v":0}
 tags:  [   [+] 
]   
 type:   Microservice_Log   
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Mon, 17 Sep 2018 22:38:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Why-are-my-JSON-logs-getting-combined-together-in-Splunk-when/m-p/384144#M69108</guid>
      <dc:creator>bbarani</dc:creator>
      <dc:date>2018-09-17T22:38:53Z</dc:date>
    </item>
  </channel>
</rss>

