Problem formatting string to json

trem124 — Tue, 10 Nov 2020 17:27:35 GMT

Hi,

I have the following String that is logged by the application and I am wondering if there is a way to pretty print it just like the rest of the logs.

Here is the raw data :

{"timestamp":"2020-11-10T15:27:02.187Z","level":"INFO","thread":"main","logger":"ca.nbc.payment.pmtinternationallibrary.config.MyApplicationContextInitializer","message":"{\"code\": \"CODE\",\"text\":null,\"origin\":null,\"rule\": \"RULE\"}","context":"default"}

I guess it has something to do with the characters being escaped but I did not find anything that got it to work properly.

I would like to have something like :

{
"timestamp": "2020-11-09T20:54:57.245Z",
"level": "INFO",
"thread": "main",
"logger": "ca.nbc.payment.pmtinternationallibrary.config.MyApplicationContextInitializer",
"message": {
"code": "CODE",
"text": null,
"origin": null,
"rule": "RULE"},
"context": "default"
}

Thanks

Re: Problem formatting string to json

ITWhisperer — Tue, 10 Nov 2020 17:52:37 GMT

| makeresults | eval _raw="{\"timestamp\":\"2020-11-10T15:27:02.187Z\",\"level\":\"INFO\",\"thread\":\"main\",\"logger\":\"ca.nbc.payment.pmtinternationallibrary.config.MyApplicationContextInitializer\",\"message\":\"{\\\"code\\\": \\\"CODE\\\",\\\"text\\\":null,\\\"origin\\\":null,\\\"rule\\\": \\\"RULE\\\"}\",\"context\":\"default\"}" | rex mode=sed "s/\{/{\n/g s/,/,\n/g s/\n(?=\\\)/\n /g s/\\\//g s/\}(?!\")/\n}/g s/\"\{/{/g s/\}\"/}/g" | table _raw

topic Problem formatting string to json in Splunk Search

Problem formatting string to json

Re: Problem formatting string to json