All Apps and Add-ons

Kafka Messaging Modular Input: How can I use spath to parse JSON in events coming over Kafka?

jonathanwood
New Member

I am using the Kafka Messaging Modular Input (https://splunkbase.splunk.com/app/1817/ ) to get data in Splunk. The data coming over Kafka is JSON.

When it gets to splunk, the events look like this:

Tue Aug 25 16:07:37 UTC 2015 name="kafka_msg_received" event_id="" msg_body="{"type":"server.statistics","current-time":1440518856.847175,"server-start-time":1440518271.104432,"node-id":"bd308a2c-c291-5868-bd97-0b06c27b536b","content":{"reset-time":1440518271.367789}}"

... | spath input=msg_body does not generate any fields from the JSON.

How can I use spath to parse the JSON in these events?

0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

Might be easier for you to plugin a custom message handler to just dump the JSON. There is one that ships by default with the App.

alt text

View solution in original post

Damien_Dallimor
Ultra Champion

Might be easier for you to plugin a custom message handler to just dump the JSON. There is one that ships by default with the App.

alt text

jonathanwood
New Member

Works like a charm. Thanks!

0 Karma

petehmrc
Path Finder

com.splunk.modinput.kafka.BodyOnlyMessageHandler

Just because I had to type it out and this might save someone the trouble 🙂

Damien_Dallimor
Ultra Champion

Mavis Beacon would be proud 🙂

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...