Nested logs are not parsed correctly

[TKelly]

I have nested events that look like this in Splunk:

container_id: 13243d84e63d8d5b56c5
container_name: /ecs-stg-compute-instances-226-ur-2-c499f4ac
log: {"module": "ur.uhg", "functions": ["unlock_user_processing"], "session-id": "XUHWnDAAkR3AwrsXxtL339z9rEf-l", "email": "[email protected]", "user-id": 3, "user-account-id": 3, "start-time": "2021-11-08T19:59:36.711483", "end-time": null, "callback-function": "calculate_metrics", "emails-processed": 316, "emails-left-to-process": 0, "images-processed": 316, "iterations": 5, "iteration-times": [56.61728, 162.878587, 43.512794, 24.918005, 0.954233], "event": "chained_functions() called.", "level": "debug", "timestamp": "2021-11-08T20:04:25.905376Z"}
 source: stdout

and a 'log' value is seen like a string even so it's a JSON object. How can I  parse "log" value into key/value pairs?? 

[ITWhisperer · Accepted solution]

| spath input=log