The json_parser operator parses the string-type field selected by parse_from as JSON.
| Field | Default | Description |
|---|---|---|
id |
json_parser |
A unique identifier for the operator. |
output |
Next in pipeline | The connected operator(s) that will receive all outbound entries. |
parse_from |
body |
The field from which the value will be parsed. |
parse_to |
attributes |
The field to which the value will be parsed. |
on_error |
send |
The behavior of the operator if it encounters an error. See on_error. |
if |
An expression that, when set, will be evaluated to determine whether this operator should be used for the given entry. This allows you to do easy conditional parsing without branching logic with routers. | |
timestamp |
nil |
An optional timestamp block which will parse a timestamp field before passing the entry to the output operator. |
severity |
nil |
An optional severity block which will parse a severity field before passing the entry to the output operator. |
The json_parser can be configured to embed certain operations such as timestamp and severity parsing. For more information, see complex parsers.
Configuration:
- type: json_parser
parse_from: body.message| Input body | Output body |
{
"timestamp": "",
"body": {
"message": "{\"key\": \"val\"}"
}
} |
{
"timestamp": "",
"body": {
"key": "val"
}
} |
Configuration:
- type: json_parser
parse_from: body.message
timestamp:
parse_from: body.seconds_since_epoch
layout_type: epoch
layout: s| Input body | Output body |
{
"timestamp": "",
"body": {
"message": "{\"key\": \"val\", \"seconds_since_epoch\": 1136214245}"
}
} |
{
"timestamp": "2006-01-02T15:04:05-07:00",
"body": {
"key": "val"
}
} |
Configuration:
- type: json_parser
if: 'body matches "^{.*}$"'| Input body | Output body |
{
"body": "{\"key\": \"val\"}"
} |
{
"body": {
"key": "val"
}
} |
{
"body": "notjson"
} |
{
"body": "notjson"
} |