CloudWatch trouble parsing @message message value from JSON log4j message

0

We are writing out log entries out in Java log4j as JSON: Here's an example: of the JSON string value of the @message field:

{"@timestamp":"2024-02-06T17:05:04.909+00:00","@version":1,"message":"SiteId: site.example.com, ServerName: ourserver, DurationMs: 114 ControllerName: class controllers.Application, MethodName: getApplication, MaskedUri: /applications/{appId}, RequestId: b9c7fb58-9434-4709-ae88-89d5f25884a4, RequestMethod: GET, SourceIp: 192.168.0.1, 192.168.0.2, 192.168.0.3, RequestUri: /applications?appId=1243, UserId: qaadmin, UserRole: 10000, AuthenticationType: null, ResponseStatusCode: 200","logger_name":"plugins.logging.LoggingContext","level":"INFO","level_value":20000,"event.module":"ourModule"}

We are trying to be able to parse the string within the message data element of the @message JSON object but we are not getting any data out. For example I'd like to be able to display the ServerName or the DurationMs value as fields that we can display and execute functions on.

This is the CloudWatch query that we tried:

fields @timestamp, @message, @message.message
| filter SiteId == 'site.example.com' and logger_name == 'plugins.logging.LoggingContext'
| parse @message '{"@timestamp": "*","@version":*,"message":"*","logger_name":"*","level":"*","level_value":"*","event.module":"*"}' as msgTimestamp, msgVersion, msg, msgLogger_name, msgLevel, msgEventModule 
| sort @timestamp desc
| limit 2

The data displayed for @message.message is empty even though when you open up the results you can see message as a separate row. All of the fields defined in the parse statement are empty as well. The theory was that if we can get the msg field out we could parse that string to get the individual data fields from that part of the JSON Log entry.

We aren't able to have the log4j data to be all JSON values in the log for a different logging format.

demandé il y a 3 mois184 vues
Aucune réponse

Vous n'êtes pas connecté. Se connecter pour publier une réponse.

Une bonne réponse répond clairement à la question, contient des commentaires constructifs et encourage le développement professionnel de la personne qui pose la question.

Instructions pour répondre aux questions