CloudWatch trouble parsing @message message value from JSON log4j message

0

We are writing out log entries out in Java log4j as JSON: Here's an example: of the JSON string value of the @message field:

{"@timestamp":"2024-02-06T17:05:04.909+00:00","@version":1,"message":"SiteId: site.example.com, ServerName: ourserver, DurationMs: 114 ControllerName: class controllers.Application, MethodName: getApplication, MaskedUri: /applications/{appId}, RequestId: b9c7fb58-9434-4709-ae88-89d5f25884a4, RequestMethod: GET, SourceIp: 192.168.0.1, 192.168.0.2, 192.168.0.3, RequestUri: /applications?appId=1243, UserId: qaadmin, UserRole: 10000, AuthenticationType: null, ResponseStatusCode: 200","logger_name":"plugins.logging.LoggingContext","level":"INFO","level_value":20000,"event.module":"ourModule"}

We are trying to be able to parse the string within the message data element of the @message JSON object but we are not getting any data out. For example I'd like to be able to display the ServerName or the DurationMs value as fields that we can display and execute functions on.

This is the CloudWatch query that we tried:

fields @timestamp, @message, @message.message
| filter SiteId == 'site.example.com' and logger_name == 'plugins.logging.LoggingContext'
| parse @message '{"@timestamp": "*","@version":*,"message":"*","logger_name":"*","level":"*","level_value":"*","event.module":"*"}' as msgTimestamp, msgVersion, msg, msgLogger_name, msgLevel, msgEventModule 
| sort @timestamp desc
| limit 2

The data displayed for @message.message is empty even though when you open up the results you can see message as a separate row. All of the fields defined in the parse statement are empty as well. The theory was that if we can get the msg field out we could parse that string to get the individual data fields from that part of the JSON Log entry.

We aren't able to have the log4j data to be all JSON values in the log for a different logging format.

質問済み 3ヶ月前184ビュー
回答なし

ログインしていません。 ログイン 回答を投稿する。

優れた回答とは、質問に明確に答え、建設的なフィードバックを提供し、質問者の専門分野におけるスキルの向上を促すものです。

質問に答えるためのガイドライン

関連するコンテンツ