CloudWatch trouble parsing @message message value from JSON log4j message

0

We are writing out log entries out in Java log4j as JSON: Here's an example: of the JSON string value of the @message field:

{"@timestamp":"2024-02-06T17:05:04.909+00:00","@version":1,"message":"SiteId: site.example.com, ServerName: ourserver, DurationMs: 114 ControllerName: class controllers.Application, MethodName: getApplication, MaskedUri: /applications/{appId}, RequestId: b9c7fb58-9434-4709-ae88-89d5f25884a4, RequestMethod: GET, SourceIp: 192.168.0.1, 192.168.0.2, 192.168.0.3, RequestUri: /applications?appId=1243, UserId: qaadmin, UserRole: 10000, AuthenticationType: null, ResponseStatusCode: 200","logger_name":"plugins.logging.LoggingContext","level":"INFO","level_value":20000,"event.module":"ourModule"}

We are trying to be able to parse the string within the message data element of the @message JSON object but we are not getting any data out. For example I'd like to be able to display the ServerName or the DurationMs value as fields that we can display and execute functions on.

This is the CloudWatch query that we tried:

fields @timestamp, @message, @message.message
| filter SiteId == 'site.example.com' and logger_name == 'plugins.logging.LoggingContext'
| parse @message '{"@timestamp": "*","@version":*,"message":"*","logger_name":"*","level":"*","level_value":"*","event.module":"*"}' as msgTimestamp, msgVersion, msg, msgLogger_name, msgLevel, msgEventModule 
| sort @timestamp desc
| limit 2

The data displayed for @message.message is empty even though when you open up the results you can see message as a separate row. All of the fields defined in the parse statement are empty as well. The theory was that if we can get the msg field out we could parse that string to get the individual data fields from that part of the JSON Log entry.

We aren't able to have the log4j data to be all JSON values in the log for a different logging format.

feita há 3 meses184 visualizações
Sem respostas

Você não está conectado. Fazer login para postar uma resposta.

Uma boa resposta responde claramente à pergunta, dá feedback construtivo e incentiva o crescimento profissional de quem perguntou.

Diretrizes para responder a perguntas