CloudWatch trouble parsing @message message value from JSON log4j message

0

We are writing out log entries out in Java log4j as JSON: Here's an example: of the JSON string value of the @message field:

{"@timestamp":"2024-02-06T17:05:04.909+00:00","@version":1,"message":"SiteId: site.example.com, ServerName: ourserver, DurationMs: 114 ControllerName: class controllers.Application, MethodName: getApplication, MaskedUri: /applications/{appId}, RequestId: b9c7fb58-9434-4709-ae88-89d5f25884a4, RequestMethod: GET, SourceIp: 192.168.0.1, 192.168.0.2, 192.168.0.3, RequestUri: /applications?appId=1243, UserId: qaadmin, UserRole: 10000, AuthenticationType: null, ResponseStatusCode: 200","logger_name":"plugins.logging.LoggingContext","level":"INFO","level_value":20000,"event.module":"ourModule"}

We are trying to be able to parse the string within the message data element of the @message JSON object but we are not getting any data out. For example I'd like to be able to display the ServerName or the DurationMs value as fields that we can display and execute functions on.

This is the CloudWatch query that we tried:

fields @timestamp, @message, @message.message
| filter SiteId == 'site.example.com' and logger_name == 'plugins.logging.LoggingContext'
| parse @message '{"@timestamp": "*","@version":*,"message":"*","logger_name":"*","level":"*","level_value":"*","event.module":"*"}' as msgTimestamp, msgVersion, msg, msgLogger_name, msgLevel, msgEventModule 
| sort @timestamp desc
| limit 2

The data displayed for @message.message is empty even though when you open up the results you can see message as a separate row. All of the fields defined in the parse statement are empty as well. The theory was that if we can get the msg field out we could parse that string to get the individual data fields from that part of the JSON Log entry.

We aren't able to have the log4j data to be all JSON values in the log for a different logging format.

asked 3 months ago181 views
No Answers

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions