CloudWatch trouble parsing @message message value from JSON log4j message

0

We are writing out log entries out in Java log4j as JSON: Here's an example: of the JSON string value of the @message field:

{"@timestamp":"2024-02-06T17:05:04.909+00:00","@version":1,"message":"SiteId: site.example.com, ServerName: ourserver, DurationMs: 114 ControllerName: class controllers.Application, MethodName: getApplication, MaskedUri: /applications/{appId}, RequestId: b9c7fb58-9434-4709-ae88-89d5f25884a4, RequestMethod: GET, SourceIp: 192.168.0.1, 192.168.0.2, 192.168.0.3, RequestUri: /applications?appId=1243, UserId: qaadmin, UserRole: 10000, AuthenticationType: null, ResponseStatusCode: 200","logger_name":"plugins.logging.LoggingContext","level":"INFO","level_value":20000,"event.module":"ourModule"}

We are trying to be able to parse the string within the message data element of the @message JSON object but we are not getting any data out. For example I'd like to be able to display the ServerName or the DurationMs value as fields that we can display and execute functions on.

This is the CloudWatch query that we tried:

fields @timestamp, @message, @message.message
| filter SiteId == 'site.example.com' and logger_name == 'plugins.logging.LoggingContext'
| parse @message '{"@timestamp": "*","@version":*,"message":"*","logger_name":"*","level":"*","level_value":"*","event.module":"*"}' as msgTimestamp, msgVersion, msg, msgLogger_name, msgLevel, msgEventModule 
| sort @timestamp desc
| limit 2

The data displayed for @message.message is empty even though when you open up the results you can see message as a separate row. All of the fields defined in the parse statement are empty as well. The theory was that if we can get the msg field out we could parse that string to get the individual data fields from that part of the JSON Log entry.

We aren't able to have the log4j data to be all JSON values in the log for a different logging format.

已提问 3 个月前184 查看次数
没有答案

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则