like a few other folks I m having trouble getting a nested j SigNoz Community #support

like a few other folks, I'm having trouble getting...

Andrew Hoog

09/09/2024, 6:40 PM

like a few other folks, I'm having trouble getting a nested json object (

body.message: {...}

) hoisted to attributes. Over time, I might cherry-pick just a few of the attributes but even trying a few techniques (e.g. use JSON parser to temp variable from your JSON Guide) hasn't worked. I was hoping folks here might see the obvious mistake. Details in thread.

Andrew Hoog

09/09/2024, 6:42 PM

Here's the docker logs (shipped via logspout):

Copy code

bcs-web-test  | {"level":"info","message":{"error":null,"http-version":"1.1","method":"GET","referrer":"<http://localhost:3042/auth/sign-in>","remote-address":"::ffff:192.168.65.1","response-time":"5.337","status-code":"304","time":"2024-09-09T15:54:37.875Z","url":"/pricing","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0","user-email":null,"user-uuid":null,"x-forwarded-for":""},"service":"http","timestamp":"2024-09-09T15:54:37.875Z"}

Andrew Hoog

09/09/2024, 6:43 PM

here's what I see in SigNoz UI and rule I started with (deleted failed ones):

Andrew Hoog

09/09/2024, 6:43 PM

there are certain properties like

status-code

url

and such I'd like to have as direct attributes so it's easier to filter, group, alert, etc.

Andrew Hoog

09/09/2024, 6:43 PM

tia

Andrew Hoog

09/09/2024, 6:50 PM

as you can see, right now messages is created in attributes but as a string

nitya-signoz

09/10/2024, 2:34 AM

You seem to have a nested json, as of now you will have to move them out manually to attributes using the

move

operator. @Raj Kamal any easy way of doing this ?

Andrew Hoog

09/10/2024, 11:44 AM

Thx, I tried that and can try again but it never seemed to work. The pipeline wouldn't error out but the subsequent

move

jobs after the initial json just silently failed. Is there way to debug? But I'll try again later today...maybe I was using

add

copy

instead of

move

(would that make a difference?)

Raj Kamal

09/10/2024, 1:17 PM

If you are looking to move only a few of the properties out of

attributes.message

move

operator should be the right choice. There is no easy way to hoist all nested properties up right now. However, a workaround would be to serialize the extracted

attributes.message

map back to JSON and then use a JSON parser on it For example, you could use the

add

processor to add the temp field

attributes.serialized_message

with value

EXPR(replace(toJSON(attributes.message), "\n", ""))

and then use a json parser on

attributes.serialized_message

34 Views

Open in Slack

Previous Next