Hello everyone When I apply a JSON parser to the body field SigNoz Community #support

Hello everyone! When I apply a JSON parser to the ...

Mac Wynkoop

11/26/2024, 9:17 PM

Hello everyone! When I apply a JSON parser to the "body" field, I get this error in my otlp-receiver container:

Copy code

{"level":"error","ts":1732655670.9503894,"caller":"helper/transformer.go:100","msg":"Failed to process entry","kind":"processor","name":"signozlogspipeline/pipeline_conduit","pipeline":"logs","operator_id":"6936b6bb-c733-42db-9ee2-8c4ceae531e5","operator_type":"json_parser","error":"running if expr: interface conversion: interface {} is map[string]interface {}, not string (1:21)\n | body != nil && body matches \"^\\\\s*{.*}\\\\s*$\"\n |

Which seems strange considering it does properly pull out the contents of the body into attributes like I want. Why does this error throw if we do properly parse into attributes?

Mac Wynkoop

11/26/2024, 9:43 PM

I see now my journald receiver was sending it as a map object. I used the workaround of:

Copy code

EXPR(replace(toJSON(body), "\n", ""))

To cast the body to attributes.serialized_msg first. But even still, trying to grab the severity_text from attributes.MESSAGE, my regex parser is not applying any text to attributes.severity_name. This is my regex:

Copy code

(?P<severity_text>(DEBUG|INFO|WARN|ERROR))

Am I doing something wrong?

nitya-signoz

11/27/2024, 5:08 AM

Yeah your body is a map instead of a string. If message is inside body then it will can be referenced as

body.MESSAGE

. The issue with datatype is a known one https://github.com/SigNoz/signoz/issues/5993

Mac Wynkoop

11/27/2024, 9:51 PM

@nitya-signoz Any wisdom re: the Regex parser statement? I'm giving it a named field, but it doesn't seem to actually pull the Regex'd values out.

Mac Wynkoop

11/27/2024, 10:10 PM

Screenshot 2024-11-27 at 1.10.36 PM.png

Mac Wynkoop

11/27/2024, 10:11 PM

You can see the INFO in the string, but the Regex parser just ignores it. Or maybe I'm using it wrong?

13 Views

Open in Slack

Previous Next