All fields in are being output in the `message` property as a JSON string

I'm using NLog with a Redis target. In an older version all of the attributes in my layout used to appear as 1st class data-items when viewing in Kibana.

Since upgrading to the latest version they all appear as a JSON encoded string value against a single data-item named message.

I've tried specifying a JsonLayout for the message value but it has made no difference:

How do I get these back to first class data-items in Kibana so that I can click the Filter button against them? I don't know if this is something I need to address in Kibana, or NLog. Can anyone help?

It sounds like the data is being indexed as a JSON encoded string within Elasticsearch. Within Discover in Kibana, can you expand a record and provide the content of the JSON tab?

Thanks for your reply! The top hit in the search was as follows. The info in the message is what used to appear as top-level entries in Kibana.

"hits": [
  {
	"_index": "company-logstash-2018.04.13",
	"_type": "redis-input",
	"_id": "AWK_BxCit7NclctjJUWU",
	"_score": 12.9958105,
	"_source": {
	  "@timestamp": "2018-04-13T12:42:13.453Z",
	  "app_Name": "company-myapp.web.mysite",
	  "Version": "4.1.0.132",
	  "level": "Info",
	  "LoggerType": "Company.myapp.Web.mysite.Controllers.HomeController",
	  "@version": "1",
	  "Environment": "DEMO",
	  "message": "{ \"user\": \"<none>\", \"session\": \"OMITTED\", \"message\": \"GET \\/\", \"ticks\": \"636592201334539791\", \"processid\": \"4912\", \"userlanguages\": \"zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3\", \"currentculture\": \"en-US\", \"currentuiculture\": \"en-US\", \"headers\": \"GET \\/\\nRemote Address: OMITTED\\n\\nAccept: application\\/json, text\\/plain, *\\/*\\nAccept-Charset: GBK,utf-8;q=0.7,*;q=0.3\\nAccept-Encoding: gzip, deflate, br\\nAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3\\nHost: OMITTED:443\\nUser-Agent: Mozilla\\/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko\\/20100101 Firefox\\/52.0\", \"requestGuid\": \"OMITTED\", \"sessionId\": \"OMITTED\", \"requestGuid\": \"OMITTED\", \"userId\": \"<none>\", \"UserLanguages\": \"zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3\", \"CurrentCulture\": \"en-US\", \"CurrentUICulture\": \"en-US\", \"Headers\": \"GET \\/\\nRemote Address: OMITTED\\n\\nAccept: application\\/json, text\\/plain, *\\/*\\nAccept-Charset: GBK,utf-8;q=0.7,*;q=0.3\\nAccept-Encoding: gzip, deflate, br\\nAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3\\nHost: OMITTED:443\\nUser-Agent: Mozilla\\/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko\\/20100101 Firefox\\/52.0\", \"RequestCtx\": \"Company.myapp.Web.Common.IoC.WebCommonLoggingContext\", \"LoggerType\": \"Company.myapp.Web.mysite.Controllers.HomeController\", \"Version\": \"4.1.0.132\", \"LogTimestamp\": \"2018-04-13T12:42:13.4539791Z\" }",
	  "type": "redis-input",
	  "RequestCtx": {
		"IpAddress": "OMITTED",
		"Url": "/"
	  },
	  "tags": []
	}
  }

Ah, yeah the message is an encoded JSON string. I am not familiar with NLog, so you might want to reach out to them for guidance.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.