All fields in are being output in the `message` property as a JSON string

Elastic Stack Kibana
1

I'm using NLog with a Redis target. In an older version all of the attributes in my layout used to appear as 1st class data-items when viewing in Kibana.

Since upgrading to the latest version they all appear as a JSON encoded string value against a single data-item named message.

I've tried specifying a JsonLayout for the message value but it has made no difference:

How do I get these back to first class data-items in Kibana so that I can click the Filter button against them? I don't know if this is something I need to address in Kibana, or NLog. Can anyone help?

2

It sounds like the data is being indexed as a JSON encoded string within Elasticsearch. Within Discover in Kibana, can you expand a record and provide the content of the JSON tab?

3

Thanks for your reply! The top hit in the search was as follows. The info in the message is what used to appear as top-level entries in Kibana.

"hits": [
  {
	"_index": "company-logstash-2018.04.13",
	"_type": "redis-input",
	"_id": "AWK_BxCit7NclctjJUWU",
	"_score": 12.9958105,
	"_source": {
	  "@timestamp": "2018-04-13T12:42:13.453Z",
	  "app_Name": "company-myapp.web.mysite",
	  "Version": "4.1.0.132",
	  "level": "Info",
	  "LoggerType": "Company.myapp.Web.mysite.Controllers.HomeController",
	  "@version": "1",
	  "Environment": "DEMO",
	  "message": "{ \"user\": \"<none>\", \"session\": \"OMITTED\", \"message\": \"GET \\/\", \"ticks\": \"636592201334539791\", \"processid\": \"4912\", \"userlanguages\": \"zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3\", \"currentculture\": \"en-US\", \"currentuiculture\": \"en-US\", \"headers\": \"GET \\/\\nRemote Address: OMITTED\\n\\nAccept: application\\/json, text\\/plain, *\\/*\\nAccept-Charset: GBK,utf-8;q=0.7,*;q=0.3\\nAccept-Encoding: gzip, deflate, br\\nAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3\\nHost: OMITTED:443\\nUser-Agent: Mozilla\\/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko\\/20100101 Firefox\\/52.0\", \"requestGuid\": \"OMITTED\", \"sessionId\": \"OMITTED\", \"requestGuid\": \"OMITTED\", \"userId\": \"<none>\", \"UserLanguages\": \"zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3\", \"CurrentCulture\": \"en-US\", \"CurrentUICulture\": \"en-US\", \"Headers\": \"GET \\/\\nRemote Address: OMITTED\\n\\nAccept: application\\/json, text\\/plain, *\\/*\\nAccept-Charset: GBK,utf-8;q=0.7,*;q=0.3\\nAccept-Encoding: gzip, deflate, br\\nAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3\\nHost: OMITTED:443\\nUser-Agent: Mozilla\\/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko\\/20100101 Firefox\\/52.0\", \"RequestCtx\": \"Company.myapp.Web.Common.IoC.WebCommonLoggingContext\", \"LoggerType\": \"Company.myapp.Web.mysite.Controllers.HomeController\", \"Version\": \"4.1.0.132\", \"LogTimestamp\": \"2018-04-13T12:42:13.4539791Z\" }",
	  "type": "redis-input",
	  "RequestCtx": {
		"IpAddress": "OMITTED",
		"Url": "/"
	  },
	  "tags": []
	}
  }
4

Ah, yeah the message is an encoded JSON string. I am not familiar with NLog, so you might want to reach out to them for guidance.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.