How to treat JSON as a string


What would be the best way to handle JSON which appears in amongst my normal logs. We don't require parsing of individual fields, just need it to be displayed as a string as this JSON appears very rarely.

As you can see in the message field, it's failing when it's hitting the first JSON element...... or is it a quote escape issue?

I have other multi-line logs working fine.


How are you combining the multiple lines into a single event?

Thanks for the reply @Badger

I figured it out.. this is a new type of multi-line log for me.

This is my multiline setup now, which now combines logs that start with " ", "}" or ")"

multiline.pattern: "^( |}|\))"
multiline.negate: false
multiline.match: after

I think you are missing something in your Grok pattern:
Not working:
Note the (?m) at the start telling RegEx to do multiline matching

1 Like

I had no idea you could do this. It actually seems like a much more resilient way of handling it rather than using multiline.pattern.

Thanks again!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.