'Fluentd formatting json

I have a json:

{
  "message": "2022-04-21T10:40:24.261996286+02:00 stdout F {\"timestamp\":\"2022-04-21T08:40:24,261Z\",\"level\":\"WARN\",\"logger\":\"SoupCoreClientContext\",\"thread\":\"ThreadServiceProvider\",\"message\":\"Lost connection / cannot connect to server. \",\"instance\":\"api\"}",
  "hostname": "fluentd",
  "@log_name": "api"
}

and my source looks like this:

<source>
 @type tail
   path /data/api.log
   tag api
   pos_file /data/api-file.log.pos
   read_from_head true
   <parse>
      @type none
   </parse>
</source>

Also I'm using this filter to try to parse message with specified key, but it doesn't work:

<filter *>
  @type parser
  key_name message
  reserve_data true
  remove_key_name_field true
  <parse>
    @type multi_format
    <pattern>
      format json
    </pattern>
    <pattern>
      format none
    </pattern>
  </parse>
</filter>

How can I parse escaped json inside "message" key?

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution	Source

'Fluentd formatting json

Sources

Related Questions