github.com/observiq/carbon@v0.9.11-0.20200820160507-1b872e368a5e/docs/operators/json_parser.md (about)

     1  ## `json_parser` operator
     2  
     3  The `json_parser` operator parses the string-type field selected by `parse_from` as JSON.
     4  
     5  ### Configuration Fields
     6  
     7  | Field        | Default          | Description                                                                                                                                |
     8  | ---          | ---              | ---                                                                                                                                        |
     9  | `id`         | `json_parser`    | A unique identifier for the operator                                                                                                       |
    10  | `output`     | Next in pipeline | The connected operator(s) that will receive all outbound entries                                                                           |
    11  | `parse_from` | $                | A [field](/docs/types/field.md) that indicates the field to be parsed as JSON                                                              |
    12  | `parse_to`   | $                | A [field](/docs/types/field.md) that indicates the field to be parsed as JSON                                                              |
    13  | `preserve`   | false            | Preserve the unparsed value on the record                                                                                                  |
    14  | `on_error`   | `send`           | The behavior of the operator if it encounters an error. See [on_error](/docs/types/on_error.md)                                            |
    15  | `timestamp`  | `nil`            | An optional [timestamp](/docs/types/timestamp.md) block which will parse a timestamp field before passing the entry to the output operator |
    16  
    17  
    18  ### Example Configurations
    19  
    20  
    21  #### Parse the field `message` as JSON
    22  
    23  Configuration:
    24  ```yaml
    25  - type: json_parser
    26    parse_from: message
    27  ```
    28  
    29  <table>
    30  <tr><td> Input record </td> <td> Output record </td></tr>
    31  <tr>
    32  <td>
    33  
    34  ```json
    35  {
    36    "timestamp": "",
    37    "record": {
    38      "message": "{\"key\": \"val\"}"
    39    }
    40  }
    41  ```
    42  
    43  </td>
    44  <td>
    45  
    46  ```json
    47  {
    48    "timestamp": "",
    49    "record": {
    50      "key": "val"
    51    }
    52  }
    53  ```
    54  
    55  </td>
    56  </tr>
    57  </table>
    58  
    59  #### Parse a nested field to a different field, preserving original
    60  
    61  Configuration:
    62  ```yaml
    63  - type: json_parser
    64    parse_from: message.embedded
    65    parse_to: parsed
    66    preserve: true
    67  ```
    68  
    69  <table>
    70  <tr><td> Input record </td> <td> Output record </td></tr>
    71  <tr>
    72  <td>
    73  
    74  ```json
    75  {
    76    "timestamp": "",
    77    "record": {
    78      "message": {
    79        "embedded": "{\"key\": \"val\"}"
    80      }
    81    }
    82  }
    83  ```
    84  
    85  </td>
    86  <td>
    87  
    88  ```json
    89  {
    90    "timestamp": "",
    91    "record": {
    92      "message": {
    93        "embedded": "{\"key\": \"val\"}"
    94      },
    95      "parsed": {
    96        "key": "val"
    97      }
    98    }
    99  }
   100  ```
   101  
   102  </td>
   103  </tr>
   104  </table>
   105  
   106  #### Parse the field `message` as JSON, and parse the timestamp
   107  
   108  Configuration:
   109  ```yaml
   110  - type: json_parser
   111    parse_from: message
   112    timestamp:
   113      parse_from: seconds_since_epoch
   114      layout_type: epoch
   115      layout: s
   116  ```
   117  
   118  <table>
   119  <tr><td> Input record </td> <td> Output record </td></tr>
   120  <tr>
   121  <td>
   122  
   123  ```json
   124  {
   125    "timestamp": "",
   126    "record": {
   127      "message": "{\"key\": \"val\", \"seconds_since_epoch\": 1136214245}"
   128    }
   129  }
   130  ```
   131  
   132  </td>
   133  <td>
   134  
   135  ```json
   136  {
   137    "timestamp": "2006-01-02T15:04:05-07:00",
   138    "record": {
   139      "key": "val"
   140    }
   141  }
   142  ```
   143  
   144  </td>
   145  </tr>
   146  </table>