VMware Cloud Community
k29er
Contributor
Contributor

Parsing JSON in Log Insight

Following guidance and using example log data from VMWare, the test data is being parsed into separate events seemingly based on line breaks in the data. Only when I wipe the line breaks does it parse the data as one event.

Is this by-design?

Referenced guidance:

JSON Parser

Parser IS working when the event is contiguous.

Tags (1)
Reply
0 Kudos
1 Reply
Cederberg
Enthusiast
Enthusiast

Hi.

I know it's a bit old this post and i guess you have probably solved it by now. But to mark an event with mulitple lines you need to use the Event marker option on the file logs. The default value for that option is ^ which match all new lines. If for example your event starts with [2020-06-09] you need to regex match that with something like this ^\[\d{4}-\d{2}-\d{2}\]. Then it should only be a new event when the regex pattern match a date.

Hope that helps if you hadn't solved it before.

Best regards

//Cederberg

Reply
0 Kudos