1 Reply Latest reply on Jun 9, 2020 2:24 AM by Cederberg

    Parsing JSON in Log Insight

    k29er Lurker

      Following guidance and using example log data from VMWare, the test data is being parsed into separate events seemingly based on line breaks in the data. Only when I wipe the line breaks does it parse the data as one event.


      Is this by-design?


      Referenced guidance:

      JSON Parser


      Parser IS working when the event is contiguous.

        • 1. Re: Parsing JSON in Log Insight
          Cederberg Lurker



          I know it's a bit old this post and i guess you have probably solved it by now. But to mark an event with mulitple lines you need to use the Event marker option on the file logs. The default value for that option is ^ which match all new lines. If for example your event starts with [2020-06-09] you need to regex match that with something like this ^\[\d{4}-\d{2}-\d{2}\]. Then it should only be a new event when the regex pattern match a date.


          Hope that helps if you hadn't solved it before.


          Best regards