Pretty Prints a JSON field. This can be an expensive operation and you should usually do this after filtering your data — at the end of your query. This will prevent data that will be filtered out from being formatted. If the field does not contain valid JSON, the unmodified input value is stored in the output field. If no field is specified the @rawstring will be formatted.
Parameter | Type | Required | Default Value | Description |
---|---|---|---|---|
as | string | optional[a] | The name of the field to store the output in. | |
field [b] | string | optional[a] | @rawstring | The name of the field to format. |
step | number | optional[a] | 2 | The indentation in number of characters, minimum 2 spaces. |
strict | boolean | optional[a] | false | If set to true only valid JSON input produce a value in the output field. By default invalid JSON is copied to the output field unmodified. |
[a] Optional parameters use their default value unless explicitly set. |
Hide omitted argument names for this function
Omitted Argument NamesThe argument name for
field
can be omitted; the following forms of this function are equivalent:logscalejson:prettyPrint("field")
and:
logscalejson:prettyPrint(field="field")
These examples show basic structure only.
json:prettyPrint()
Examples
Format JSON in the @rawstring field after filtering the data.
#type=json
| account=123
| json:prettyPrint()
Only copy valid JSON to the output field by setting
strict=true
. Here the field
formattedJson will not be created for events with
invalid JSON in message.
formattedJson := json:prettyPrint(field=message, strict=true)