Format JSON

Format JSON in @rawstring field using the json:prettyPrint() function

Query

logscale
#type=json
| account=123
| json:prettyPrint()

Introduction

The json:prettyPrint() function can be used to format a JSON field for improved readability. When used without parameters, json:prettyPrint() assumes, that the JSON is in the @rawstring field.

In this example, the json:prettyPrint() function is used to format the @rawstring field.

Step-by-Step

  1. Starting with the source repository events.

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[/Filter/] 1[/Filter/] 2>Augment Data] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    #type=json

    Filters for events with the JSON type.

  3. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[/Filter/] 1[/Filter/] 2>Augment Data] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    | account=123

    Filters for events related to account 123.

    It is recommended to filter the event set as much as possible before using the json:prettyPrint() function to prevent unnecessary formatting of discarded data.

  4. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[/Filter/] 1[/Filter/] 2>Augment Data] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> result style 2 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    | json:prettyPrint()

    Formats the JSON content for improved readability. Without a specified field, it formats the @rawstring field.

    Note that if input is not valid JSON, it returns unmodified values. To prevent this, you can set a strict parameter. For an example of usage, see Format Only Valid JSON.

  5. Event Result set.

Summary and Results

The query is used to make JSON data more readable in the results. Formatting JSON in the @rawstring field after filtering the data is very important as it is a resource-intensive operation.