Format JSON

Format JSON in @rawstring field using the json:prettyPrint() function

Query

logscale
#type=json
| account=123
| json:prettyPrint()

Introduction

The json:prettyPrint() function can be used to format a JSON field for improved readability. When used without parameters, json:prettyPrint() assumes, that the JSON is in the @rawstring field.

In this example, the json:prettyPrint() function is used to format the @rawstring field.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    #type=json

    Filters for events with the JSON type.

  3. logscale
    | account=123

    Filters for events related to account 123.

    It is recommended to filter the event set as much as possible before using the json:prettyPrint() function to prevent unnecessary formatting of discarded data.

  4. logscale
    | json:prettyPrint()

    Formats the JSON content for improved readability. Without a specified field, it formats the @rawstring field.

    Note that if input is not valid JSON, it returns unmodified values. To prevent this, you can set a strict parameter. For an example of usage, see Format Only Valid JSON.

  5. Event Result set.

Summary and Results

The query is used to make JSON data more readable in the results. Formatting JSON in the @rawstring field after filtering the data is very important as it is a resource-intensive operation.

Note that without the strict parameter set to true, the json:prettyPrint() function attempts to format even invalid JSON, which might lead to unexpected results.