Format Only Valid JSON

Format only JSON data that is considered valid using the json:prettyPrint() function

Query

logscale
formattedJson := json:prettyPrint(field=message, strict=true)

Introduction

The json:prettyPrint() function can be used to format a JSON field for improved readability. When used without parameters, json:prettyPrint() assumes, that the JSON is in the @rawstring field.

In this example, the json:prettyPrint() function is used to format the message field as JSON with the strict parameter set to true to only process valid JSON.

Step-by-Step

  1. Starting with the source repository events.

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0>Augment Data] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    formattedJson := json:prettyPrint(field=message, strict=true)

    Uses the field parameter to specify the message field as the source of JSON data and the strict parameter set to true to only process valid JSON.

    Formats the valid JSON data for improved readability and assigns the results to a new field named formattedJson.

    Note that if the JSON in the message field is invalid, the formattedJson field will not be created for that event.

  3. Event Result set.

Summary and Results

The query is used to make valid JSON data more readable in the results.

Note that without strict parameter set to true, the json:prettyPrint() function attempts to format even invalid JSON, which might lead to unexpected results.