Configuring SigNoz for JSON Logs Extraction

TLDR Justin faced issues with column addition in the SigNoz UI for parsed JSON logs. nitya-signoz guided them on parsing the log body to extract keys to be used as columns in UI.

Photo of Justin
Thu, 12 Oct 2023 05:26:09 UTC

Hi all, I am using signoz to pull logs from docker. I don't have much visibility into the signoz setup - it's been handed to me by a different team. Our application sends JSON logs, and I can perform useful queries against it. So far so good. Our application produces arbitrary k/v fields, and I can see them all being parsed in the body of each log line. So for example, I can see body.file (source code file) and body.level (log level). I can do queries like "body.level = 'whatever'. However I can't seem to add them as columns in the "List view" of the UI - which is what I need to make this usable by other members of the team. Am I "holding this wrong"? Do I need to either log differently, or configure signoz differently?

Photo of vishal-signoz
Fri, 13 Oct 2023 00:23:46 UTC

nitya-signoz can answer this

Photo of Justin
Fri, 13 Oct 2023 01:43:30 UTC

I would appreciate it a lot! :slightly_smiling_face: I think my core question is : "can I pull all the keys out of the "body" (which is just a JSON string) and put them at the top level, so they can be arbitrarily used as columns in the List View". Keys are arbitrary based on the application and it would be annoying to have to keep editing the config to statically define them.

Photo of nitya-signoz
Fri, 13 Oct 2023 05:39:24 UTC

Yes you can for that you will have to parse your log body ex:-