Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: add exmaple and documentation about using JMESPath literals #1176

Merged
merged 1 commit into from
Oct 18, 2019
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 34 additions & 0 deletions docs/clients/promtail/stages/json.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,10 @@ json:
# Set of key/value pairs of JMESPath expressions. The key will be
# the key in the extracted data while the expression will the value,
# evaluated as a JMESPath from the source data.
#
# Literal JMESPath expressions can be done by wrapping a key in
# double quotes, which then must be wrapped in single quotes in
# YAML so they get passed to the JMESPath parser.
expressions:
[ <string>: <string> ... ]

Expand Down Expand Up @@ -89,3 +93,33 @@ The second stage will parse the value of `extra` from the extracted data as JSON
and append the following key-value pairs to the set of extracted data:

- `user`: `marco`

### Using a JMESPath Literal

This pipeline uses a literal JMESPath expression to parse JSON fields with
special characters in the name, like `@` or `.`

For the given pipeline:

```yaml
- json:
expressions:
output: log
stream: '"grpc.stream"'
timestamp: time
```

Given the following log line:

```
{"log":"log message\n","grpc.stream":"stderr","time":"2019-04-30T02:12:41.8443515Z"}
```

The following key-value pairs would be created in the set of extracted data:

- `output`: `log message\n`
- `stream`: `stderr`
- `timestamp`: `2019-04-30T02:12:41.8443515`

Note that referring to `grpc.stream` without the combination of double quotes
wrapped in single quotes will not work properly.