JSON Logs

JSON is an open-standard file format that transmits data objects made up of attribute-value pairs in a human-readable form. It's widely adopted for its structured data format and because it's easy to parse. JSON is also compact and simple to implement in most logging frameworks. Site24x7 helps you parse single and multiline JSON logs. Additionally, it supports the combination of a simple log with JSON log patterns. You can track and monitor these logs with Site24x7 Applogs.

Getting started 

1. Log in to your Site24x7 account. 
2. Download and install the Site24x7 Server Monitoring agent (Windows | Linux). 
3. Go to Admin > AppLogs > Log Types, then select Add Log Type.

Single line JSON

Sample log

{"machineTimeUTC":"2019-01-01T09:27:11.620Z","id":"661dc0ae-404b-4f0d-9579-ceca6e20f22c","callCenterName":"DEV-Station","name":"A","value":100,"stack":"dev","machineTime":"2019-01-01T11:27:11.620+02:00"}

Log pattern

Following is the default pattern identified by Site24x7 for parsing the sample JSON logs. The log pattern should start with the keyword json and contain a minimum of one date field.

json $stack$ $machineTimeUTC as MachineTime:date:yyyy-MM-dd'T'HH:mm:ss.SSS'Z'$ $callCenterName as CallCenter$ $name$ $id$

This log is separated into fields, each of which will take its respective value, and is then uploaded to Site24x7. 

Multiline JSON

Sample log 

{
"_index": "keepalive-2019-01-01",
"_type": "logs",
"_id": "49590436630844818814950698841516754273392947672976982018.0",
"_score": 1.5,
"_source": {
"logType": "Keepalive",
"machineData": {
"name": "A",
"callCenterName": "DEV-Station",
"machineTimeUTC": "2019-01-01T09:27:11.620Z",
"id": "661dc0ae-404b-4f0d-9579-ceca6e20f22c",
"stack": "dev",
"machineTime": "2019-01-01T11:27:11.620+02:00"
}
},
"fields": {
"nameid": [
"DEV-Station = B"
],
"machineData.machineTimeUTC": [
1546334831620
],
"machineData.machineTime": [
1546334831620
]
}
}

Log pattern

You can use the following log pattern to collect the JSON object machineData from the sample log.

json $_source.machineData.stack as Stack$ $_source.machineData.machineTimeUTC as DateTime:date$ $_source.machineData.callCenterName as CenterName$ $_source.machineData.name as Name$ $_source.machineData.id as Id$ 

You can use the following log pattern to collect a few other data objects such as _score and _source.logType.

json $_source.machineData.stack as Stack$ $_source.machineData.machineTimeUTC as DateTime:date$ $_source.machineData.callCenterName as CenterName$ $_source.machineData.name as Name$ $_source.machineData.id as Id$ $_source.logType as logtypes$ $_score as score:number$

Combination of normal logs with JSON log pattern

Sample log

2022/06/06 09:13:38 vagrant program[123]: server.1 {"method":"GET", "status_code":200, "url":"https://zylker.com/logs/pipelines", "duration":123456}

Log pattern

The following log pattern contains a combination of normal and JSON format logs:

$Date:date$ vagrant program[123]: server.1 $Message:json:$method$ $status_code:number$ $url$ $duration:number$$

With JSON object

Sample log

{"timestamp":"2024-02-12 12:12:12","name":"Request Count of Sample App","widgetId":12,"description":"Event description","params":{"selected":212,"period":0},"version":"0.1"}

Log pattern

json $widgetId:number$ $name$ $description$ $params:json-object$ $version$ $timestamp:date:yyyy-MM-dd HH:mm:ss$

With JSON array

Sample log

{"routePlannerRouteId":"10010202","routeId":"10010202","routeDate":"2022-12-09T00:00:00","regionId":"548","oprCode":"initialETA","stopdetails":[{"attributes":"test1","locationKey":"53w4","routePlannerStopId":"257288","stopETA":"2022-12-10T15:27:09-05:00"},{"attributes":"test2","locationKey":"257288","routePlannerStopId":"257288","stopETA":"2022-12-09T13:26:58-05:00"},{"attributes":"test3","locationKey":"442433","routePlannerStopId":"442433","stopETA":"2022-12-10T15:27:09-05:00"}]}

Log pattern

json $routePlannerRouteId$ $routeDate:date:yyyy-MM-dd'T'HH:mm:ss$ $routeId$ $regionId$ $oprCode$ $stopdetails:json-array:($locationKey$ $attributes$ $routePlannerStopId$ $stopETA$)$

Using spaces in the field name

Sample log

{"Machine Time":"2019-01-01T09:27:11.620Z","keyid":"661dc0ae-404b-4f0d-9579-ceca6e20f22c","Service Name":"DEV-Station","Service Value":100,"Stack":"dev"}

Log pattern

json $Machine Time as MachineTime:date:yyyy-MM-dd'T'HH:mm:ss.SSS'Z'$ $Service Value as ServiceValue:number$ $keyid$ $Service Name as ServiceName$ $Stack$

Related log types

• Ruby on Rails logs
• Windows Event logs
• Syslogs
• Key-value logs
• XML logs