Adding fields to multi-level JSON document breaks the document

It does not appear to be possible for NxLog Community to add fields to a JSON document which contain complex fields because parse_json() converts those complex fields to strings, thereby breaking the document as it is sent upstream. Alernatively, I'm doing something wrong ;).

Let's say the NxLog is reading a file with a JSON document on each line and I want to add a custom field. I understand I would do the following:

AskedMay 16, 2017 - 9:37am

Log detail being dropped

Hi everyone,

We have an internal application on a windows box which logs in a way which is slightly mangled. All other windows logs come through nxlog but on these messages the entire message field gets dropped.

Is there a way to parse using ifs? eg:

if $service == "Homegrown app" {


So that I can either change the output format or parse them untouched into a file etc...

AskedFebruary 13, 2015 - 10:23am