It does not appear to be possible for NxLog Community to add fields to a JSON document which contain complex fields because parse_json() converts those complex fields to strings, thereby breaking the document as it is sent upstream. Alernatively, I'm doing something wrong ;).

Let's say the NxLog is reading a file with a JSON document on each line and I want to add a custom field. I understand I would do the following:

Exec parse_json();
Exec $new_field = 'too sexy';
Exec to_json();

If the original JSON line is 

{"field1":1, "field2":2, "fieldComplex":{"a":3,"b",4}}

I would expect my resuting document, after NxLog injection, to be:

{"field1":1, "field2":2, "fieldComplex":{"a":3,"b",4}, "new_field":"too sexy"}

But that's not what happens. The complex field is converted to text and the resulting document is:

{"field1":1, "field2":2, "fieldComplex":"{'a':3,'b',4}", "new_field":"too sexy"}

Can this behaviour be avoided?

Thanks, Geoff

AskedMay 16, 2017 - 9:37am

Answer (1)

The Community Edition is a little behind with this. It already works with the EE and the resulting json is what you'd expect:

{"field1":1,"field2":2,"fieldComplex":{"a":3,"b":4},"new_field":"too sexy"}