JSON Parser
This transform has been deprecated in favor of the remap
transform, which enables you to use Vector Remap Language (VRL for short) to
create transform logic of any degree of complexity. The examples below show how you can use VRL to
replace this transform's functionality.
.message = parse_json(.message)
Configuration Options
Required Options
drop_invalid(required)
If true events with invalid JSON will be dropped, otherwise the event will be kept and passed through.
| Type | Syntax | Default | Example |
|---|---|---|---|
| bool |
inputs(required)
A list of upstream source or transform
IDs. Wildcards (*) are supported.
See configuration for more info.
| Type | Syntax | Default | Example |
|---|---|---|---|
| array | literal | ["my-source-or-transform-id","prefix-*"] |
type(required)
The component type. This is a required field for all components and tells Vector which component to use.
| Type | Syntax | Default | Example |
|---|---|---|---|
| string | literal | ["json_parser"] |
Advanced Options
drop_field(optional)
If the specified field should be dropped (removed) after parsing. If parsing fails, the field will not be removed, irrespective of this setting.
| Type | Syntax | Default | Example |
|---|---|---|---|
| bool |
field(optional)
The log field to decode as JSON. Must be a string value type.
| Type | Syntax | Default | Example |
|---|---|---|---|
| string | literal | message | ["message","parent.child","array[0]"] |
overwrite_target(optional)
If target_field is set and the log contains a field of the same name as the target, it will only be overwritten if this is set to true.
| Type | Syntax | Default | Example |
|---|---|---|---|
| bool |
target_field(optional)
If this setting is present, the parsed JSON will be inserted into the log as a sub-object with this name. If a field with the same name already exists, the parser will fail and produce an error.
| Type | Syntax | Default | Example |
|---|---|---|---|
| string | literal | ["root_field","parent.child"] |
How it Works
Invalid JSON
If the value for the specified field is not valid JSON you can control keeping
or discarding the event with the drop_invalid option. Setting it to true will
discard the event and drop it entirely. Setting it to false will keep the
event and pass it through. Note that passing through the event could cause
problems and violate assumptions about the structure of your event.
State
This component is stateless, meaning its behavior is consistent across each input.