How to use the processor_packjson plug-in to encapsulate fields - Simple Log Service

If you use Logtail to collect logs, you can use the processor_packjson plug-in to encapsulate one or more fields into a JSON object-formatted field. This topic describes the parameters of the processor_packjson plug-in and provides examples on how to configure the plug-in.

Limits

The input plug-ins for text logs and container stdout and stderr support only form configuration. Other input plug-ins support only editor configuration in JSON.

Entry point

If you want to use a Logtail plug-in to process logs, you can add a Logtail plug-in configuration when you create or modify a Logtail configuration. For more information, see Overview of Logtail plug-ins for data processing.

Configuration description

Important

Only Logtail V0.16.28 and later support the processor_packjson plug-in.

Form configuration

Parameters

Set the Processor Type parameter to Encapsulate Fields. Then, configure other parameters based on the following table.

Parameter	Description
Original Field	The original fields to encapsulate.
New Field	The new field after encapsulation.
Retain Original Field	Specifies whether to retain the original fields in the new log that is obtained after parsing.
Report Original Field Missing Error	Specifies whether to report an error if the raw log does not contain the original fields.

Examples
The following example shows how to encapsulate the a and b fields into the d_key JSON field:
- Raw log
```
"a":"1"
"b":"2"
```
- Logtail plug-in configuration for data processing
- Processing result
```
"a":"1"
"b":"2"
"d_key":"{\"a\":\"1\",\"b\":\"2\"}"
```

Editor configuration in JSON

Parameters

Set the type parameter to processor_packjson. Then, configure other parameters in the detail section based on the following table.

Parameter	Type	Required	Description
SourceKeys	String array	Yes	The original fields to encapsulate.
DestKey	String	No	The new field after encapsulation.
KeepSource	Boolean	No	Specifies whether to retain the original fields in the new log that is obtained after parsing. Valid values: true (default) false
AlarmIfIncomplete	Boolean	No	Specifies whether to report an error if the raw log does not contain the original fields. Valid values: true (default) false

Examples

The following example shows how to encapsulate the a and b fields into the d_key JSON field.

Raw log
```
"a":"1"
"b":"2"
```

Logtail plug-in configuration for data processing

{
  "processors":[
    {
      "type":"processor_packjson",
      "detail": {
        "SourceKeys": ["a","b"],
        "DestKey":"d_key",
        "KeepSource":true,
        "AlarmIfEmpty":true
      }
    }
  ]
}

Processing result

"a":"1"
"b":"2"
"d_key":"{\"a\":\"1\",\"b\":\"2\"}"