concat fields

[Natalia Bell]

Hi, 

We have some problem with json decode. We can't change messages so we need to solve this problem: we receibe messages on json format, but sometimes a field contains double quoted, so json format is corrupted. For example:

{"metadata":{},"reason":"Pulled","message":"Successfully pulsss222led image "sartifactsrepository-tc.shporter:1.0.0-SNAPSHOT"ssd", "count":1,"type":"Normal","eventTime":null,"reportingComponent":"","reportingInstance":""}

We made this regexp https://rubular.com/r/x3Wy2ZGLSqnBBH to substring each field of interest. Actually we want to concat message1+message2+message3 on a field called message. how can we concat this fields on td-agent-bit?

we tried something like this 

[FILTER]

    Name record_modifier

    Match *

    Record message ${record["message1"] record["message2"] record["message3"]}

Thanks!

[Eduardo Silva]

Hi Natalia, 

I'd suggest using a Lua script/filter for such case text manipulation case: 

https://docs.fluentbit.io/manual/pipeline/filters/lua

regards, 

--
You received this message because you are subscribed to the Google Groups "Fluent Bit" group.
To unsubscribe from this group and stop receiving emails from it, send an email to fluent-bit+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/fluent-bit/d2d7cfd7-5e49-4890-a300-e2acf5ab4afbn%40googlegroups.com.

--

Eduardo Silva

Calyptia Inc.

https://fluentbit.io

https://twitter.com/edsiper