Structured json logging from systemd service and agent

[wilk]

Hi,

I run my systemd service from a VM which return json log. (Theses json logs are fine, they was recognized as json when I was running the same app from CloudRun). I also run Caddy which also send json logs.

On the config.yaml of /etc/google-cloud-ops-agent I set a processors with type: parse_json but on the log explorer all the json is going to message and not parsed.

What did I missed ?

logging:
  processors:
    parse_seps:
      type: parse_json
  receivers:
    systemd_journald:
      type: systemd_journald
  service:
    pipelines:
      default_pipeline:
        receivers: [systemd_journald]
        processors: [parse_seps]

jsonPayload: {
MESSAGE: "{"severity":"INFO","message":"GET /joueur/miasa","joueur":"miasa"}"
PRIORITY: "6"
SYSLOG_FACILITY: "3"
}

[80x24]

Tell the parse_seps processor to parse the MESSAGE field:

logging:
  processors:
    parse_seps:
      type: parse_json
      field: MESSAGE
  receivers:
    systemd_journald:
      type: systemd_journald
  service:
    pipelines:
      default_pipeline:
        receivers: [systemd_journald]
        processors: [parse_seps]

[Philipp_Horwat]

I am currently facing the same problem as @wilk . Unfortunately, your proposed solution does not work.

Also, according to the documentation here, there is no field parameter for the parse_json processor.

[lawrencenelson]

Hi @wilk,

Welcome to the Google Cloud Community!

As a first step in troubleshooting, I recommend ensuring that the output of your systemd service is structured in the proper JSON format. This involves adjusting how your service writes its logs to ensure that each log entry is a valid JSON object.

Once you have your systemd service outputting structured JSON logs, consider using Fluentd to further process and forward these logs to the Ops Agent. Fluentd can be configured to collect logs directly from your systemd service, either by tailing log files or capturing stdout/stderr outputs.

I hope this helps. Thank you.