英文:
ill-formed log in Loki
问题
我正在使用golang中的zerolog，它输出json格式的日志。应用程序正在k8s上运行，并且具有以下cri-o格式。
在Grafana loki上的实际日志截图
我的问题是，由于我的json日志前面有一些非json文本，我似乎无法有效地查询日志，一个例子是，当我尝试将日志导入logfmt时，会抛出异常。
我想要的是能够查询json的子字段。
我的直觉是，也许对于每个日志，只选择从{（json的开始）开始的部分，然后也许我可以进行更有趣的操作。我有点困惑，不确定继续的最佳方式是什么。
非常感谢任何帮助和意见。
英文:
I'm using zerolog in golang, which outputs json formatted log, the app is running on k8s, and has cri-o format as following.
actual log screenshot on Grafana loki
My question is, since there's some non-json text prepended to my json log, I can't seem to effectively query the log, one example is, when I tried to pipe the log into logfmt, exceptions were thrown.
What I want is to be able to query into the sub field of the json.
My intuition is to maybe for each log, only select the parts from { (start of the json), then maybe I can do more interesting manipulation. I'm a bit stuck and not sure what's the best way to proceed.
Any help and comments is appreciated.
答案1
得分: 1
经过一番思考，问题解决了。
由于我直接使用了这里的 promtail 设置 https://raw.githubusercontent.com/grafana/loki/master/tools/promtail.sh
在这个设置中，默认的解析器是 docker，但我们需要将其更改为 cri，之后，日志在我的 Grafana 仪表板中被正确解析为 JSON。
英文:
after some head scratching, problem solved.
As I'm directly using the promtail setup from here https://raw.githubusercontent.com/grafana/loki/master/tools/promtail.sh
And within this setup, the default parser is docker, but we need to change it to cri, afterwards, the logs are properly parsed as json in my Grafana dashboard
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论