tojson

Converts the given field values to the JSON string.

Syntax

tojson [output=TARGET_FIELD] [FIELD, ...]
Optional Parameter
output=TARGET_FIELD
Field to store the converted JSON string (default: _json).
FIELD, ...
Fields to be converted into the JSON string, separated by a comma (,) (default: all fields).

Usage

  1. Convert the all fields into the json string and assign it to the result field.

    tojson output=result
    
  2. Convert the _time and line fields into the json format and assign it to the jsonlog field.

    tojson output=jsonlog _time, line