tojson
Converts the given field values to the JSON string.
Syntax
tojson [output=TARGET_FIELD] [FIELD, ...]
Optional Parameter
output=TARGET_FIELD
- Field to store the converted JSON string (default:
_json
). FIELD, ...
- Fields to be converted into the JSON string, separated by a comma (
,
) (default: all fields).
Usage
-
Convert the all fields into the json string and assign it to the result field.
tojson output=result
-
Convert the _time and line fields into the json format and assign it to the jsonlog field.
tojson output=jsonlog _time, line