dashboard vars, extract field values from json content

[dginhoux]

Hi,

I'm ingesting traefik json logs in json format. And i want to create a dashboard with a var list with a field in json (RequestAddr).
So, i create a var with the following config and query :

But i it return the full _msg content... i don't understand how get this value.

Json sample :

Can you help me ?

[tiny-pangolin]

I do not believe it is possible for the logs datasource to detect generated fields from the unpack_json pipe. Would it be possible for you to parse the json using a something like telegraf or vector so RequestAddr shows up as other field when it is ingested?

As an example this the telegraf configuration I'm using to parse Traefik logs from docker before shipping them to Victorialogs

The other benefit to parsing the logs at ingestion time instead of query time is the queries will complete faster and use fewer resources since Victorialogs isn't parsing the logs every time the dashboard loads.