diff --git a/docs/clients/promtail/stages/json.md b/docs/clients/promtail/stages/json.md index 2f115ab25df84..ba20011ab59d7 100644 --- a/docs/clients/promtail/stages/json.md +++ b/docs/clients/promtail/stages/json.md @@ -10,6 +10,10 @@ json: # Set of key/value pairs of JMESPath expressions. The key will be # the key in the extracted data while the expression will the value, # evaluated as a JMESPath from the source data. + # + # Literal JMESPath expressions can be done by wrapping a key in + # double quotes, which then must be wrapped in single quotes in + # YAML so they get passed to the JMESPath parser. expressions: [ : ... ] @@ -89,3 +93,33 @@ The second stage will parse the value of `extra` from the extracted data as JSON and append the following key-value pairs to the set of extracted data: - `user`: `marco` + +### Using a JMESPath Literal + +This pipeline uses a literal JMESPath expression to parse JSON fields with +special characters in the name, like `@` or `.` + +For the given pipeline: + +```yaml +- json: + expressions: + output: log + stream: '"grpc.stream"' + timestamp: time +``` + +Given the following log line: + +``` +{"log":"log message\n","grpc.stream":"stderr","time":"2019-04-30T02:12:41.8443515Z"} +``` + +The following key-value pairs would be created in the set of extracted data: + +- `output`: `log message\n` +- `stream`: `stderr` +- `timestamp`: `2019-04-30T02:12:41.8443515` + +Note that referring to `grpc.stream` without the combination of double quotes +wrapped in single quotes will not work properly.