Nested JSON Output

[atze234]

Hello,

i'm parsing my logs using Grok Patterns with the fluent-plugin-grok-parser. Having such a pattern in filter for example:

<filter matcher>
  @type parser
  key_name message
  reserve_data true
<grok>
  pattern "^%{IP:[http][request][client][ip]} %{DATA}"
</grok>
</filter>

This will create the Field "[http][request][client][ip]" in cloudwatch logs. Is it possible somehow that i can put nested JSON directly to cloudwatch?

What i expect in Cloudwatch Logs:

{

    "host": "myhostname",
    "message": "192.168.0.1 message-from-ip",
    "http": {
        "request": {
          "client": {
            "ip" : "192.168.0.1"
          }
        }
      }
}

But i got in cloudwatch:

{

    "host": "myhostname",
    "message": "192.168.0.1 message-from-ip",
    "[http][request][client][ip]": "192.168.0.1"
}

Im using the fluent-package from Debian Repository with these plugins: fluent-plugin-cloudwatch-logs (0.14.3) fluent-plugin-grok-parser (2.6.2)

[github-actions[bot]]

@atze234 this issue was automatically closed because it did not follow the issue template.