humio / issues

Issue Tracker for Humio
4 stars 2 forks source link

Feature request - ability to render newlines in fields #82

Open nhoad opened 5 years ago

nhoad commented 5 years ago

I'm using JSON logging, with a JSON object per line. For example:

'{"message": "something bad happened", "level": 14, "time": "2019-04-26T13:02:42.319588Z", "module": "__main__", "pid": 17683, "application": "myapplication", "thread": "7fc09c0d1680.0", "traceback": "Traceback (most recent call last):\n\n  File \"<stdin>\", line 2, in <module>\n\nException: no\n"}

And I'm using the following query to make it more readable:

parseJson(@rawstring) | @pid := format("%f", field=pid) | select([@timestamp, application, @pid, message, traceback])

The UI at the moment renders fields with newlines as though they have no newlines, so e.g. the traceback field above is rendered as a single line, which makes following errors difficult. It would be great if there was a filter or something that could be applied to fields to render literal newlines. This way the traceback field from the example JSON would render in Humio like this:

Traceback (most recent call last):

  File "<stdin>", line 2, in <module>

Exception: no

Which would make it much easier to read.

andejens commented 5 years ago

Hi @nathan-hoad, thank you for your input. We'll look into how best to accommodate your request.

Nirzak commented 2 years ago

@nhoad nhoad have you later managed to render new lines in json inside humio?

nhoad commented 2 years ago

I haven't, no.

dereksantibanez commented 1 year ago

Neither have I!

dereksantibanez commented 1 year ago

Closest I can get is repeating each event, with a single traceback line in each event.

splitString(field=traceback, by="\n", as=traceback)
| split(traceback)
| traceback != ""
| select([message, traceback])
| sort(logSeqNum, order=asc)

But it's pretty ugly.

Eg:

message, traceback
this problem happened, Traceback (most recent call last):
this problem happened, File "<stdin>", line 2, in <module>
this problem happened, Exception: no