Parsing JSON Logs with Nested Objects

Nested Objects in JSON Logs

Production JSON logs often contain nested objects with rich contextual data. The parser extracts the top-level standard fields and serializes nested objects into the extra fields section for inspection.

Example: API Request Log

{
  "timestamp": "2024-01-15T10:30:00.000Z",
  "level": "error",
  "logger": "api-handler",
  "message": "Request failed with validation error",
  "request": {
    "method": "POST",
    "path": "/api/users",
    "body": {"name": "", "email": "invalid"},
    "headers": {"content-type": "application/json"}
  },
  "error": {
    "code": "VALIDATION_ERROR",
    "details": [
      {"field": "name", "message": "Name is required"},
      {"field": "email", "message": "Invalid email format"}
    ]
  },
  "requestId": "req-abc-123",
  "duration": 15
}

How Nested Fields Are Handled

The parser processes nested objects by:

1. Top-level standard fields — timestamp, level, logger, and message are extracted into their respective columns
2. Nested objects — are serialized to JSON strings and shown as extra fields (e.g., request: {"method":"POST",...})
3. Scalar extra fields — like requestId and duration are shown as-is in extra fields

Correlation IDs

A common pattern in microservice architectures is including a requestId (also called traceId or correlationId) in every log entry. When searching parsed logs, you can filter by this ID to trace a single request across multiple service logs.

Error Stack Traces

Error logs often include a stack or stackTrace field containing the full exception trace. The parser preserves this in the extra fields section, where you can expand it for full inspection.