JSON is an open-standard file format that transmits data objects made up of attribute-value pairs in a human-readable form. It's widely adopted for its structured data format and because it's easy to parse. JSON is also compact and simple to implement in most logging frameworks. Site24x7 helps you parse single and multiline JSON logs. Additionally, it supports the combination of a simple log with JSON log patterns. You can track and monitor these logs with Site24x7 Applogs.

Table of contents

Getting started 

  1. Log in to your Site24x7 account. 
  2. Download and install the Site24x7 Server Monitoring agent (Windows | Linux). 
  3. Go to Admin > AppLogs > Log Types, then select Add Log Type.

Single line JSON

Sample log


Log pattern

Following is the default pattern identified by Site24x7 for parsing the sample JSON logs. The log pattern should start with the keyword json and contain a minimum of one date field.

json $stack$ $machineTimeUTC as MachineTime:date:yyyy-MM-dd'T'HH:mm:ss.SSS'Z'$ $callCenterName as CallCenter$ $name$ $id$
If you wish to change the field name, say from callCenterName to CallCenter, use the as keyword. Also, if you want to exclude a field from the JSON log, you can remove it from the log pattern.

This log is separated into fields, each of which will take its respective value, and is then uploaded to Site24x7. 

Field name Field value
stack dev
MachineTime 2019-01-01T09:27:11.620Z
CallCenter DEV-Station
name A
id 661dc0ae-404b-4f0d-9579-ceca6e20f22c

Multiline JSON

Sample log 

"_index": "keepalive-2019-01-01",
"_type": "logs",
"_id": "49590436630844818814950698841516754273392947672976982018.0",
"_score": 1.5,
"_source": {
"logType": "Keepalive",
"machineData": {
"name": "A",
"callCenterName": "DEV-Station",
"machineTimeUTC": "2019-01-01T09:27:11.620Z",
"id": "661dc0ae-404b-4f0d-9579-ceca6e20f22c",
"stack": "dev",
"machineTime": "2019-01-01T11:27:11.620+02:00"
"fields": {
"nameid": [
"DEV-Station = B"
"machineData.machineTimeUTC": [
"machineData.machineTime": [

Log pattern

You can use the following log pattern to collect the JSON object machineData from the sample log.

json $_source.machineData.stack as Stack$ $_source.machineData.machineTimeUTC as DateTime:date$ $_source.machineData.callCenterName as CenterName$ $_source.machineData.name as Name$ $_source.machineData.id as Id$ 
Field name Field value
Stack dev
DateTime 2019-01-01T09:27:11.620Z
CenterName DEV-Station
Name A
Id 661dc0ae-404b-4f0d-9579-ceca6e20f22c

You can use the following log pattern to collect a few other data objects such as _score and _source.logType.

json $_source.machineData.stack as Stack$ $_source.machineData.machineTimeUTC as DateTime:date$ $_source.machineData.callCenterName as CenterName$ $_source.machineData.name as Name$ $_source.machineData.id as Id$ $_source.logType as logtypes$ $_score as score:number$

Combination of normal logs with JSON log pattern

Sample log

2022/06/06 09:13:38 vagrant program[123]: server.1 {"method":"GET", "status_code":200, "url":"https://zylker.com/logs/pipelines", "duration":123456}

Log pattern

The following log pattern contains a combination of normal and JSON format logs:

$Date:date$ vagrant program[123]: server.1 $Message:json:$method$ $status_code:number$ $url$ $duration:number$$
This log pattern supports only a single line JSON log combination with a normal log.
Field name Field value
Date 2022/06/06 09:13:38
method GET
status_code 200
url https://www.zylker.com/logs/ingest
duration 123456

With JSON object

Sample log

{"timestamp":"2024-02-12 12:12:12","name":"Request Count of Sample App","widgetId":12,"description":"Event description","params":{"selected":212,"period":0},"version":"0.1"}

Log pattern

json $widgetId:number$ $name$ $description$ $params:json-object$ $version$ $timestamp:date:yyyy-MM-dd HH:mm:ss$

JSON object

With JSON array

Sample log


Log pattern

json $routePlannerRouteId$ $routeDate:date:yyyy-MM-dd'T'HH:mm:ss$ $routeId$ $regionId$ $oprCode$ $stopdetails:json-array:($locationKey$ $attributes$ $routePlannerStopId$ $stopETA$)$

JSON array

Using spaces in the field name

Sample log

{"Machine Time":"2019-01-01T09:27:11.620Z","keyid":"661dc0ae-404b-4f0d-9579-ceca6e20f22c","Service Name":"DEV-Station","Service Value":100,"Stack":"dev"}

Log pattern

json $Machine Time as MachineTime:date:yyyy-MM-dd'T'HH:mm:ss.SSS'Z'$ $Service Value as ServiceValue:number$ $keyid$ $Service Name as ServiceName$ $Stack$


Related log types

Was this document helpful?
Thanks for taking the time to share your feedback. We’ll use your feedback to improve our online help resources.