Documentation forPapertrail

JSON search syntax

In addition to using the Google-esque search syntax to find things in your logs, Papertrail can parse a JSON object that appears at the end of a log line. Each line can contain arbitrary string data before the JSON. For example:

Copy 
2019-12-02 03:04:05 DEBUG {"a":123,"b":456}

This is a beta feature and the final syntax might change. If you have any questions or suggestions, please contact contact us.

JSON Search Syntax

Root level search

Copy 
json.orgId:1193

Example matches:

Exact match { "orgId": 1193 }
Substring match { "orgId": 11933962 }

Nested search

Copy 
json.user.name:pete

Example matches:

Exact match { "user": {"name": "Pete"} }
Substring match { "user": {"name": "Peter" } }

Exact Match

Copy 
json.orgId:"11933962"

Example matches:

Exact match { "orgId": 11933962 }

Negation

Copy 
json.cursor.tail:false AND -json.orgId:15884562

Example matches:

Different value for orgId { "orgId": 11933962, "cursor": {"tail": false} }
orgId not present { "cursor": {"tail": false} }

The scripts are not supported under any SolarWinds support program or service. The scripts are provided AS IS without warranty of any kind. SolarWinds further disclaims all warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The risk arising out of the use or performance of the scripts and documentation stays with you. In no event shall SolarWinds or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the scripts or documentation.