<p>Could anyone offer advice on how to configure promtail correctly to parse the json output from my logs?
I haven't been able to figure out why promtail is not identifying the json properties and showing them in Grafana.</p>
<p>my logback appender, in logback.xml:</p>
<pre><code>&lt;appender name=&quot;json&quot;
    class=&quot;ch.qos.logback.core.ConsoleAppender&quot;&gt;
    &lt;layout class=&quot;ch.qos.logback.contrib.json.classic.JsonLayout&quot;&gt;
        &lt;jsonFormatter
            class=&quot;ch.qos.logback.contrib.jackson.JacksonJsonFormatter&quot;&gt;
            &lt;prettyPrint&gt;true&lt;/prettyPrint&gt;
        &lt;/jsonFormatter&gt;
        &lt;timestampFormat&gt;yyyy-MM-dd' 'HH:mm:ss.SSS&lt;/timestampFormat&gt;
    &lt;/layout&gt;
&lt;/appender&gt;
</code></pre>
<p>promtail.yaml</p>
<pre><code>        ...
        ...
        ...
 scrape_configs:
    - job_name: parse-logs
      pipeline_stages:
        - docker: {}
        - json:
            expressions:
              subscriptionType:
              AuthenticationSuccess:
              user:
              execution_lasted: execution_lasted
              time-to-pull(.ms): time-to-pull(.ms)
            source: message
        - json:
            expressions:
              logger: logger
              level: level
              timestamp: timestamp
              message: message
        - labels:
            level:
            timestamp:
        ...
        ...
        ...
</code></pre>
<p>logs:</p>
<pre><code>...
{
  &quot;timestamp&quot; : &quot;2022-11-24 09:33:03.361&quot;,
  &quot;level&quot; : &quot;DEBUG&quot;,
  &quot;thread&quot; : &quot;http-nio-8081-exec-3&quot;,
  &quot;logger&quot; : &quot;com.vanitysoft.boundariesio.unitedstates.domain.dao.impl.PostalGrabberDAOImpl&quot;,
  &quot;message&quot; : &quot;{\&quot;time-to-pull(.ms)\&quot;:12,\&quot;user\&quot;:\&quot;unknown\&quot;,\&quot;number-of-postals\&quot;:1}&quot;,
  &quot;context&quot; : &quot;default&quot;
}{
  &quot;timestamp&quot; : &quot;2022-11-24 09:33:03.361&quot;,
  &quot;level&quot; : &quot;DEBUG&quot;,
  &quot;thread&quot; : &quot;http-nio-8081-exec-3&quot;,
  &quot;logger&quot; : &quot;com.vanitysoft.boundariesio.unitedstates.domain.dao.impl.PostalGrabberDAOImpl&quot;,
  &quot;message&quot; : &quot;{\&quot;time-to-pull(.ms)\&quot;:12,\&quot;user\&quot;:\&quot;unknown\&quot;,\&quot;number-of-postals\&quot;:1}&quot;,
  &quot;context&quot; : &quot;default&quot;
}
</code></pre>
<p>After editing promtail config I preform a rollup update...</p>
<pre><code>kubectl edit configmap loki-promtail --namespace loki-stack
kubectl rollout restart deployment/lke-monitor-grafana
</code></pre>
<p><strong>Update</strong>
promtail parsing requires the logs to be written on the same line(no pretty print!)</p>
<pre><code>&lt;layout class=&quot;ch.qos.logback.contrib.json.classic.JsonLayout&quot;&gt;
    &lt;jsonFormatter          class=&quot;ch.qos.logback.contrib.jackson.JacksonJsonFormatter&quot;&gt;
    &lt;/jsonFormatter&gt;
     &lt;appendLineSeparator&gt;true&lt;/appendLineSeparator&gt;
    &lt;timestampFormat&gt;yyyy-MM-dd' 'HH:mm:ss.SSS&lt;/timestampFormat&gt;
&lt;/layout&gt;
</code></pre>

<p>Assuming you correctly copied in your <code>promtail.yaml</code>, there is a formatting error: <code>-docker: {}</code> should be <code>- docker: {}</code></p>
<pre><code>---
scrape_configs:
  - job_name: parse-logs
    pipeline_stages:
      - docker: {}
      - json:
          expressions:
            subscriptionType: null
            AuthenticationSuccess: null
            user: null
            execution_lasted: execution_lasted
            time-to-pull(.ms): time-to-pull(.ms)
          source: message
      - json:
          expressions:
            logger: logger
            level: level
            timestamp: timestamp
            message: message
      - labels:
          level: null
          timestamp: null
</code></pre>
