Help json logs

JSON logs

JSON is an open-standard file format that transmits data objects made up of attribute-value pairs in human-readable format. It's widely adopted for its structured data format and because it's easy to parse. JSON is also compact and simple to implement in most logging frameworks. Site24x7 helps parse your single and multiline JSON logs, so you can pinpoint critical events quickly and take remedial action. Learn more about log management with Site24x7

Getting started

  1. Log in to your Site24x7 account.
  2. Download and install the Site24x7 Server Monitoring agent (Windows | Linux). 
  3. Go to Admin > AppLogs > Log Profile and Add Log Profile.

Single line JSON

Sample log


Log pattern

json $stack$ $machineTimeUTC as MachineTime:date:yyyy-MM-dd'T'HH:mm:ss.SSS'Z'$ $callCenterName as CallCenter$ $name$ $id$

This is the default pattern identified by Site24x7 for parsing the sample JSON logs shown above. The log pattern should start with the keyword "json" and should contain a minimum of one date field.

If you wish to change the field name from "callCenterName" to "CallCenter", you can do so using the keyword "as." Also, if you want to exclude a field from the JSON log, make sure to remove those fields from the log pattern.

The sample log given above can be separated into seven fields, each of which will take its respective value from here and will then be uploaded to Site24x7.

Field name Field value
Machine time UTC 2019-01-01T09:27:11.620Z
ID 661dc0ae-404b-4f0d-9579-ceca6e20f22c
Call CenterName DEV-Station
Name A
Value 100
Stack dev
Machine time 2019-01-01T11:27:11.620+02:00

Edit log type

Multiline JSON

Sample log 


"_index": "keepalive-2019-01-01",

"_type": "logs",

"_id": "49590436630844818814950698841516754273392947672976982018.0",

"_score": 1.5,

"_source": {

"logType": "Keepalive",

"machineData": {

"name": "A",

"callCenterName": "DEV-Station",

"machineTimeUTC": "2019-01-01T09:27:11.620Z",

"id": "661dc0ae-404b-4f0d-9579-ceca6e20f22c",

"stack": "dev",

"machineTime": "2019-01-01T11:27:11.620+02:00"



"fields": {

"nameid": [

"DEV-Station = B"


"machineData.machineTimeUTC": [



"machineData.machineTime": [



"name-id": [

"DEV-Station - B"




Log pattern

As per the sample log given above, if you wish to collect the JSON object content "machineData," use the log pattern below:

json $_source.machineData.stack as Stack$ $_source.machineData.machineTimeUTC as DateTime:date$ $_source.machineData.callCenterName as CenterName$ $ as Name$ $ as Id$ 

Edit log type

If you wish to collect a few other data objects such as _score and _source.logType, use the log pattern below:

json $_source.machineData.stack as Stack$ $_source.machineData.machineTimeUTC as DateTime:date$ $_source.machineData.callCenterName as CenterName$ $ as Name$ $ as Id$ $_source.logType as logtypes$ $_score as score:number$

Related Log types

Was this document helpful?
Thanks for taking the time to share your feedback. We’ll use your feedback to improve our online help resources.

Help json logs