Fluent-bit parse only first level keys in JSON?

[big-loser]

Hi guys:

Is it possible in Fluent-bit parse JSON message keys but only first level?

For example message:

{"key1": "value1", "key2": "value2", "data": {"inner-key1": "foo", "inner-key2": "bar"}}

Need to parse only key1, key2, data. Key "data" value should be as text no matter how deep structure there is.

"data" Key is Random, maybe it's "request" or something .

How to parse only first level JSON keys

[edsiper]

give me a few examples to understand better, e.g:

1. expected input, expected output
2. expected input, expected output
3. expected input, expected output

[big-loser]

thanks for your reply.

1. expected input:

{"level": "info","time": "2025-08-20T07:35:24.751Z","caller": "handler/crt_blacklist_strategy.go:88","msg": "CrtBlacklistStrategyHandler page","s_name": "hella-manager","s_code": "8081","trace_id": "2679b7e1-38bf-4b0b-b267-58a5b6cbd7d5","request": {"PageIndex": 1,"PageSize": 100,"ID": 0,"Type": 0,"Os": 0,"Value": "","IsWhitelist": false,"AppId": "2"},"response": {"status": "success","data": {"items": [],"total": 0}}}

expected output:

{
  "level": "info",
  "time": "2025-08-20T07:35:24.751Z",
  "caller": "handler/crt_blacklist_strategy.go:88",
  "msg": "CrtBlacklistStrategyHandler page",
  "s_name": "hella-manager",
  "s_code": "8081",
  "trace_id": "2679b7e1-38bf-4b0b-b267-58a5b6cbd7d5",
  "request": "{\"PageIndex\":1,\"PageSize\":100,\"ID\":0,\"Type\":0,\"Os\":0,\"Value\":\"\",\"IsWhitelist\":false,\"AppId\":\"2\"}",
  "response": "{\"status\":\"success\",\"data\":{\"items\":[],\"total\":0}}"
}

2. expected input: {"level": "info","time": "2025-08-20T07:35:24.751Z","caller": "handler/crt_blacklist_strategy.go:88","msg": "CrtBlacklistStrategyHandler page","s_name": "hella-manager","s_code": "8081","trace_id": "2679b7e1-38bf-4b0b-b267-58a5b6cbd7d5","request": {"PageIndex": 1,"PageSize": 100,"ID": 0,"Type": 0,"Os": 0,"Value": "","IsWhitelist": false,"AppId": "2"}}

expected output:

{
  "level": "info",
  "time": "2025-08-20T07:35:24.751Z",
  "caller": "handler/crt_blacklist_strategy.go:88",
  "msg": "CrtBlacklistStrategyHandler page",
  "s_name": "hella-manager",
  "s_code": "8081",
  "trace_id": "2679b7e1-38bf-4b0b-b267-58a5b6cbd7d5",
  "request": "{\"PageIndex\":1,\"PageSize\":100,\"ID\":0,\"Type\":0,\"Os\":0,\"Value\":\"\",\"IsWhitelist\":false,\"AppId\":\"2\"}"
}

3. expected input: {"level": "info","time": "2025-08-20T07:35:24.751Z","caller": "handler/crt_blacklist_strategy.go:88","msg": "CrtBlacklistStrategyHandler page","s_name": "hella-manager","s_code": "8081","trace_id": "2679b7e1-38bf-4b0b-b267-58a5b6cbd7d5","xxxx": {"aaa": 1}} expected output:

{
  "level": "info",
  "time": "2025-08-20T07:35:24.751Z",
  "caller": "handler/crt_blacklist_strategy.go:88",
  "msg": "CrtBlacklistStrategyHandler page",
  "s_name": "hella-manager",
  "s_code": "8081",
  "trace_id": "2679b7e1-38bf-4b0b-b267-58a5b6cbd7d5",
  "xxxx": "{\"aaa\":1}"
}

[github-actions[bot]]

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 5 days. Maintainers can add the exempt-stale label.