How to retrieve nested json in fetch logs

dkroger — Fri, 24 Oct 2025 09:14:12 GMT

Hello team,

I having trying to get some fields from keda controller in kubernetes using fetch logs, this query is almost there but missing some nested json values

fetch logs | filter matchesValue(k8s.namespace.name, "keda") | sort timestamp desc | parse content, "LD JSON:json" | fieldsFlatten json, fields:{type,namespace,name, error} | parse error, "LD JSON:error_log" | fields timestamp, name, namespace, error_log

I'm able to get the error log which shows as an actual json:

{ "error": { "code": "404", "message": "Resource not found. The requested item could not be located.", "status": "NOT_FOUND", "details": [ { "@type": "type.googleapis.com/google.rpc.ResourceInfo", "resourceType": "exampleResource", "resourceName": "sample-id-123", "owner": "sample-owner", "description": "The resource with the given ID does not exist." } ] } }

How can I get the message, status and owner in my query above?

Re: How to retrieve nested json in fetch logs

darya-ramashko — Fri, 28 Nov 2025 16:38:27 GMT

Hello,

You could try something like this:

fetch logs | filter matchesValue(k8s.namespace.name, "keda") | sort timestamp desc | parse content, "JSON:json" | fieldsFlatten json, fields:{type,namespace,name} | fieldsAdd errorMessage = json[error][message], errorStatus = json[error][status], errorOwner=json[error][details][0][owner] | fields timestamp, type, name, namespace, errorMessage, errorStatus, errorOwner

Hope that helps,

Darya

topic How to retrieve nested json in fetch logs in Log Analytics

How to retrieve nested json in fetch logs

Re: How to retrieve nested json in fetch logs