https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-JSON-parsing-in-Log-module/ta-p/300189 <H2 class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">Table of contents</H2> <P><LI-TOC indent="15" liststyle="disc" maxheadinglevel="3"></LI-TOC></P> <HR /> <H2 class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">Summary</H2> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">This article helps you troubleshoot common issues with JSON log ingestion in Log module (deployed via OneAgent or Dynatrace Operator). It covers mixed plain-text and JSON log files, incorrect timestamp extraction, and incorrect severity mapping. It applies to SaaS and Managed environments on Linux and Windows.</P> <H2 class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">Problem</H2> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Log Module supports JSON log ingestion, but parsing does not always behave as expected. Common symptoms include:</P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">A log file contains both plain-text and JSON entries, and the JSON entries are reported individually in some places and merged with plain-text entries in others.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">A JSON log entry is ingested with the wrong timestamp, for example, a <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">created_at</CODE> or <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">eventtime</CODE> value is used instead of the entry's actual log time.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">A log entry uses a custom JSON field for its timestamp, but Log module doesn't pick it up.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Severity (log level) values in ingested logs don't match the values written by the application, for example, a <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">severity</CODE> field set to <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">STATS</CODE> appears in Dynatrace as <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">SEVERE</CODE>.</LI> </UL> <H2 class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">Resolution</H2> <H3 class="text-text-100 mt-2 -mb-1 text-base font-bold">Mixed plain-text and JSON entries in the same log file</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">A log file or container stream contains both plain-text log lines and JSON objects.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">JSON entries are sometimes reported individually and sometimes merged with surrounding plain-text lines, depending on where in the file Log module began reading.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Behavior is inconsistent between agent restarts or rotations.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Log Module does not support log files that mix plain-text and JSON entries without explicit guidance on where each entry begins. This is a known limitation.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Configure the <STRONG>Log entry boundary</STRONG> setting so Log module knows where one entry ends and the next begins. You'll typically need one boundary pattern per entry type (one matching JSON entries, one matching plain-text entries).</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">For step-by-step configuration, see <EM>Troubleshooting log record boundary detection &gt; Mixed plain text and JSON entries not separated correctly</EM>.</P> <HR /> <H3 class="text-text-100 mt-2 -mb-1 text-base font-bold">Timestamp extracted from the wrong field</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">A JSON log entry is ingested with a timestamp that doesn't match its actual log time.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The misleading timestamp value matches a field elsewhere in the JSON payload (for example, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">eventtime</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">created_at</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">period_start</CODE>).</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The log line contains plain-text content before the JSON object (a "prefix").</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause (brief)</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">When JSON parsing is turned on, Log module looks for the timestamp value in a predefined set of supported JSON keys. For the full list of supported keys, see <A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://docs.dynatrace.com/docs/analyze-explore-automate/logs/lma-log-ingestion/lma-log-ingestion-via-api/lma-ingest-json-txt-logs" target="_blank" rel="noopener">Ingest JSON and TXT logs</A>. The same rules apply to OneAgent log ingestion.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">When a plain-text prefix exists before the JSON object, the timestamp found in the prefix takes priority over any timestamp inside the JSON object. Plain-text content <STRONG>after</STRONG> the closing <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">}</CODE> (a "suffix") is not parsed, it's copied as-is into the log content.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">If the wrong timestamp is being picked from a prefix, adjust the application's log format so the prefix either contains the intended timestamp or contains no date-like string.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">If the wrong timestamp is being pulled from the JSON object, reorder the JSON so a supported timestamp key appears before any misleading fields.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">If neither option is possible, see <EM>Troubleshooting missing logs &gt; Entries dropped — timestamp out of bounds</EM> for additional workarounds, including disabling JSON parsing or defining an explicit timestamp pattern.</LI> </UL> <HR /> <H3 class="text-text-100 mt-2 -mb-1 text-base font-bold">Timestamp in a non-standard JSON key</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The log entry contains a clearly recognizable timestamp inside the JSON payload, but Log module assigns a different (or auto-observed) timestamp.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The JSON key holding the timestamp is not on the <A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://docs.dynatrace.com/docs/analyze-explore-automate/logs/lma-log-ingestion/lma-log-ingestion-via-api/lma-ingest-json-txt-logs" target="_blank" rel="noopener">list of supported timestamp keys</A>.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">When JSON parsing is turned on, Log module only looks for timestamps in the predefined set of supported keys. A timestamp in a non-standard key is ignored.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">To extract the timestamp from a non-standard key:</P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><STRONG>Turn off JSON parsing</STRONG> for this log source. Log Module will then scan the raw log line for a timestamp using configured patterns, allowing you to anchor on the non-standard field. Note: With JSON parsing turned off, JSON fields are no longer automatically extracted as log attributes; the line is ingested as a raw string.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Alternatively, ask the application team whether the field can be renamed to one of the supported keys.</LI> </UL> <HR /> <H3 class="text-text-100 mt-2 -mb-1 text-base font-bold">Unexpected severity/log level values</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Ingested logs show severity values that don't match those emitted by the application.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The application's severity values are non-standard but happen to start with the same letter as a known severity level, for example, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">STATS</CODE> mapped to <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">SEVERE</CODE>, or <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">WAITING</CODE> mapped to <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">WARN</CODE>.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause (brief)</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">When JSON parsing is turned on, Log module applies a permissive severity mapping that matches values in recognized severity keys based on their <STRONG>first letter</STRONG>. Non-standard values that share a first letter with a known log level can be mapped incorrectly. For the full list of severity value mappings, see <A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://docs.dynatrace.com/docs/analyze-explore-automate/logs/lma-log-ingestion/lma-log-ingestion-via-api/lma-log-data-transformation" target="_blank" rel="noopener">Log data transformation for OneAgent-ingested JSON logs</A>.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">When JSON parsing is disabled, severity mapping is stricter, and this ambiguity does not apply.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Inspect the affected log entries and check whether the severity/level field contains values that begin with the same letter as a standard severity (for example, values starting with <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">S</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">W</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">I</CODE>, or <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">E</CODE>).</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Adjust the application's log format so severity values use unambiguous strings, ideally, the standard severity names (<CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">INFO</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">WARN</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">ERROR</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">DEBUG</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">TRACE</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">FATAL</CODE>).</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">If the application can't be changed, consider disabling JSON parsing for this log source to apply the stricter severity mapping. Note: this loses automatic JSON field extraction.</LI> </UL> <H2 class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">What's next</H2> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">For broader boundary issues (multi-line entries split incorrectly, entries merged), see <EM>Troubleshooting log record boundary detection</EM>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">For missing logs (records not appearing at all, including timestamp-out-of-bounds drops), see <EM>Troubleshooting missing logs</EM>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">For ingest delay, see <EM>Troubleshooting log ingest delay</EM>.</LI> </UL> Wed, 26 Aug 2026 08:34:14 GMT Kacper 2026-08-26T08:34:14Z https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-JSON-parsing-in-Log-module/ta-p/300189 <P><LI-TOC indent="15" liststyle="disc" maxheadinglevel="2"></LI-TOC></P> <DIV class="lia-message-template-content-zone"> <P>*<EM>Use a table of contents for longer articles.&nbsp;</EM></P> <H2>Summary</H2> <P><EM>*This is a mandatory section.</EM></P> <P><EM>Short description of which part of the Dynatrace platform the article refers to and what kind of problem it will help resolve/ task it will describe.</EM></P> <P>&nbsp;</P> <H2>Problem</H2> <P><EM>*This is a mandatory section.</EM></P> <P><EM>Provide a precise description of the problem/ task to be described. Use anonymized screenshots, and include text for&nbsp;important messages, errors, or information that will help the customer find this article when searching.</EM></P> <P>&nbsp;</P> <H2>Troubleshooting steps</H2> <P><EM>*This section can be omitted as necessary.</EM></P> <P><EM>Explain what troubleshooting steps should be taken to ensure the problem matches this article.</EM></P> <P>&nbsp;</P> <H2>Resolution</H2> <P><EM>*This section can be omitted for articles that guide customers on case creation.</EM></P> <P><EM>Explain the solution or all possible solutions resulting from the troubleshooting steps.<BR /><BR /></EM></P> <H2>What's next</H2> <P><EM>*This is a mandatory section. Customers need a way to respond or follow up if they have questions.&nbsp;</EM></P> <P><EM>Explain what to do if the article didn't help.&nbsp;</EM><EM>Note that there are multiple options available, including:</EM></P> <OL> <LI><EM><STRONG>Opening a chat or support case&nbsp;</STRONG>- be as specific as possible about the information the customer should include in the case.&nbsp;</EM><EM>Use the following formula and fill or change the bullet points:<BR /><BR /></EM> If this article didn't help, <STRONG>create a chat or open a support case</STRONG> <UL> <LI>Mention that you reviewed this article.</LI> <LI>Include the following details: <UL> <LI>Link to XYZ</LI> <LI>Screenshot of XYZ</LI> <LI>Information about XYZ</LI> </UL> </LI> </UL> </LI> <LI><EM><STRONG>Suggesting Product Idea</STRONG> - encourage the customer to suggest/ vote for a Product Idea explaining their business use case.<BR /></EM> <DIV>Please submit a Product Idea with detailed information about your request and use case in the Product Ideas forum. Our Product Management team regularly reviews these suggestions:</DIV> <A href="https://community.dynatrace.com/t5/Dynatrace-product-ideas/idb-p/DynatraceProductIdeas" target="_blank" rel="noopener">https://community.dynatrace.com/t5/Dynatrace-product-ideas/idb-p/DynatraceProductIdeas</A></LI> <LI><STRONG><EM>Explain this will change in the future </EM></STRONG><EM>- explain that this behavior will change in a future release. (No product idea / support case needed)</EM></LI> <LI><STRONG><EM>Alternatives -</EM></STRONG><EM>&nbsp;any other actions or links to other articles that could move the customer forward.</EM></LI> </OL> <H2><BR />Related reading</H2> <P><EM>*Link this article to other relevant configuration or troubleshooting guides, including any applicable troubleshooting maps.<BR />:open_book:&nbsp;&nbsp;</EM><A href="https://community.dynatrace.com/t5/Troubleshooting/" target="_blank" rel="noopener">XXX Troubleshooting Map</A></P> <P>:open_book:&nbsp; Link 1</P> <P>:open_book:&nbsp; Link 2</P> <P>:open_book:&nbsp; Link 3</P> <P>:open_book:&nbsp; Link 4</P> </DIV> Wed, 26 Aug 2026 08:34:14 GMT https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-JSON-parsing-in-Log-module/ta-p/300189 Kacper 2026-08-26T08:34:14Z