Tailing JSON log files

Sending JSON formatted logstash data into your ELK cluster is great. It is a real help when you are searching through the proverbial haystack in production for clues to what went wrong. However, sometimes when you are developing you might want to read the data off the test server just like it was going to your console … now you hate the JSON format. Tailing the logs is now basically worthless.

Here is a bash script that tails the log and just prints out the ‘@message’ field in the JSON object.

tail -f debug-json.log | \
  xargs -L1 --delimiter='\n' -n1  \
  python -c 'import json,sys; \
             d = json.loads(sys.argv[1]); \
             print d["@message"];';