Hi,

We are using Kibana for our log analysis. We changed the log4j2.xml appender to <LogStashJSONLayoutPega />. but the alert file message is not in JSON format for us to analyze in Kibana efficiently. The Entire message fields are separated by * not individual fields.

We cannot parse it using FileBeat/Logstash as of now in our current architecture

does anyone know how can we format the message field to JSON specifically for PegaRULES-Alerts Log.

Example of LogEntry: I need a separate field created for PEGA0005.

{"app":"","stack":"","source_host":"CPX-K3BC2J49JT6","alertType":"performance","level":"ALERT","pega_log_type":"ALERT","message":"2021-08-19 09:39:59,045 GMT*8*PEGA0005*1025*500*cedc797982dcf96a0bc41853706918f4*NA*NA*NA*NA*NA*NA*NA*?*-1**2*NA*NA*com.pega.pegarules.data.internal.store.DataStorePreparedStatement*NA*NA*NA*NA*NA*false*NA**NA*NA*NA*NA*NA*NA*NA*NA*Database operation took more than the threshold of 500 ms: 1,025 ms\tSQL: SELECT pzUCShortInsId AS \"pzUCShortInsId\", pyFieldName AS \"pyFieldName\", pyFieldValue AS \"pyFieldValue\", pyLocalizedValue AS \"pyLocalizedValue\", pyRuleSet AS \"pyRuleSet\", pyRuleSetVersion AS \"pyRuleSetVersion\", pyClassName AS \"pyClassName\", pyRuleAvailable AS \"pyRuleAvailable\", pzInsKey AS \"pzInsKey\", pxUpdateDateTime AS \"pxUpdateDateTime\" FROM rules.pr4_fieldvalue WHERE pyRuleAvailable != 'No' ORDER BY pzUCShortInsId*","userid":"","pegathread":"","@timestamp":"2021-08-19T09:39:59.045Z","thread_name":"StartUp-TaskExecutor","@version":1,"tenantid":"","logger_name":"com.pega.pegarules.data.internal.store.DataStorePreparedStatement"}

thanks in advance