Use jq to parse JSON logs into something more readable

README.md

Structured logs are way better than normal logs for a whole bunch of reasons, but they can sometimes be a pain to read in the shell. Take this logline for example:

{"erlang_pid":"#PID<0.1584.0>","level":"error","message":"Got error when retry: :econnrefused, will retry after 1535ms. Have retried 2 times, :infinity times left.","module":"","release":"c2ef629cb357c136f529abec997426d6d58de485","timestamp":"2019-12-17T19:22:11.164Z"}

This format is hard for a human to parse. How about this format instead?

error | 2019-12-17T19:21:02.944Z | Got error when retry: :econnrefused, will retry after 1648ms. Have retried 2 times, :infinity times left.

We can go from A to B using our friends jq and the Unix pipe:

kubectl logs <pod> | jq -r '[.level, .timestamp, .message] | join(" | ")'

You can alias this jq command in your .bashrc or .zshrc:

alias pretty="jq -r '[.level, .timestamp, .message] | join(\" | \")'"

Then do this:

kubectl logs <pod> | pretty

Other tips...

Use kubectl -f to tail a pod:

kubectl logs -f <pod> | pretty

Use stern -o raw to tail a group of pods:

stern -o raw <pattern> | pretty