Here's the log format in the system that we are currently using and right now it's not easy to change the logs format through the entire system. And I need a way to extract the json object in the logs and its fields. So that I can have easier time looking at the logs as currently the size of the messages is too big.

This is the log formate

A B C {"field name one":value of field , "msg": "a sample message", "c": c}

Here's a sample log. Note that the fields A, B, C don't have spaces but the json object's fields and values may have spaces.

service_name/syslog.log:2022-09-24T16:18:01.38754199Z stdout F {"level":"info","ts":1664036281.3874626,"msg":"system sample message","host":"host_name","processor":"test","reqId":"1234"}

and through cli, I'd just want to print the values in msg. How can I do that?

  • Probably best to use a combo of something else with jq to do this the "right way", but sed -n -e 's/.*"msg":\s*"//' -e 's/\([^\\]\)".*/\1/p' filename.log would probably be close to what you want. The first expression removes everything up to "msg": " (with any number of spaces after the colon) and the second removes everything from the first remaining " which is not preceded by an escaping backslash.
    – frabjous
    Sep 25 at 0:31

1 Answer 1


jq is a common tool to manipulate JSON. jq -r .msg will return the decoded value of the msg key in the JSON document.

You can use cut to get the JSON data by extracting the fields from field four onwards (cut -d ' ' -f 4-)

So combine them:

cut -d ' ' -f 4- | jq -r .msg


echo '2022-09-24T16:18:01.38754199Z stdout F {"level":"info","ts":1664036281.3874626,"msg":"system sample message","host":"host_name","processor":"test","reqId":"1234"}' | cut -d ' ' -f 4- | jq -r .msg
system sample message

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.