InfluxDB Logs - Output is split into multiple measurements (1 for each key-value pair)

[harcipulyka]

I have a custom remap input that returns key-value pairs (dict, json ?, not sure about the Vector terminology). I would like to push this to my InfluxDB instance. My problem is that instead of creating one measurement per log entry, it creates an entry for each key that exists in the parsed json log entry.

This is the config:

  influx:
    type: influxdb_logs
    inputs: ["parse_message"]
    bucket: bucketname
    endpoint: https://influx.my-website.com
    measurement: log
    org: my-org

And for debugging, I also added a console sink with this config:

  console:
    type: "console"
    inputs: ["parse_message"]
    encoding:
      codec: "json"

Which results in results like this:

{
    "context": "core",
    "event": "Server is running on port 8080",
    "level": "info",
    "timestamp": 1743355879
}

And in influx these appear as seperate entries, something like this:

log,host=your_host _field=context   _value="core"          1743355879
log,host=your_host _field=event     _value="Server is running on port 8080" 1743355879
log,host=your_host _field=level     _value="info"          1743355879
log,host=your_host _field=timestamp _value=1743355879      1743355879

And I want it to look like this:

log,host=your_host context="core",event="Server is running on port 8080",level="info",timestamp=1743355879 1743355879

Is this possible with Vector?

[harcipulyka]

Nevermind, I just had a spotty understanding of Influx's internal data representation. For anyone else running into this, just look up short rows in influx and the pivot function.