Duplicate log data within "log" field

[amar-loggly]

we are seeing duplicate data in our logs. What happens is we get original data AND the same data again in the log field.

Is this by design, or is there a setting/code somewhere that is sending in data twice?

[anandkumarpatel]

an example of data sent. Data is duplicated in the "log" key

{
  "name": "docker.listener",
  "environment": "production-delta",
  "hostname": "docker-listener",
  "pid": 15,
  "tx": true,
  "module": "/docker-listener/lib/worker-server.js",
  "level": 30,
  "queue": "time.five-minutes.passed",
  "job": {
    "tid": "7644295a-5ebd-4e02-9a62-72b4606c6737"
  },
  "jobMeta": {
    "headers": {},
    "timestamp": 1497975003133,
    "appId": "khronos"
  },
  "method": "_runWorker",
  "msg": "running worker",
  "time": "2017-06-20T16:10:03.141Z",
  "v": 0,
  "log": "{\"name\":\"docker.listener\",\"environment\":\"production-delta\",\"hostname\":\"docker-listener\",\"pid\":15,\"tx\":true,\"module\":\"/docker-listener/lib/worker-server.js\",\"level\":30,\"queue\":\"time.five-minutes.passed\",\"job\":{\"tid\":\"7644295a-5ebd-4e02-9a62-72b4606c6737\"},\"jobMeta\":{\"headers\":{},\"timestamp\":1497975003133,\"appId\":\"khronos\"},\"method\":\"_runWorker\",\"msg\":\"running worker\",\"time\":\"2017-06-20T16:10:03.141Z\",\"v\":0}\n",
  "stream": "stdout",
  "docker": {
    "container_id": "33e47e27e6baeb4c358af0a9659d8c574e5770063da81b540b17492ce04ade3f"
  },
  "kubernetes": {
    "namespace_name": "default",
    "pod_id": "bdd9ab29-52c2-11e7-a25b-0a4d591713e0",
    "pod_name": "docker-listener-2703994374-6gxps",
    "container_name": "docker-listener",
    "labels": {
      "app": "docker-listener",
      "pod-template-hash": "2703994374"
    },
    "host": "ip-10-8-60-13.us-west-2.compute.internal"
  }
}

[sekka1]

Happy to look into this but i think I need some more information to understand this more.

My logs looks a little different. This is from the kubernetes ingress pod. The log field is the nginx stdout.

Your logs are in json? Is Loggly parsing the json in the actual event and adding it in as fields?

I dont have any pods emitting json logs that I can test with.

Can you look at logs from some other pod that does not emit json?

[anandkumarpatel]

We actually format all of our logs in JSON. Sadly we don't have a service which prints out just strings.

[anandkumarpatel]

@amar-loggly might be able to answer what loggly does