Sometimes logs might be shipped escaped or stringified. With the Parse Json field rule, you can transform these logs to Json with no effort.
Select the field that is escaped select then destination and you are all done.
3-Complete all the needed info, group name, rules matcher, rule’s name etc.
In the example below we are unescaping the log and making it in Json format.
Message after the rule:
If you chose a destination field that will cause a mapping exception, A message will pop to let you know that you will be creating an exception if you apply this rule.