# Parse and Query JSON Logs

Learn how to parse and query JSON logs.

## Parse JSON Logs

When ingesting logs, Kloudfuse automatically detects the JSON language code and extracts log facets.

The practical default limit for the number of facets that a single log line produce is 50. When there is more than 50 possible facets (over limit), facet extraction may fail.

To increase the limit, override the configuration.

### Increase Number of Possible Facets to 100

```yaml
logs-parser:
  - skipAutoFacet:
      args:
        maxFacetsCount: 100 (1)
```

|     |     |
| --- | --- |
| **1** | `maxFacetsCount`: Increase maximum number of facets extracted from a log line to 100. |

You can also add a condition that the rule apply only to log lines that match a specific condition; see [Parsing configuration example](https://docs.kloudfuse.com/platform/3.2.5/logs-parsing-example/).

### Parsing Example

Consider the following log line:

#### Extract Facets from a JSON Log Line

```json
{
  "timestamp": "2021-09-01T00:00:00.000Z",
  "level": "INFO",
  "message": "User logged in",
  "user-name": "john.doe",
  "aliases" : ["johndoe", "johnny"],
  "location" : {
    "city": "San Francisco",
    "state": "California"
  }
}
```

Kloudfuse "flattens" facet names to use `_` (the underscore character) to join nested fields. It also extracts the `aliases` field as a string.

The extracted facets are `timestamp`, `level`, `message`, `user_name`, `location_city`, `location_state`, and `aliases`.

## Query JSON Logs

After a successful ingestion, you can use the Logs Explorer to search the log lines using the extracted facets. See [Facet search for logs](https://docs.kloudfuse.com/platform/3.2.5/log-search-facet/).