Format JSON Structured Log Entries for Readable Analysis

A single Pino error entry is unreadable on one line. Prettify at 4-space to expose the nested err object and its stack.

Input (one Pino line):
{"level":50,"time":1718200000000,"msg":"request failed","req":{"method":"GET","url":"/api/orders"},"err":{"type":"TypeError","message":"cannot read id","stack":"TypeError: cannot read id\n    at h (a.js:10)"}}

Output (4-space, abbreviated):
{
    "level": 50,
    "time": 1718200000000,
    "msg": "request failed",
    "req": { "method": "GET", "url": "/api/orders" },
    "err": {
        "type": "TypeError",
        "message": "cannot read id",
        "stack": "TypeError: cannot read id\n    at h (a.js:10)"
    }
}

CloudWatch wraps the app's JSON as a string inside message. Extract the inner JSON first, then prettify it.

CloudWatch event:
{"message":"{\"level\":50,\"msg\":\"db timeout\",\"err\":{\"code\":\"ETIMEDOUT\"}}"}

Step 1 - take the inner string and unescape it:
{"level":50,"msg":"db timeout","err":{"code":"ETIMEDOUT"}}

Step 2 - prettify that:
{
  "level": 50,
  "msg": "db timeout",
  "err": { "code": "ETIMEDOUT" }
}

Two log lines for the same route, one 200 one 500. Sort keys ON aligns fields so the differing field jumps out.

Both prettified, Sort keys ON:
OK (200):                 FAIL (500):
{                         {
  "level": 30,              "level": 50,    <- differs
  "req": {...same...},      "req": {...same...},
  "res": {                  "res": {
    "statusCode": 200         "statusCode": 500  <- differs
  }                         }
}                         }

Pasting several log lines at once fails because NDJSON is not one JSON document. Format a single line, or wrap the lines in an array.

Input (3 log lines):
{"level":30,"msg":"a"}
{"level":30,"msg":"b"}
{"level":50,"msg":"c"}

Result: invalid JSON: Unexpected non-whitespace
character after JSON at position 22

Fix: format one line, OR wrap as an array:
[ {"level":30,"msg":"a"}, {"level":30,"msg":"b"},
  {"level":50,"msg":"c"} ]

A 64-bit traceId carried as a number is corrupted on parse. Loggers should emit IDs as strings; prettify confirms the safe shape.

Logged as number (unsafe):
{"traceId":13835058055282163712}
Prettified:
{
  "traceId": 13835058055282164000   <- changed!
}

Logged as string (safe):
{"traceId":"13835058055282163712"}
Prettified:
{
  "traceId": "13835058055282163712"  <- exact
}

A log file is one JSON object per line — not a single document. Strict JSON.parse stops after the first object and throws Unexpected non-whitespace character after JSON. Format one line at a time, or wrap the lines you need in a JSON array [ ... ] and prettify that array.

Lines like 2026-06-12 INFO {"level":30,...} or app | {"msg":...} are not pure JSON — the prefix breaks the parser. Strip everything before the first { (or after the JSON) so the file contains only the JSON object, then prettify.

A traceId/spanId above 2^53−1 is rounded on parse, so the prettified value differs from the real ID — and you could chase the wrong trace. Most tracers emit IDs as strings to avoid this; if yours doesn't, treat the displayed number as approximate and pull the raw value from the source line.

High-throughput logs sometimes truncate a line at a buffer boundary or interleave two writers. The result is incomplete JSON and the parser reports where it broke (e.g. Unexpected end of JSON input). That error is itself a signal — grab a clean copy of the line from the source, not the rendered console.

Cloud platforms store the app's JSON as an escaped string inside message/log. Prettifying the outer object shows the inner JSON as one long escaped string. Extract and unescape the inner string into its own file, then prettify that to read the real structure.

Pino and Bunyan write level as a number (30 = info, 50 = error). The prettifier does not translate it to a label — that is pino-pretty's job in a live terminal. Use the level table in this guide to read the code. This is expected behavior, not a defect.

time and ts are usually epoch milliseconds (e.g. 1718200000000). The prettifier keeps them as numbers — it does not convert to a human date. Note that very large epoch nanoseconds (19 digits) would exceed safe-integer range and round; epoch milliseconds (13 digits) are safe.

Pino conventionally leads with level, time, pid, hostname, msg. Turning Sort keys on alphabetizes that, so err and level jump around. It is useful for two-line comparison but not for scanning a single entry — leave it off when reading one line top to bottom.

A stack value is a single JSON string containing \n escapes. Prettifying indents the object but does not turn the \n inside the string into real line breaks — JSON string contents are not reflowed. To read the stack as multiple lines, copy the string value and unescape it separately.

A single log line over 2 MB (rare, but happens with embedded payloads or base64 blobs) is blocked on free tier; Pro raises the limit to 100 MB. Very long lines also hit the 5,000-character preview truncation — display only; Copy/Download return the full line.