Unescaping message field in forwarded log message from App Platform to managed OpenSearch

Hi,

I’m using App Platform forwarding the runtime logs to managed OpenSearch.

The forwarded messages are wrapped inside of DigitalOcean’s wrapped object. For example:

{
     "@timestamp": <ts>,
     "do_component": "<value>",
     ...
     "message": "<runtime log>"
}

However, my runtime log is JSON object so it gets escaped when log is forwarded to OpenSearch like so:

{
     "@timestamp": <ts>,
     "do_component": "<value>",
     ...
     "message": "{\"myfield\":\"myvalue\"}"
}

So OpenSearch isn’t able to correctly index the field. Instead it should be:

{
     "@timestamp": <ts>,
     "do_component": "<value>",
     ...
     "message": {
         "myfield": "myvalue"
     }
}

What are the ways to achieve this?

I think it makes sense that DO’s log forwarder treats each line as a string, so then i need some sort of transformer between the OpenSearch ingestion but unsure if this is something OpenSearch can provide out of box.

Thanks Harry