Skip to content
Pretty Payload
All guidesWorking with JSON

Working with JSON

Escaped JSON in a Log: From Backslashes to a Readable Payload

Turn a quoted, backslash-heavy log field into a readable JSON tree - without deleting escapes by hand or guessing at every encoding.

Pretty Payload4 min read

You copied one field from a log viewer and it looks like a punctuation storm: \"status\":\"failed\" wrapped in quotes, maybe twice. That is usually not broken JSON. It is JSON text stored inside a string - and the log export escaped it for transport.

This guide focuses on that extraction task: recognize the encoded string, isolate the right field, inspect one or two layers, and decide whether to keep the string form for the destination.

For the broader “JSON inside JSON” tree workflow, see the nested JSON viewer.

Recognize an encoded string

Clues you are looking at escaped JSON rather than a raw object:

  • The value starts and ends with " in the outer document
  • Interior quotes appear as \"
  • You see \\n or \\t where a pretty printer would show real newlines
  • The field name hints at encoding: payload_raw, body, message, data

Fictional event (one layer of encoding):

{
  "event_id": "demo_1042",
  "source": "Example Company webhook",
  "payload_raw": "{\"order_id\":\"ord_9001\",\"status\":\"failed\",\"customer\":{\"name\":\"Example Company\"},\"note\":\"contact [email protected]\"}"
}

payload_raw is a string. Its characters happen to be JSON. A strict pretty-printer of the outer object will keep showing backslashes until something treats that string as nested JSON.

Extract only the relevant log value

Logs often add prefixes:

INFO demo_1042 payload_raw="{\"order_id\":\"ord_9001\",\"status\":\"failed\"}"

Copy the JSON object (or the quoted value) - not the INFO timestamp line. If the paste still fails to parse, trim wrappers and retry. For syntax damage after a bad copy, repair malformed JSON covers missing commas and friends.

Avoid the temptation to Find/Replace all backslashes. Literal paths, Windows filenames, and regexes need those characters. Global deletion corrupts real data.

Inspect one and two layers

Paste the outer object into the web demo. Pretty Payload can detect supported JSON stored in strings and expand it. For the sample above, the viewer may note Un-stringified nested JSON strings and present payload_raw as an object:

{
  "event_id": "demo_1042",
  "source": "Example Company webhook",
  "payload_raw": {
    "order_id": "ord_9001",
    "status": "failed",
    "customer": {
      "name": "Example Company"
    },
    "note": "contact [email protected]"
  }
}

Value-type difference: before expansion, payload_raw is a string; after, it is an object (or array). That matters if you copy the result into a system that still expects a string field.

Two layers looks like a string that contains another escaped string (or a root that is itself a quoted JSON string). Unwrap one layer at a time and review after each step. The product does not promise every exotic encoding will decode automatically.

Preserve the original when the destination expects a string

Use the expanded tree to read status, order_id, or nested errors.

Copy JSON produces readable, indented JSON. Copy Minified removes unnecessary spaces and line breaks to put the same JSON on one line. Both copy the current document with the same values and data types; minifying does not turn an object into an encoded string.

If Pretty Payload has expanded payload_raw into an object, both copy buttons output that field as an object. Neither restores its original quoted, escaped string form.

When you file a ticket or replay a fixture:

  • Keep a copy of the original log snippet.
  • If the destination expects an encoded string, use the original string or explicitly serialize the expanded field back into a JSON string before sending it.
  • If the destination expects an object, use Copy JSON or Copy Minified, depending on whether you want indented or single-line output.

Search (Search keys and values…) for failed or ord_9001 once the inner document is open. Edit only fictional values when trimming an example (edit and remove keys).

Escaped JSON is not personally out to get you. It is a string doing its job - with more backslashes than anyone asked for.

Try it

  1. Paste the payload_raw sample into prettypayload.com/try/.
  2. Confirm the nested object opens and status reads failed.
  3. Use Copy JSON for a readable example, or keep your original string for systems that still expect encoding.

For recurring log-to-viewer work, add Pretty Payload to Chrome.

All guides