## TL;DR

Vault audit logs are JSON lines with deeply nested structures that naive parsers choke on. Parse line by line with a streaming JSON reader, handle nesting generically, and skip malformed lines with a warning.

## Error

```text
agent failed to parse the vault audit log: nested json error
```

## Steps

1. Capture the failing line and validate it independently. Expected: the bad line isolated.
2. Switch to a streaming line-delimited JSON parser. Expected: one bad line cannot kill the parse.
3. Access nested fields defensively with defaults for missing keys. Expected: schema drift tolerated.
4. Log skipped lines with their reason for later review. Expected: visibility, not silent drops.
5. Re-run over the full audit log. Expected: complete parse.

## When to use

- Vault audit-log parsing failures in agents.
- Building audit analysis.

## When not to use

- Logs not being written (check Vault audit config).
- You need real-time tailing (different setup).

## Tool compatibility

- Vault audit logs; streaming JSON parsers.

## Variant phrasings

### audit log json parse error

Stream it.

### nested json broke the parser

Defensive access.

## Why it happens

Audit entries nest request and response objects several levels deep; hand-rolled parsers assume a flatter shape.

## Edge cases

- HMACed fields are opaque by design; do not expect to read them.
- Very large responses bloat lines; cap line buffers.
- Log rotation mid-parse needs handling; track file offsets.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Vu5MIneLAqBQ4oQpjDwkig