# Display raw JSON value from log entry in Discover table

**URL:** <https://discuss.elastic.co/t/display-raw-json-value-from-log-entry-in-discover-table/86232>\
**Category:** Kibana\
**Created:** [May 18, 2017, 10:16am UTC](https://discuss.elastic.co/t/display-raw-json-value-from-log-entry-in-discover-table/86232 "2017-05-18T10:16:50Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marcin\_Kawa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcin_kawa/32/18327_2.png) [@Marcin\_Kawa](https://discuss.elastic.co/u/Marcin_Kawa)\
**Post date:** [May 18, 2017, 10:16am UTC](https://discuss.elastic.co/t/display-raw-json-value-from-log-entry-in-discover-table/86232/1 "2017-05-18T10:16:50Z")

</div>

I'm looking for a way to combine few fields from log entry into one string representation to display it on the `Discover` view. Problem is the only common element for the fields is that those values are enclosed inside JSON object `extra`.

Example log entry JSON:

```auto
{
   "message": "MainProcess",
   "extra": {
      "task_name": "Indexing Sub Plan Bundles ",
      "function": "<function load_bundles>",
      "memory_used": 519480,
      "time_sec": 27.590729
    },
}

```

So in Kibana table view it's:

```auto
message: "MainProcess",
extra.task_name: "Indexing Sub Plan Bundles ",
extra.function: "<function load_bundles>",
extra.memory_used: 519480,
extra.time_sec: 27.590729

```

Is there a way to display the whole `extra` key as string on the list in the Discover view?

Thanks. Any help would be appreciated!

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [May 18, 2017, 11:57am UTC](https://discuss.elastic.co/t/display-raw-json-value-from-log-entry-in-discover-table/86232/2 "2017-05-18T11:57:49Z")

</div>

Hi @Marcin_Kawa,

one option would be to add the string representation in a new field during ingest. If that is not an option, you could create a [scripted field](https://www.elastic.co/guide/en/kibana/current/scripted-fields.html) in the index pattern settings that concatenates the fields you want dynamically. But please be aware of the performance penalty associated with that.

I would like to understand your use case better, if you don't mind. What prohibits you from just adding those columns to the table individually in Discover?

---

<div class="post-metadata">

**Author:** ![Marcin\_Kawa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcin_kawa/32/18327_2.png) [@Marcin\_Kawa](https://discuss.elastic.co/u/Marcin_Kawa)\
**Post date:** [May 18, 2017, 12:24pm UTC](https://discuss.elastic.co/t/display-raw-json-value-from-log-entry-in-discover-table/86232/3 "2017-05-18T12:24:16Z")

</div>

Hi @weltenwort,  
Many thanks for the reply. During ingest , you mean when Logstash processes the entry? It would duplicate the data though, right?

For scripting fields the problem is that the `extra` object keys can differ a lot between log entries. So for example in one entry log there will be 5 different keys in `extra` object when the next log entry can have 10 totally different keys inside the `extra` object.

```auto
# log entry 1
{"message": "foo", "extra": {"bar": 'one', "foobar": "two"}}
# log entry 2
{"message": "foo", "extra": {"barbar": 'bar', "foofoo": "foo"}}
# log entry 3
{"message": "foobar"}

```

The reason I want to display content from `extra` is to see what's inside (keys and values) without expanding each entry. Sometimes the `extra` object contains a lot of data so it would be better not o replicate it in the log entry as it would be used only for display purposes in the Discover list view.

I believe the scripting field would not work here as I want to display all keys/values from the `extra` object and the keys inside are inconsistent between different log entries.

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [May 18, 2017, 1:30pm UTC](https://discuss.elastic.co/t/display-raw-json-value-from-log-entry-in-discover-table/86232/4 "2017-05-18T13:30:38Z")

</div>

There indeed is no way to iterate over all fields of a document in a scripted field. Aside from duplicating the data in a string field on ingest time, I can not see another way of achieving this right now, sorry.

But I would encourage you to file an [enhancement request](https://github.com/elastic/kibana/issues/new) on GitHub any explain your use case. This way we can track the request and possibly implement a solution down the line.

---

<div class="post-metadata">

**Author:** ![Marcin\_Kawa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcin_kawa/32/18327_2.png) [@Marcin\_Kawa](https://discuss.elastic.co/u/Marcin_Kawa)\
**Post date:** [May 19, 2017, 11:10am UTC](https://discuss.elastic.co/t/display-raw-json-value-from-log-entry-in-discover-table/86232/5 "2017-05-19T11:10:11Z")

</div>

Many thanks for help. I will do create enhancement request as I believe that display only fields might be useful. For now I'm duplicating the `extra` argument and parsing it to string with `mutate` filter in Logstash.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 16, 2017, 11:10am UTC](https://discuss.elastic.co/t/display-raw-json-value-from-log-entry-in-discover-table/86232/6 "2017-06-16T11:10:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.