How to access parent JSON object in Kibana?


#1

Hi,
I have a JSON objects in my logs and I want to view the parent object as a whole instead of all subfields separately. How can I view that in KIbana?

Example:
This is a sample message form the logs:
Note: the object inside message can have different fields everytime i.e. tag1, tag2, tag3 can be differnet tags

{"time": "2016-06-21T17:24:24.480Z", "level": "DEBUG", "category": "sample.js", "hostname": "xyz", "message": {
"id": "1111",
"name": "asdf",
"tag1": "zzz",
"tag2": value2,
"tag3": "value3"
}}

In Kibana, I would like to view "message" as an object , how can I see that? Right now on Discover tab, it shows as message.tag1, message.tag2,etc

Is there a way to view it as message as a whole with all sub tag-value pairs??

Thanks


(Jim Unger) #2

@keya,

So it sounds like you want to be able to view/explore your data in a structured format, ie:

If that is the case, unfortunately that is not possible. Elasticsearch flattens all of the documents when they are indexed.


(system) #3