JSON Array treatment in a visualization

[pedrodantas]

Hello!

I was wondering if there is any way to display the contents of a JSON Array that is received in the Elastic logs in a Kibana visualization.

My application is sending JSON logs to Kibana. One of the log fields is a details array that is composed of a group of entities and their respective messages.

{
  "details": [
    {
      "entityId": "1",
      "message": "Product."
    },
    {
      "entityId": "2",
      "message": "Document."
    },
    {
      "entityId": "3",
      "message": "Document."
    }
  ]
}

I would like to use the Table visualization to insert something like this into my company's dashboard.

However, I can't seem to get around to it. I can't find a way to do this because of how Kibana aggregates information. Is there any way where I can easily do this?

Thank you

[jsanz (Jorge Sanz)]

Indeed Kibana is more suited to work with aggregated data than with individual documents, and support for nested fields (which I understand you are using) is pretty limited in the product.

Check this long-standing issue for more details but in any case the rendering of individual documents is done with Discover and it can only render the JSON representation of your nested field.