Slashes in a JSON field - can't visualize on sub-fields

Elastic Stack Kibana
1

Hello, I have been using Kibana for a couple days for now and i've ran into an issue with handling a JSON field that gets interptreted as a string somehow. Here is a peek into usual logs:

firefox_2018-08-17_13-50-18
firefox_2018-08-17_13-50-18.png1920×1040 115 KB

The log field should work as a JSON-field, but when you look ath the raw data it is littered with backslashes from previous sources:

firefox_2018-08-17_13-52-39
firefox_2018-08-17_13-52-39.png1920×1040 92.9 KB

I can't visualize on any of the sub-fields nor process it any further.

What should i do about it ? Is it possible to solve it using pure Kibana features ? Do i need to install a plugin or tamper with whole efk stack ? Or should I rather fix the data at its source (this solution isn't preferrable due to security issues) ?

2

Hi @Patryk_Miszczak,

As suggested here, you'd better properly re-ingest your data so that log field is indexed as an object, not as a string.

If it's something out of your control and you need to extract just some fraction of the data from log field you can create a scripted field and use Painless API to extract the data you need. Painless doesn't support any specific JSON functionality, but you can use String functions like indexOf and substring to extract pieces you're interested in.

Thanks,
Oleg