View document with nested data


I’m totally loving Graylog so far, but I’m running into something I’m missing. The logs I’m managing in Graylog contain nested data. For example, an object of context that contains a certain structure. I understand that the underlying datastore will create a separate key for each possible “path” through the nested documents, but I’m used to KIbana to be able to view the underlying document with the nested data. To make my problem clear, lets take the following log as an example:

message: hello
host: web01.local
context: {
	foo: bar
	data: {
		bar: baz

The following keys will be created:


This makes perfect sense, but sometimes when viewing a single log, it will get 10x more readable if I would be able to view the document in a nested structure.

Is there something I’m fundamentally misunderstanding or did I fail to search for the correct terms?

Thanks in advance.


he @scspruijt

you missed to explain how you ingest the data and what you do in terms of processing in graylog. All by itself it does not flatten and create fields. Did you ingest json and use a json extractor?

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.