View document with nested data

[scspruijt (Sander Spruijt)]

Hi,

I’m totally loving Graylog so far, but I’m running into something I’m missing. The logs I’m managing in Graylog contain nested data. For example, an object of context that contains a certain structure. I understand that the underlying datastore will create a separate key for each possible “path” through the nested documents, but I’m used to KIbana to be able to view the underlying document with the nested data. To make my problem clear, lets take the following log as an example:

message: hello
host: web01.local
context: {
	foo: bar
	data: {
		bar: baz
  }
}

The following keys will be created:

message
host
context_foo
context_data_bar

This makes perfect sense, but sometimes when viewing a single log, it will get 10x more readable if I would be able to view the document in a nested structure.

Is there something I’m fundamentally misunderstanding or did I fail to search for the correct terms?

Thanks in advance.

Regards,

[jan (Jan Doberstein)]

he @scspruijt

you missed to explain how you ingest the data and what you do in terms of processing in graylog. All by itself it does not flatten and create fields. Did you ingest json and use a json extractor?