Skip to content

view-search-results-json-logs.md

Latest commit

 

History

History
62 lines (39 loc) · 5.91 KB

view-search-results-json-logs.md

File metadata and controls

62 lines (39 loc) · 5.91 KB
Raw
id view-search-results-json-logs
title View Search Results for JSON Logs
description If your search results contain JSON logs, you can expand or collapse the view on the Messages tab to show or hide the JSON format and structure.

import useBaseUrl from '@docusaurus/useBaseUrl';

If your search returns fields that are valid JSON objects, you can expand or collapse the view on the Messages tab to show or hide the JSON substructure, or present the messages as formatted JSON code.

Expand or collapse JSON messages

By default, the collapsed version of JSON messages is shown. You can see the top level JSON attributes, and only the attributes below the top that are objects rather than simple values.
<img src={useBaseUrl('img/search/get-started-search/search-basics/view-search-results-json-logs/expand-collapse.png')} alt="Expand collapse"/>

Click Expand/Collapse on the upper right side of the Messages table to see expand options:

  • Expand all Rows. Rows that show truncated messages are expanded to show complete messages.
  • Expand all Rows and JSON. Rows that show truncated messages are expanded to show complete messages, and nested JSON messages are expanded, as shown below.
    <img src={useBaseUrl('img/search/get-started-search/search-basics/view-search-results-json-logs/expanded-json-message.png')} alt="Expanded JSON message"/>

After you’ve expanded either all rows, or all rows and JSON objects, the Expand/Collapse JSON has options for resetting your view.

You can also expand and collapse the JSON objects in a particular message using options on a context menu. Depending on whether JSON is currently expanded or collapsed, you’ll see either a Collapse Nested JSON or an Expand Nested JSON option.

<img src={useBaseUrl('img/search/get-started-search/search-basics/view-search-results-json-logs/context-menu.png')} alt="context menu"/>

Why copy JSON fields easily?

Copying JSON fields from search results used to require manually highlighting the exact text for each value or label — a repetitive and error-prone process. With the copy options now available, hovering over a JSON field and clicking the Copy icon captures the full value automatically. If you prefer to copy only a portion, you can still drag to select specific text and copy just that selection.

Copy message content

Right-click an individual message to see the following option:

  • Copy selected text.
  • Copy entire string as JSON. Copies the message to the clipboard in JSON format. This function is not available on Safari due to a browser limitation.
  • Copy field value. Copies the JSON field value.
    <img src={useBaseUrl('img/search/get-started-search/build-search/dynamic-parsing/copy-field-name.png')} alt="Copy field name" style={{border: '1px solid gray'}} width="400" />

Reference parsed JSON fields

The field browser and search results messages table have a few helpful features. 

Field Browser:

  • A search input field allows you to search for fields by name.
    <img src={useBaseUrl('img/search/get-started-search/build-search/dynamic-parsing/field-browser-search-field.png')} alt="Field browser search field" style={{border: '1px solid gray'}} width="400" />
  • JSON structures are nested with expand and collapse options.
    <img src={useBaseUrl('img/search/get-started-search/build-search/dynamic-parsing/field-browser-expand-collapse-JSON.png')} alt="Field browser expand collapse JSON" style={{border: '1px solid gray'}} width="200" />
  • A copy button is available to the right of each field allowing you to easily copy a field name.
    <img src={useBaseUrl('img/search/get-started-search/build-search/dynamic-parsing/field-browser-copy-field.png')} alt="Field browser copy field" style={{border: '1px solid gray'}} width="500" />

Search results table:

  • You can copy field names from JSON structures. After selecting (click and highlight) a JSON key in your results, right click and select Copy field name. See [modifying a search from the messages tab]/modify-search-from-messages-tab) for details on the other provided options.
    <img src={useBaseUrl('img/search/get-started-search/build-search/dynamic-parsing/JSON-right-click-copy-options.png')} alt="JSON right click copy options" style={{border: '1px solid gray'}} width="300" />

    Copying a field name using this option will automatically format field names that have special characters. For example, the field name shown in the screenshot is total time-series, it would be automatically formatted to %"total time-series" to work properly in a search query.
     

  • A copy button is available to the right of each column (field) name allowing you to easily copy a field name.
    <img src={useBaseUrl('img/search/get-started-search/build-search/dynamic-parsing/copy-button-messages-table.png')} alt="Copy button messages table" style={{border: '1px solid gray'}} width="500" />

  • A copy button is available next to a JSON value or the full JSON structure allowing you to copy the selected JSON value or the JSON structure inside the selected array.
    <img src={useBaseUrl('img/search/get-started-search/build-search/dynamic-parsing/copy-json.png')} alt="Copy JSON" style={{border: '1px solid gray'}} width="400" />

Format JSON messages in search results 

If the messages in your search results can be formatted as JSON, the Messages tab presents the option to display each message in JSON or raw format. Click the link to toggle between the JSON and raw view. 

The view of JSON formatting is limited to JSON files less than 10 KB in size.

<img src={useBaseUrl('img/search/get-started-search/search-basics/view-search-results-json-logs/view-json.png')} alt="View as JSON" style={{border: '1px solid gray'}} width="600" />