Skip to content

Commit

Permalink
Merge pull request #655 from logzio/split-array-sep16
Browse files Browse the repository at this point in the history
Nested objects
  • Loading branch information
Simplychee authored Sep 17, 2024
2 parents 43578f5 + 4a28b87 commit 609e860
Showing 1 changed file with 30 additions and 4 deletions.
34 changes: 30 additions & 4 deletions docs/user-guide/data-hub/log-parsing/split-json-array.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,16 +6,42 @@ description: Learn how to split JSON arrays in Logz.io
keywords: [log, monitoring, parsing, arrays, json, default parsing, built in log types, log types, observability]
---

Logs received as a JSON array cannot be effectively parsed or mapped into fields, making it difficult to search logs efficiently.

When log data is sent with **nested objects** in an array, it **cannot** be used for configuring alerts or creating visualizations. Therefore, it's crucial to parse arrays into separate log documents.


Logs that are received as a JSON array cannot be properly parsed or mapping into fields.
This will impede your ability to search your logs efficiently.

Log data sent in an array cannot be used for configuring alerts or creating visualizations. This is why it's important to parse arrays into multiple log documents.
Example of log data that **can** be used for alerts and visualizations:

```json
"array_field": [
{
"field": "test"
},
{
"field": "test2"
}
]
```

Example of log data that **cannot** be used for alerts or visualizations:

```json
{
"nested_arr": [
{
"field": "test"
},
{
"field": "test2"
}
]
}
```

Some shipping methods offer the option to parse an array of JSON objects into discrete events. That way, the logs can be fully parsed and mapped by Logz.io.

Some log shipping methods allow you to parse a JSON array into individual events, ensuring that logs are fully parsed and mapped by Logz.io for better use in alerts and visualizations.

### Shipping methods that support arrays

Expand Down

0 comments on commit 609e860

Please sign in to comment.