JSON Expansion

When dealing with JSON Logscape is able to automatically extract your data into a format that can immediately be put to use. In order for this extraction to take place the entire event must be JSON, as Logscape will attempt to convert the entire event into a JSON object.

At search time the fields within your data are exposed on the left hand menu. For example

{
    "Apple": {
        "Variety": [{
            "Granny-Smith": {
                "Colour": "Green",
                "Number": 5
            }
        }, {
            "Cox": {
                "Color": "Red",
               "Number": 3
            }	
        }]
    }
}

Values are exposed based upon their location in the tree, so we could access values through syntax such as

Apple_Variety_Granny-Smith_Colour

If a value makes use of an array, it can be accessed via the [] notation, i.e if we wanted to perform operations on all varieties of Apple

Apple_Variety_[]_Number

Due to the fact that Logscape treats each individual entry in the JSON array as an individual event, the ability to refer to a specific value is retained.

Apple_Variety_1_Number

Due to current limitations, it is not possible to map values against each other, so I couldn't map the colour against the number for all varieties of apple using the [] notation.

This is due to the fact values are not mapped against each other when the JSON is denormalized.

The JSON implementation also supports wildcarding values, so if this record was added

"blue-Cox"{
	"Color":"Blue",
	"Number":4
}

To the data, it could then be accessed via

*cox_Color.count() 

And get stats for both the Cox, and the Blue-Cox. Similarly if the following were added

"blue-Granny-Smith"{
	"Color":"Blue",
	"Number":5
}

Wildcarding could then capture all the blue fruit using

*blue*.count()