About the Content Preview

After you select the files and specify any optional advanced filtering controls for the object group, the Content Preview window displays some sample records of the storage files.

The Content Preview summarizes the format of the selected file(s) (such as log, JSON, CSV, Parquet, or unknown) and the compression types (such as none, GZIP, snappy, or snappy-java). CSV, JSON, and log files display options to help with their index processing. The preview can vary depending on the type of files identified for the group.

📘

Compressed Data Files Have a Content Preview

ChaosSearch can provide a source file content preview even if the files are compressed. This allows you to stay in the page while constructing regular expressions for further refinement.

👍

UNKNOWN Format

If Format is unknown, select LOG and type a regular expression to parse the file contents for indexing. See the next section.

Log File Preview

In the Content Preview window, when you are indexing log files, ChaosSearch uses a regex to parse the contents of the log file. ChaosSearch has several default regex patterns to parse common or previously seen log files, and you can create your own regex for your custom or new types of log files that might have been set as UNKNOWN format.

There is a Formatted Preview section at the bottom of the window to view the index fields schema. Click Validate to display a sample of the formatted preview based on the regex string.

ChaosSearch analyzes the file contents for patterns and generates a format recommendation.

CSV File Preview

A sample window for the CSV format follows. It has a compression and delimiter field, as well as a setting that specifies whether the first row in the file has column header values.

JSON File Preview

For a JSON file, the Content Preview window has options for indexing JSON's nested arrays including expansion options and depth levels. Review JSON Flex Processing for more information on the ChaosSearch JSON indexing features.