Creating Views for JSON Object Groups

Review how to create views for JSON object groups and the options for filtering and transformation.

When you create a view for JSON log and event object groups, the process is slightly different depending on whether the object group uses vertical or horizontal expansion.

For a vertical expansion object group:

The Create View process is very similar to the view process for LOG or CSV file formats.

  1. In the Refinery Create View window, you select the object group(s).
  2. You select one or more indexes in the object group(s), and click Next.
  3. In the Schema Transformation window, you can virtually transform one or more of the fields in the index structure as needed, then click Next.
  4. Select a Timestamp field for visualizations and click Create View.
  5. Type a name for the view, select options for caching, case-sensitivity, and click Create to add the view for visualizations or queries.

For a horizontal expansion object group:

The Create View process is almost the same, but with an additional JSON Array Transformation step for additional selections when the object group indexes are horizontally expanded:

  1. In the Refinery Create View window, you select the object group(s). All selected object groups must use horizontal expansion.
  2. You select one or more indexes in the object group(s), and click Next.

πŸ“˜

NOTE:

If the selected object group has no horizontal expansions, the Create View process skips the JSON Array Transformation window.

  1. In the JSON Array Transformation window, review a list of all the attributes/columns and select a virtual vertical expansion for any desired fields. This enables users to filter and query on the attributes of the expanded fields as columns in the Analytics area. A sample window follows; choose zero, one or more attributes/fields to vertically expand, then click Next.
21922192
  1. In the Schema Transformation window, you can virtually transform one or more of the fields in the index structure as needed, then click Next.
  2. Select a Timestamp field for visualizations and click Create View.
  3. Type a name for the view, select options for caching, case-sensitivity, and click Create to add the view for visualizations or queries.

Best Practices for Views

It can be helpful to create a few views on small test indexes to see how the expansion options and the JSON Array Transformation can alter the options for filtering, querying, and visualizations in the Analytics area.

For example, you could confirm when simple string searches are all the analysis needed for some indexes, or when more attribute filtering is needed for visualization and dashboards to show the behavior, alerts, and health of a service.


What’s Next
Did this page help you?