JSON Flex Options Reference
A list of the JSON Flex options in object groups and views
Object Group Features
ChaosSearch object grouping features give administrators more insight and control over how to select and flatten their JSON source files (pre-indexing).
| JSON Flex Object Group Options Option | Description |
|---|---|
| Default Object Group Array Expansion: Horizontal or Vertical | You can specify whether to use Horizontal or Vertical expansion for the arrays in the JSON file to choose more compact storage of indexed data versus more visibility of JSON fields for filtering and data analysis aggregations. See JSON Log Flattening Example for a general example of horizontal and vertical expansion effects. |
| Flattening Level: None, 1-10, Unlimited | You can choose to expand all arrays (Unlimited), none of the arrays, or only the arrays at or above a specified level of 1 to 10. Any arrays below the specified level are indexed as a JSON string value. |
Column selection options: array_selection_policy | Array selection controls allow you to specify only the arrays that you want to index (whitelist) or to index all arrays except specific ones (blacklist). This option provides a finer control on the indexing of arrays, reducing the indexed data storage footprint and also the distraction of fields that are not useful for analysis tasks, all without changing or re-pipelining the source JSON files. |
Column selection options: vertical_selection_policy | The vertical selection policy allows administrators to apply vertical expansion rules to specific arrays when the group itself defaults to horizontal expansion for all arrays. That is, with JSON Flex, you can use horizontal expansion for the indexing storage advantages, but for specific arrays that are better suited for vertical expansion, you can selectively apply vertical expansion where needed during indexing. |
Column selection options: field_selection_policyFOR NESTED JSON OBJECTS, not arrays. | For nested JSON objects (not arrays), the field selection policy gives you a finer control over which nested objects to index as separate properties, or to index as a JSON string blob. The nested properties to stringify can be selected using a blacklist of their property names or using a regex rule to use regular expressions to select the properties to process as JSON strings. |
Refinery View Features
Chaos Refinery® features help to prepare user-ready views with the valuable columns for querying and analytics. Refinery views can also use several transformation options to extract information from the indexed data.
| JSON Flex Refinery View Options | Description |
|---|---|
| JSON Array Transformation | For arrays that are indexed with horizontal expansion, the JSON Array Transformation window allows you to selectively apply a virtual vertical expansion of that array within the Refinery view. That is, the selected array and its fields will be materialized as columns for use as filter controls and for aggregation analysis with the view. |
| Materialize with JSONPath | For columns that contain a JSON string value, you can specify a JSON Path value to identify a field and its values, and materialize that field into a view column that can be used for filtering or simple aggregations like Count, Min, and Max. You can define multiple materialized fields from one JSON string field. |
| Materialize with JQ | For columns that contain a JSON string value, you can specify a jq filter expression value to identify a field and its values, and materialize that field into a view column that can be used for filtering or simple aggregations like Count, Min, and Max. You can define multiple materialized fields from one JSON string field. |
| Treat as Nested JSON | For columns that contain JSON string data with nested arrays or nested objects, you can transform that field to one that supports Elastic nested query path values, using either the Search Analytics > Discover feature, or the Elastic API. |
Another Look at JSON Flex
For a closer look at how a simple nested JSON file can quickly inflate with expansion operations, see the ChaosSearch blog: The New Best Way to Index and Query JSON Logs.
Updated 11 months ago
What’s Next