Step 3. Define Views

After you create and index one or more more object groups, use the ChaosSearch Refinery® to create views. Views are a lens or pane into the indexed data for one or more object groups; they allow you to define how to explore and query that data using tools like the Search Analytics or SQL Analytics interfaces or through interfaces like the Elasticsearch or SQL APIs.

Refinery views have powerful data controls, allowing you to virtually transform the indexed data fields and materialize fields into the columns that will drive the end-user visualizations and analytics. For example, you could limit analysis to a recent time frame, such as the last 7 days. You can also set various behaviors such as caching results or case-sensitivity for querying. For the details about creating views, see Refinery Views.

The steps to create a view:

1. Select one or more object groups with indexed data that you want to analyze.
2. Specify filtering or transformation options if needed.
3. Create a view for one or more object groups and their associated data intervals.
4. Reference and use the view in your analysis tools.

Views can be created using the ChaosSearch console, APIs, or Terraform Provider. This topic focuses on the console steps.

To create a view, navigate to the Views tab and click Create View.

Select Object Groups

Select one or more object groups to associate their indexed data with the view. The pane updates to show the list of daily intervals for the selected groups. You can restrict analysis to daily interval file names that match a pattern, or to an analysis window of a specific number of previous days like 1 day, 7 days, 30 days, and so on, then click Next.

Filter and Transform

In the Schema Transformation window, you can review the data model/schema for the columns in the view and take advantage of several predefined, schema transformation types that are available to you. You can transform fields virtually (that is, without changing the indexed data stored on disk) by clicking the gear icon.

If your object group uses isolation keys, you can use view filtering controls to restrict by one or more isolation keys, to show and analyze only the data associated with the specified key(s).

An advantage of the ChaosSearch views is that you can use virtual transformations to change or refine how data is represented within a view, without the overhead of changing and re-indexing the source data. Other views for the same data can treat the data uniquely as well. For example, you can create a materialized column with a regular expression on an existing field, or with a JSONPath expression on a JSON string field. You can narrow a data type for a column named client_ip from a string type to treat it as an IP type for IP range filters. This type change can assist visualization tools to properly manage and render the data when using the view, all with the current indexed data.

Create the View

After you specify any optional filtering or transforms, click Next to proceed to the view naming and final steps. You can specify controls like query caching and case insensitive querying as applicable.

After you create the views that provide the analysis window to your indexed data, you can start to query, search, and visualize your data using the embedded analysis tools or APIs.