After you create and index one or more more object groups, use the ChaosSearch Refinery® to create views. Views are a lens or pane into the indexed data for one or more object groups; they allow you to define how to explore and query that data using tools like the Search Analytics or SQL Analytics interfaces or through interfaces like the Elasticsearch or SQL APIs.
Refinery views have powerful data controls, allowing you to virtually transform the indexed data fields and materialize fields into the columns that will drive the end-user visualizations and analytics. For example, you could limit analysis to a recent time frame, such as the last 7 days. You can also set various behaviors such as caching results or case-sensitivity for querying. For the details about creating views, see Refinery Views.
The steps to create a view:
- Select one or more object groups with indexed data that you want to analyze.
- Specify filtering or transformation options if needed.
- Create the view.
- Reference and use the view in your analysis tools.
Views can be created using the ChaosSearch console, APIs, or Terraform Provider. This topic focuses on the console steps.
To create a view, navigate to the Views tab and click Create View.
Select one or more object groups to associate their indexed data with the view. The pane updates to show the list of daily intervals for the selected groups, and you can restrict analysis to specific daily intervals if desired, then click Next.
In the Schema Transformation window, you can review the data model/schema for the columns in the view and take advantage of several predefined, schema transformation types that are available to you. You can transform fields virtually (that is, without changing the indexed data stored on disk) by clicking the gear icon.
If your object group uses isolation keys, you can use view filtering controls to restrict by one or more isolation keys, to show and analyze only the data associated with the specified key(s).
An advantage of the ChaosSearch views is that you can use virtual transformations to change or refine the type of the data within the view, without the overhead of changing and re-indexing the source data. For example, you can create a materialized column with a regular expression on an existing field, or with a JSONPath expression on a JSON string field. You can narrow a data type for a column named
client_ip from a string type to treat it as an IP type for IP range filters. This type change can assist visualization tools to properly manage and render the data, all with the current indexed data.
After you specify any optional filtering or transforms, click Next to proceed to the view naming and final steps. You can specify controls like query caching and case insensitive querying as applicable.
After you create the views that provide the analysis window to your indexed data, you can start to query, search, and visualize your data using the embedded analysis tools or APIs.
Updated 4 months ago