My events are application log events (logback in Java) a la INFO [2016-07-07 20:56:54,937] [service: catalog-service] [visitorId: a3b2ced84dfa] com.blah.blergh.SomeClass: Something log-worthy happened which often contain stack traces.
Currently, we are ingesting these logs with the log4j sourcetype and extracting interesting fields while preserving the useful ability to watch streaming logs in a way that is easy to scan visually. The problem we run into is that extracting useful information about the stack traces has involved a set of nasty regexes that only work most of the time.
I have been testing writing these logs and ingesting them as JSON events. This gives us the very nice property of easily searchable/reportable stack trace information without regexes and a useful structured view of the events - the default collapsible view.
The one thing that our original solution had that our new one does not is an ability to see a list of events that is easy to visually scan. I'd like to create another view that will automatically format the results either into a table or pre-defined concatenation of JSON fields. Obviously I can format the results any way I want on any search, but I'd like to make this format standard so not every user watching these logs needs to format the events in the search string.
Is there a good way to solve this remaining use case without double-ingesting?
