Propper Logging practices for list of events

[sankarms]

I have a service that recommends a list of cars based on the user's input of personal information. For example, someone can send a request containing personal information and my service will respond back with a list of cars suited for their needs/personality like so:

{
    "cars": [
        {
            "type": "chevrolet equinox"
        },
        {
            "type": "ford explorer"
        },
        {
            "type": "cadillac srx"
        },
    ]
}

I want to be able to log all the cars that we send out as recommendations so I can make a bar graph that represents the number of times we've recommended all the different types of cars.

My question is, what are the best practices in this case. How can we look it so that splunk will easily be able to pick this up and generate a bar graph with?

[martin_mueller · Accepted solution]

Making the entire event as one JSON object is a good way of letting Splunk easily understand arrays/lists, yes.

[martin_mueller]

If you're only every going to store a string per car then that would be more efficient. If for example you might one day store the model year it'd be better to split that off into an object per car with properties manufacturer, model, year, etc.

[sankarms]

ok so would it be better to log it like this:

{
     "cars": ["chevrolet equinox","ford explorer","cadillac srx"]
 }