which is more better structure when use json array

[ktaeil]

when i made a log for HEC with json array, im not sure what is more better way to use spl.

can someone advise me please?

way 1. 

{host: 'test'

lists : [{

                   id: ' list1'

                   ip: '192.168.0.1'

                   device: 'laptop'

                   value: 123

                   },

                 {

                   id: ' list2'

                   ip: '192.168.0.2'

                   device: 'phone'

                   value: 1223

                   },

                 {

                   id: ' list3'

                   ip: '192.168.0.3'

                   device: 'desktop'

                   value: 99

                   },

]}

way2.

{host: 'test'

list1 :{

                   id: ' list1'

                   ip: '192.168.0.1'

                   device: 'laptop'

                   value: 123

             }

list2 : {

                   id: ' list2'

                   ip: '192.168.0.2'

                   device: 'phone'

                   value: 1223

                   },

list3:   {

                   id: ' list3'

                   ip: '192.168.0.3'

                   device: 'desktop'

                   value: 99

                   },

]}

[yuanliu]

It is interesting that you pose the question in regard to SPL instead of a data structure consideration.  But still, while array is a viable structure for many applications, SPL is not the only language that has to go to extra length to handle.  If you have a choice, and if you don't care much about front-end compute, hash is easier on SPL. (And again, easier in some use cases with other languages.)

I do want to suggest, though, you drop the nested listX.id node because that is redundant. (Lastly, I also recommend that you illustrate with compliant JSON.  This makes volunteers work easier.)

{"host": "test",

"list1" :{

                  "ip": "192.168.0.1",

                   "device": "laptop",

                   "value": 123

             },

"list2" : {

                   "ip": "192.168.0.2",

                   "device": "phone",

                   "value": 1223

                   },

"list3":   {

                   "ip": "192.168.0.3",

                   "device": "desktop",

                   "value": 99

                   }

}