I have an index populated with JSON data. One of the elements in the JSON data is an array of key/value pairs. I want to create a dashboard that pulls all of the data in one search populating one t...
See more...
I have an index populated with JSON data. One of the elements in the JSON data is an array of key/value pairs. I want to create a dashboard that pulls all of the data in one search populating one table with the non-array values. When one of the rows in the table of non-array values is selected, I want to populate a second table with the array of key/value pairs parsed out into individual rows. I have this sort of working by searching again back to the original index but would like to avoid this overhead since the key/value pairs were included in the initial results.
Any ideas on how to pull this off?
Example of one record:
{ "Header": { "EntryTimestamp": "2023-06-13T14:13:07.9316608Z", "EntryType": "Exception", "SubmittingUser": "TEST", "Message": "Call to Server end point failed. Unable to connect to the remote server.", "ApplicationName": "TestService", "Environment": "DEVELOPMENT" }, "Items": [{ "Key": "ExceptionTimeStamp", "Value": "2023-06-13T14:13:07.9266" }, { "Key": "ExceptionSource\\MachineName", "Value": "TESTSERVER" }, { "Key": "ExceptionSource\\ClassName", "Value": "Socket" }, { "Key": "ExceptionSource\\NameSpace", "Value": "System.Net.Sockets" }, { "Key": "ExceptionSource\\Method", "Value": "DoConnect" }, { "Key": "RootExceptionType", "Value": "System.Net.Sockets.SocketException" }, { "Key": "ExceptionID", "Value": "72c52379-433b-41a7-90aa-1900cfcc4c29" }, { "Key": "Timeout", "Value": "115000" }, { "Key": "Message", "Value": "Unable to connect to the remote server" } ], "Data": "" }
The elements in the "Header" section would appear in one table. When that row is selected, the array of "Items" would be populated in a second two-column table with the first column being Keys and the second column being the corresponding value that goes with the key.
The approach I started with was putting the Items array in a hidden column in the first table, but am stuck on that approach with trying to figure out how to get that into an array and populate the second table.