Description
Is your feature request related to a problem? Please describe.
Want better support for JSON in Logs Drilldown.
Related: grafana/logs-drilldown#1122
Currently in the above PoC, if a filter is added from the "Fields" tab, and the user has other active JSON parser props, the filter from the "Fields" will break the users query, as we cannot determine the JSON parser prop for a nested field, as underscores are used to delimit parent/child nodes, but are also valid chars within field labels.
Describe the solution you'd like
I'd like to see a "path" argument on the detected_fields response, that contains the JSON structure so JSON parser properties can be added for JSON field filters.
Example log line:
{
"host": "32.30.161.3",
"user-identifier": "-",
"datetime": "18/Mar/2025:16:03:30 +0000",
"method": "PUT",
"request": "/api/mimir/v1/label",
"protocol": "HTTP/1.1",
"status": 200,
"bytes": 15636,
"referer": "http://www.internalstreamline.info/next-generation/24/7/out-of-the-box/dot-com",
"_25values": 12,
"nested_object": {
"method": "GET",
"url": "https://www.legacyreintermediate.net/seize/sexy",
"numArray": [
27744,
14670,
15496
],
"strArray": [
"placeat",
"tenetur",
"placeat"
],
"DeeplyNestedObject": {
"method": "POST",
"url": "https://www.customercutting-edge.net/cross-platform/end-to-end",
"numArray": [
13985,
22832,
11108
],
"strArray": [
"voluptatem",
"ducimus",
"fugiat"
],
"ExtraDeeplyNestedObject": {
"method": "PUT",
"url": "https://www.forwarde-business.net/eyeballs/harness",
"numArray": [
23243,
3255,
13411
],
"strArray": [
"omnis",
"sed",
"voluptas"
]
}
}
}
}
Current response:
{
"fields": [
{
"label": "nested_object_DeeplyNestedObject_url",
"type": "string",
"cardinality": 100,
"parsers": [
"json"
]
},
],
...
}
Desired response:
{
"fields": [
{
"label": "nested_object_DeeplyNestedObject_url",
"path": "nested_object.DeeplyNestedObject.url", // <-- This is the change
"type": "string",
"cardinality": 100,
"parsers": [
"json"
]
},
],
...
}
Describe alternatives you've considered
A wildcard JSON parser argument, that says parse the default JSON fields (as if no JSON parser props were added) in addition to any specified JSON parser props (big lift)
Recursive JSON field parsing in Loki (big lift)
Additional context
Chatted with @trevorwhitney about this today, agreed that adding a "path" to the detected_fields response so the frontend application can build the necessary JSON parser props for field filters.