Field Data Types

Use the Data type column formatting option (appears when clicking the up-arrow-head next to column header) to assign a relevant data type to field names, thus affecting how data is displayed in the Event list.

Available data types are:

  • Bytes formats the data size in bytes, with prefixes. Example: 1500000 will be displayed as 1.5 MB.

  • JSON offers a view of JSON data with expandable and collapsible nodes, allowing the interaction with its tree structure.

JSON Formatting Type

Figure 64. JSON Formatting Type


  • Log line highlights data in different colors on all columns if the data format is supported — supported formats are JSON, XML and accesslog. This is the default format for field @rawstring.

    Note

    An Invalid value error message is shown in the string in case of unsupported data format.

  • Number displays numbers with thousands separators and right-aligned column. Example: 1,000.24.

  • Text displays data as plain text. This is the default format for all fields except @rawstring, @timestamp and @ingesttimestamp.

  • Time Ago converts Unix timestamp with milliseconds in Time ago relative time. Example: 47m 12s ago.

  • Time Duration displays the milliseconds elapsed as duration. Example: 3000 is shown as 3s.

  • XML shows highlighted XML.

  • Make default for field saves the selected format as the default for that field (instead of the field's standard format type), so that the data type previously chosen is kept when the field is removed and re-added in the Event list. These settings will never override the formatting chosen for any dashboard or widget already configured with different data types.