Anywhere in the User Interface (Event List, Fields Panel, Inspection Panel), you can click the three-dot menu icon (⋮) on a field to get contextual menus that offer a series of interactions. What interactions are supported depend on the Field Data Types of the field you click. The image below shows them all:
Figure 58. Field Interactions Drilldowns
Main interactions are:
Search box. It works in any field interaction within the Fields Panel and Inspection Panel. It also works in the Event List when the data type is JSON or Log line.— copies the value or the field's name, ready for you to paste it in the
You can copy the field in different formats:
Further interactions are available no matter if the field selected is a value or a name:
array:contains()query function to query data. It is only shown for JSON arrays. Two interactions are available:
Event List, I can filter for any user who has WRITE permissions, independent on where the WRITE value is in the array. The following query is applied when this interaction is selected:filters events by requiring a string value to be present in the array. For example, given a list of users with different access permissions in thelogscale
Event List, I want to filter any user who doesn't have WRITE permissions. The following query is applied when this interaction is selected:allows for inverted filters i.e. it filters events by requiring a string value that is not present in the array. For example, given a list of users with different access permissions in thelogscale
not array:contains("user.permissions", value=WRITE)
array:contains()checks for a single value at the time, you need to run multiple Array interactions if you wish to filter on multiple values in the array.
This is possible because interactions are made with fields where LogScale is able to detect what type the field is; for example, some fields are just strings that might be JSON: LogScale detects it as JSON, thus the option→ will appear in the menu. Similarly, a field that looks like an URL will have the drill-down option → and it will split out the different parts of the URL.
When you hover one of the available drill-downs, you will get a
description of what will happen to your query string. In the example shown
here below, the drill-down selected is going to append
timeChart(#repo) to your query:
Figure 59. Query Update Tooltip
Use SHIFT+click to add the suggested option to the query string without running a new search.