LinkedIn
Twitter
I have software application logs streaming into BigQuery for use in Looker. While I can do extractions on the major components (like log level, source server, environment, etc) I’m struggling with making use of Looker’s table visualizations for reading unstructured or long messages.
I happened across the Fastly example on the Looker website, but it looks to be doing just a string with no additional transformations applied for its request object, which I would imagine to be the most comparable situation.
These messages are not structured in such a way that I would create a common LookML definition for every field within them, meaning that I wind up with either hundreds/thousands of character line messages in a single table column. In some cases I have structured json/xml that I’d want to properly visualize in a multi-line manner if possible too. BigQuery permits me to define custom functions with which I can at least format the json objects into properly indented multi-line representations, but I haven’t broached the topic in Looker yet.
ex for displaying more legible json structures.
{"key":"value","another":"thing"}
{
"key": "value",
"another": "thing"
}
Additionally, is there a way to disable drilldown clicking on the table visualizations without disabling exploration of the field entirely? With unstructured data again it’s often necessary to copy/paste a subsection of the cell value rather than the entire thing.
ex. selecting the json value out of this object requires a wider selection and trimming down the result when the value is pasted elsewhere.
While the above is Table (Legacy) the same applies to the new Table format.
When in Explore, even the Visualization panel does not allow for direct selection - instead requiring you to pop open the textarea panel which needs to be resized manually each time. It also as a side note doesn’t properly scale it’s vertical size - which I think stems from changing the window size during Edit.
Looking for any suggestions on how to make this more usable for this type of use case.
