Skip to main content
Sumo Logic

View Search Results for JSON Logs

If your search returns fields that are valid JSON objects, you can expand or collapse the view on the Messages tab to show or hide the JSON substructure, or present the messages as formatted JSON code.

Expand or collapse JSON messages

By default, the full contents and structure of the JSON messages are shown.

Click Collapse All on the upper right side of the message table to hide the structure. This  operation does not hide the top level JSON attributes, only the attributes below the top that are objects rather than simple values.

Click Expand All to toggle back to the view that shows the full contents and structure of the log messages.

Right-click an individual message to see the following options:

  • Collapse Cell. Collapses the substructure of the selected message.
  • Expand Cell. Expand the substructure of the selected message.
  • Copy as JSON. Copies the message to the clipboard. (This function is not available on Safari due to a browser limitation.)

Format JSON messages in search results 

If the messages in your search results can be formatted as JSON, the Messages tab presents the option to display each message in JSON or raw format. Click the link to toggle between the JSON and raw view. 

The view of JSON formatting is limited to JSON files less than 10 KB in size.

json or raw cropped.png