When you index a JSON field, both the field name and field value count toward index traffic, including subfields that are not explicitly indexed.
Calculation rules
Index traffic for a JSON field is calculated based on the following rules:
- If a subfield is not indexed, its index traffic is calculated as the text data type.
- If a subfield is indexed, its index traffic is calculated based on the actual data type of the subfield, which can be text, long, or double. For more information, see Create indexes.
Example
In the following sample log, the result field is of the JSON type and only the result.anomaly_type subfield is indexed. Index traffic includes the name of the result field and all content in its value. The names and values of non-indexed subfields such as dim_name are also included, and their data types are treated as text.
- Sample log
{ "result": { "anomaly_type": "None", "dim_name": "body_bytes_sent", "is_anomaly": false, "score": 0, "value": "4850.000000" } } - In the index configuration, the data type of the result field is json, with the delimiter
,':"=0[]{}?@&<>/\n\t\r. The data type of its anomaly_type subfield is text, and it is indexed.