Problem Statement
Summary:
Customers want to query semi-structured logs (JSON blobs / nested fields / arrays) without pre-tagging every field at ingestion time (schema-on-read like KQL). Today Sentry Logs are schema-on-write, so only pre-extracted attributes are searchable.
Example (customer ask):
Log contains JSON blob in a field:
{ "message": "Request completed", "payload": "{\"id\":\"123\",\"items\":[{\"sku\":\"A1\"}]}" }
Expected (KQL/AppInsights):
| extend p = parse_json(payload)
| where tostring(p.id) == "123"
| mv-expand item = p.items
| where tostring(item.sku) == "A1"
Sentry today:
Not possible unless id, items.sku, etc. are extracted/flattened at ingestion.
Current Limitations:
- No query-time JSON parsing
- No nested field access inside JSON blobs
- No array expansion (mv-expand equivalent)
- No query-time string parsing/regex extraction
Solution Brainstorm
No response
Product Area
Processing
Problem Statement
Summary:
Customers want to query semi-structured logs (JSON blobs / nested fields / arrays) without pre-tagging every field at ingestion time (schema-on-read like KQL). Today Sentry Logs are schema-on-write, so only pre-extracted attributes are searchable.
Example (customer ask):
Log contains JSON blob in a field:
{ "message": "Request completed", "payload": "{\"id\":\"123\",\"items\":[{\"sku\":\"A1\"}]}" }Expected (KQL/AppInsights):
Sentry today:
Not possible unless id, items.sku, etc. are extracted/flattened at ingestion.
Current Limitations:
Solution Brainstorm
No response
Product Area
Processing