getsentry / getsentry/sentry

Support query-time JSON parsing + nested field access + array expansion for Logs (KQL-like)

Open
#106,211 14 comments 2 reactions 1 assignee Claimed by @bcoe View on GitHub
Product Area: Explore
Dominant language
Python
Stars
44.8k
Forks
4.9k
Avg merge
21h 10m
Merged PRs (30d)
635

Description

### Problem Statement

**Summary:**

Customers want to query semi-structured logs (JSON blobs / nested fields / arrays) without pre-tagging every field at ingestion time (schema-on-read like KQL). Today Sentry Logs are schema-on-write, so only pre-extracted attributes are searchable.

**Example (customer ask):**

**Log contains JSON blob in a field:**
`{ "message": "Request completed", "payload": "{\"id\":\"123\",\"items\":[{\"sku\":\"A1\"}]}" }
`

**Expected (KQL/AppInsights):**
```
| extend p = parse_json(payload)
| where tostring(p.id) == "123"
| mv-expand item = p.items
| where tostring(item.sku) == "A1"
```

**Sentry today:**
Not possible unless id, items.sku, etc. are extracted/flattened at ingestion.

**Current Limitations:**

- No query-time JSON parsing
- No nested field access inside JSON blobs
- No array expansion (mv-expand equivalent)
- No query-time string parsing/regex extraction

### Solution Brainstorm

_No response_

### Product Area

Processing

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.