Support query-time JSON parsing + nested field access + array expansion for Logs (KQL-like)
- Dominant language
- Python
- Stars
- 44.8k
- Forks
- 4.9k
- Avg merge
- 21h 10m
- Merged PRs (30d)
- 635
Description
### Problem Statement
**Summary:**
Customers want to query semi-structured logs (JSON blobs / nested fields / arrays) without pre-tagging every field at ingestion time (schema-on-read like KQL). Today Sentry Logs are schema-on-write, so only pre-extracted attributes are searchable.
**Example (customer ask):**
**Log contains JSON blob in a field:**
`{ "message": "Request completed", "payload": "{\"id\":\"123\",\"items\":[{\"sku\":\"A1\"}]}" }
`
**Expected (KQL/AppInsights):**
```
| extend p = parse_json(payload)
| where tostring(p.id) == "123"
| mv-expand item = p.items
| where tostring(item.sku) == "A1"
```
**Sentry today:**
Not possible unless id, items.sku, etc. are extracted/flattened at ingestion.
**Current Limitations:**
- No query-time JSON parsing
- No nested field access inside JSON blobs
- No array expansion (mv-expand equivalent)
- No query-time string parsing/regex extraction
### Solution Brainstorm
_No response_
### Product Area
Processing
Contributor guide
Assessment
This issue has not been assessed yet.