How to search in nested JSON

[daniellin215]

Given this example log:
{"level":"info","time":"2025-12-03T19:30:22.608Z","pid":706,"hostname":"abc","class_uid":6001,"category_uid":6,"severity_id":3,"severity":"info","message":"[Valid transaction] id: abc","activity_id":0,"client_ip_address":"172.18.0.22","endpoint":"post_v1_billing_stripe_webhooks","request_id":"abc","request_method":"POST","request_viewer_client":"unknown","team":"undetermined","feature":"Undetermined","unmapped":{"logger":"root","transactionId":"abc","models":["BillingWebhookEvent"],"untrackedModels":[],"modelOperations":["[create on BillingWebhookEvent]","[save on BillingWebhookEvent]"]},"custom":{"service":"app-server"}}

If I use the search feature on the top right hand corner, how do I filter logs to only show by custom.service = a certain value? I tried many combinations like custom.service=, custom.service:, but all yielded no results. I have to basically search the value only, which in this case I have to search for "app-server" but that is too wide as other messages and properties could also contain the string.

[amir20]

The search bar is just a search field that search across all values. So custom.service= is not supported. As you said, only searching for a certain value works, but it does search across everything.

Your other option is to use the SQL analytics engine which does the search using duckdb in your browser.

[daniellin215]

Would it be possible in the future to extend search to look for nested fields within JSON structured logs? That would be killer!

[amir20]

No because how would I know you are searching for foo= the value or foo the key. Too complicated for my taste.