Raw JSON and access to _source

[ansoni]

Hello, It would be very nice to output raw JSON which would allow further transformations using something like jq.

Also, I did not see a way to retrieve the _source field.

Great tool!

Anthony

[knes1]

Hi!

Thanks for the feedback.

I agree that raw JSON would be a useful feature. As for _source, the fields that elktail outputs and formats are part of _source object, hence _source is one level below what you can currently access in elktail.

If you had raw JSON access, would you still have the need to access _source? If yes, why?