JSON versus JSON Lines

In some cases, you might need to extract logs as JSON Lines, where each line is a JSON object. In other cases, you might need JSON that can be parsed by functions that only accept a single JSON object or array.

JSON Lines is more useful than a JSON array in the following cases:

  • Forwarding many thousands of log records to an analytics platform. Large arrays can be problematic (memory-intensive) to parse. For many analytics platforms, JSON Lines is inherently easier to ingest.
  • If you want several JSON commands to write to the same destination, such as a TCP socket, then you must output JSON Lines.

JSON Lines

By default, the JSON command of the Transaction Analysis Workbench report and extract utility outputs JSON Lines. Each line of output is a JSON object that represents an input log record:

{ record 1 }
{ record 2 }
{ record 3 }
...

JSON: A single array

If you specify the ARRAY parameter, the JSON command writes a single JSON array. Each element of the array is a JSON object that represents an input log record:

[
  { record 1 },
  { record 2 },
  { record 3 },
  ...
]

An array is useful in contexts that require a single JSON object, such as the JavaScript JSON.parse() method in web browsers.