Field Remapper

Overview

Field Remapper is a feature that allows you to add fields, delete fields, change field names or change the data type of fields in the data.

Configure Field Remapper

To use Field Remapper, follow the instructions below:

In the Processor information section , enter general information for a processor according to the instructions in Processor . In this content, you will choose Processor type as Field Remapper .
In the Parsing rule section , enter the following information:

Add fields : add any pair of values. The added value pair must follow the structure Field , Value .
Remove fields : delete existing fields in logs.
Rename fields : change the name of the field.
Convert type: change the data type of fields

For example:

Items

Value

Meaning

Source logs

Destination logs

Add fields

Key: codec

Value: rubydebug

Thêm field codec với value là rubydebug vào destination logs.

{ "@timestamp": "2023-08-02T06:35:08.017Z", "agent.id": "12002", "type": "vMonitor", "agent.hostname": "VNGCLOUD", "date": "2023-08-01T07:45:11.130Z", "client_ip": "45.61.164.120", "esc.version": "-" }

Remove fields

esc.version

Loại bỏ field esc.version khỏi destination logs.

Rename fields

Field: agent.hostname

Name: agent.host

Đổi tên field agent.hostname thành agent.host tại destination logs.

Convert type

Field: agent.id

Type: Integer

Chuyển loại dữ liệu của field agent.id từ string thành Interger.

Store and reuse Parsing rules

You can store a parsing rule by checking Save this rule , then entering a memorable name for the parsing rule you want to store. The mnemonic name has a minimum length of 5 characters, a maximum length of 255 characters and can only include upper and lower case letters (az, AZ), numbers (0-9), and dots (.), space ( ), underscore (_), hyphen (-), and the @ character.
After the parsing rule has been stored, in subsequent processor creations you can reuse this rule by selecting Rule presets in the Pasing rule section.

PreviousCSV Parser NextDate Parser

Last updated 4 months ago

Store and reuse Parsing rules

You can store a parsing rule by checking Save this rule , then entering a memorable name for the parsing rule you want to store. The mnemonic name has a minimum length of 5 characters, a maximum length of 255 characters and can only include upper and lower case letters (az, AZ), numbers (0-9), and dots (.), space ( ), underscore (_), hyphen (-), and the @ character.

After the parsing rule has been stored, in subsequent processor creations you can reuse this rule by selecting Rule presets in the Pasing rule section.