Field Remapper
Overview
Field Remapper is a feature that allows you to add fields, delete fields, change field names or change the data type of fields in the data.
Configure Field Remapper
To use Field Remapper, follow the instructions below:
In the Processor information section , enter general information for a processor according to the instructions in Processor . In this content, you will choose Processor type as Field Remapper .
In the Parsing rule section , enter the following information:
Add fields : add any pair of values. The added value pair must follow the structure Field , Value .
Remove fields : delete existing fields in logs.
Rename fields : change the name of the field.
Convert type: change the data type of fields
For example:
| Items | Value | Meaning | Source logs | Destination logs |
|---|---|---|---|---|
Add fields | Key: codec Value: rubydebug | Thêm field codec với value là rubydebug vào destination logs. | { "@timestamp": "2023-08-02T06:35:08.017Z", "agent.id": "12002", "type": "vMonitor", "agent.hostname": "VNGCLOUD", "date": "2023-08-01T07:45:11.130Z", "client_ip": "45.61.164.120", "esc.version": "-" } | { "@timestamp": "2023-08-02T06:35:08.017Z", "agent.id": "12002", "type": "vMonitor", "agent.hostname": "VNGCLOUD", "date": "2023-08-01T07:45:11.130Z", "client_ip": "45.61.164.120", "esc.version": "-" } |
Remove fields | esc.version | Loại bỏ field esc.version khỏi destination logs. | nt | nt |
Rename fields | Field: agent.hostname Name: agent.host | Đổi tên field agent.hostname thành agent.host tại destination logs. | nt | nt |
Convert type | Field: agent.id Type: Integer | Chuyển loại dữ liệu của field agent.id từ string thành Interger. | nt | nt |
Store and reuse Parsing rules
You can store a parsing rule by checking Save this rule , then entering a memorable name for the parsing rule you want to store. The mnemonic name has a minimum length of 5 characters, a maximum length of 255 characters and can only include upper and lower case letters (az, AZ), numbers (0-9), and dots (.), space ( ), underscore (_), hyphen (-), and the @ character.
After the parsing rule has been stored, in subsequent processor creations you can reuse this rule by selecting Rule presets in the Pasing rule section.
Last updated
