Field Remapper
Last updated
Last updated
Address
VNG CorporationField Remapper is a feature that allows you to add fields, delete fields, change field names or change the data type of fields in the data.
To use Field Remapper, follow the instructions below:
In the Processor information section , enter general information for a processor according to the instructions in Processor . In this content, you will choose Processor type as Field Remapper .
In the Parsing rule section , enter the following information:
Add fields : add any pair of values. The added value pair must follow the structure Field , Value .
Remove fields : delete existing fields in logs.
Rename fields : change the name of the field.
Convert type: change the data type of fields
For example:
| Items | Value | Meaning | Source logs | Destination logs |
|---|---|---|---|---|
Add fields | Key: codec Value: rubydebug | Thêm field codec với value là rubydebug vào destination logs. | { "@timestamp": "2023-08-02T06:35:08.017Z", "agent.id": "12002", "type": "vMonitor", "agent.hostname": "VNGCLOUD", "date": "2023-08-01T07:45:11.130Z", "client_ip": "45.61.164.120", "esc.version": "-" } | { "@timestamp": "2023-08-02T06:35:08.017Z", "agent.id": "12002", "type": "vMonitor", "agent.hostname": "VNGCLOUD", "date": "2023-08-01T07:45:11.130Z", "client_ip": "45.61.164.120", "esc.version": "-" } |
Remove fields | esc.version | Loại bỏ field esc.version khỏi destination logs. | nt | nt |
Rename fields | Field: agent.hostname Name: agent.host | Đổi tên field agent.hostname thành agent.host tại destination logs. | nt | nt |
Convert type | Field: agent.id Type: Integer | Chuyển loại dữ liệu của field agent.id từ string thành Interger. | nt | nt |
You can store a parsing rule by checking Save this rule , then entering a memorable name for the parsing rule you want to store. The mnemonic name has a minimum length of 5 characters, a maximum length of 255 characters and can only include upper and lower case letters (az, AZ), numbers (0-9), and dots (.), space ( ), underscore (_), hyphen (-), and the @ character.
After the parsing rule has been stored, in subsequent processor creations you can reuse this rule by selecting Rule presets in the Pasing rule section.
