Updated at: 2022-12-09 03:49:50
In the rule configuration, after parsing and verifying the original log, you can Replace Field Value, Delete Field, Rename Field and Add Field for the extracted fields after parsing by clicking Modify Field to further refine the parsing rule.
• Replace Field Value
In the Modifying Method dropdown list, select Replace Field Value. In the list of parsed fields, select the field to be replaced and enter the replacement value, such as, the value of the field hostId is replaced by test. The replacement results can be viewed in the right side;
• Delete Field
In the Modifying Method dropdown list, select Delete Field and select the field to be deleted from the parsed fields. To delete more than one field, click the
icon to add the field to be deleted, as follows:
• Add Field
In the Modifying Method dropdown list, select Add Field, select the Field Type to be added (string/int/float), Field Name, Field Value, click Verify to view the added field information in the parsing results on the right side.
To add more than one field, click the icon, as follows:
• Rename Field
In the Modifying Method dropdown list, select Rename Field, select the field to be renamed, click Verify to view the renamed field information in the parsing results on the right side.
To rename more than one field, click the icon, as follows:
• Replace Field Value
In the Modifying Method dropdown list, select Replace Field Value. In the list of parsed fields, select the field to be replaced and enter the replacement value, such as, the value of the field hostId is replaced by test. The replacement results can be viewed in the right side;
• Delete FieldIn the Modifying Method dropdown list, select Delete Field and select the field to be deleted from the parsed fields. To delete more than one field, click the
icon to add the field to be deleted, as follows: • Add FieldIn the Modifying Method dropdown list, select Add Field, select the Field Type to be added (string/int/float), Field Name, Field Value, click Verify to view the added field information in the parsing results on the right side.
To add more than one field, click the
icon, as follows:• Rename Field
In the Modifying Method dropdown list, select Rename Field, select the field to be renamed, click Verify to view the renamed field information in the parsing results on the right side.
To rename more than one field, click the
icon, as follows:
< Previous:
Next: >