Updated at: 2022-12-09 03:49:50
Reparsed Data Stream means extracting unparsed data or parsing-failed data from Elasticsearch, parsing it again, and then storing it in Elasticsearch, as follows: 
1. Click Data Source > Data Stream > + New to create the New data stream, and click Reparsed Data Stream to display the configuration parameters, as follows:
Field Name
 Description
Set Data Source * Type  The method to match data source: By Manual / Automatch      
* Index Library The index library of the required data stream
• By Manual: Single or multiple index libraries can be selected by clicking on them in the index library dropdown list;
• Automatch: Index library can be matched automatically according to Log Type, Year, Month
Advanced Screening Screening Select the parsed Field and Value in index library, to make accurate index data filtering through the filter field. Multiple screening conditions can be added through the logical combination of AND or OR.
2. Click Next to make Reparsing Size Confirmation, where you can view the Total Items of data and log Type to be re-parsed in the selected data source, as follows: 

3. Click Next to set parameters for Input Config, as follows: 
Field Name Description Restrictive Condition
Host It is to define the host field and value of the log event after re-parsing. After successful setting, the host field and value will replace all those in the re-parsed log data. -
Log Tag It is to define the log tag of the log event after re-parsing. After successful setting, the log tag will be added to the re-parsed log data. Up to 5 tags can be added.
4. Click Next to go to Destination to confirm that the index library of the re-parsed log data is consistent by default with the index library selected by data source, as follows: 
5. Click Next to make Task setting, as follows: 
Field Name Description
* Task Name The task name of the reparsed data stream
* Log Extraction Rate The number of logs extracted per second, 3000 by default
* Task Plan The method of task plan execution: 
• Execute Once: Set the time to start task, and the default is the current time;
• Fixed Time: Set the fixed time of task execution, and the default execution time is 00: 00 per day, and you can customize the execution per day or on specified weekdays.
* Task Life Cycle Set the end time of the task execution. By default, the task will end if no new data is detected for 8 days.
6. Click Next to Check, where you can check and confirm the Reparsed Data Stream configuration parameters, and click the icon to modify the configuration parameters, as follows: 

7. Click Submit to make the creation Done, where you can Check Lists and Add More Tasks, as follows: 
• Check Lists: Click to go to the data stream list page to view tasks;
• Add More Tasks: Click to create a new data stream task.