...
- In Type, select String.
- In Name, type the name of the field (column heading).
- To configure advanced settings for the field, click Advanced. Otherwise, continue with step 11.
- In UI Message Length, type the maximum length of data displayed in a column. If the data is longer than this value, it continues onto the next line(s).
- In Field Types, type the set of strings that describe the field.
- In Chars Length, type the length of the character string. If there are less characters for this field in a log record, characters are added to the string to force it to be this length.
- In Trim Chars, type a character or string to delete from the column value. For example, typing $ means that $ will be deleted from log records with $ in this field.
- In Delimiter Chars, type a character or string for delimiting the column.
- In Mask Column, define the masking of column text by selecting one of the following:
- Don't mask (default) - entire column value is displayed
- Mask entire column text - entire column value is not displayed
- Mask part of column text - part of the column value will be masked, use a regular expression and include the part you wish to mask inside a round brackets (). Note all masked values are replaced with six * - regardless of the masked value length.
- Admin user will see masking only in the patterns administration part, the values cannot be masked from users who are part of the XpoLog Administrators group.
- All users with patterns administration permissions (Edit log) will see all values in the patterns administration part.
- Users who are restricted from viewing masked data are not able to preform searches on this data, the masked data does not exist from these user's context.
- Select the GeoIP checkbox to enable GeoIP for this field.
- If this string does not appear in all records, select the Optional checkbox.
- Click Apply.
The log records are refreshed in the bottom pane showing the added field.
...
- In Type, select Priority.
- In Name, type the name of the field (column heading).
- In Set Priorities, specify the set of priorities that can appear in the field, in a semi-colon separated list. Example: DEBUG;INFO;WARN;ERROR;FATAL
- To configure advanced settings for the field, click Advanced. Otherwise, continue with step 9.
- In Chars Length, type the length of the character string. If there are less characters for this field in a log record, characters are added to the string to force it to be this length.
- In Trim Chars, type a character or string to delete from the column value. For example, typing $ means that $ will be deleted from log records with $ in this field.
- In Delimiter Chars, type a character or string for delimiting the column.
- In Mask Column, define the masking of column text by selecting one of the following:
- Don't mask (default) - entire column value is displayed
- Mask entire column text - entire column value is not displayed
- Mask part of column text - part of the column value will be masked, use a regular expression and include the part you wish to mask inside a round brackets (). Note all masked values are replaced with six * - regardless of the masked value length.
- Admin user will see masking only in administration part, the values cannot be masked from users who are part of the XpoLog Administrators group.
- All users with patterns administration permissions (Edit log) will see all values in the patterns administration part.
- Users who are restricted from viewing masked data are not able to preform searches on this data, the masked data does not exist from these user's context.
- If this field does not appear in all records, select the Optional checkbox.
- Click Apply.
The log records are refreshed in the bottom pane showing the added field.
...
- In Type, select Choice.
- In Name, type the name of the field (column heading).
- In Set Choice, specify the set of choices that can appear in the field, in a semi-colon separated list. Example: RED;YELLOW;GREEN
- To configure advanced settings for the field, click Advanced. Otherwise, continue with step 10.
- In Chars Length, type the length of the character string. If there are less characters for this field in a log record, characters are added to the string to force it to be this length.
- In Trim Chars, type a character or string to delete from the column value. For example, typing $ means that $ will be deleted from log records with $ in this field.
- In Delimiter Chars, type a character or string for delimiting the column.
- In Mask Column, define the masking of column text by selecting one of the following:
- Don't mask (default) - entire column value is displayed
- Mask entire column text - entire column value is not displayed
- Mask part of column text - part of the column value will be masked, use a regular expression and include the part you wish to mask inside a round brackets (). Note all masked values are replaced with six * - regardless of the masked value length.
- Admin user will see masking only in administration part, the values cannot be masked from users who are part of the XpoLog Administrators group.
- All users with patterns administration permissions (Edit log) will see all values in the patterns administration part.
- Users who are restricted from viewing masked data are not able to preform searches on this data, the masked data does not exist from these user's context.
- If this field does not appear in all records, select the Optional checkbox.
- Click Apply.
The log records are refreshed in the bottom pane showing the added field.
...
- In Type, select Number.
- In Name, type the name of the field (column heading).
- To configure advanced settings for the field, click Advanced. Otherwise, continue with step 9.
- In Chars Length, type the length of the character string. If there are less characters for this field in a log record, characters are added to the string to force it to be this length.
- In Trim Chars, type a character or string to delete from the column value. For example, typing $ means that $ will be deleted from log records with $ in this field.
- In Delimiter Chars, type a character or string for delimiting the column.
- In Mask Column, define the masking of column text by selecting one of the following:
- Don't mask (default) - entire column value is displayed
- Mask entire column text - entire column value is not displayed
- Mask part of column text - part of the column value will be masked, use a regular expression and include the part you wish to mask inside a round brackets (). Note all masked values are replaced with six * - regardless of the masked value length.
- Admin user will see masking only in administration part, the values cannot be masked from users who are part of the XpoLog Administrators group.
- All users with patterns administration permissions (Edit log) will see all values in the patterns administration part.
- Users who are restricted from viewing masked data are not able to preform searches on this data, the masked data does not exist from these user's context.
- If this numeric field does not appear in all records, select the Optional checkbox.
- Click Apply.
The log records are refreshed in the bottom pane showing the added field.
...
- In Type, select GeoIP.
- In Name, type the name of the field (column heading).
- In Information, type the information appearing in the field: Country, Region, City; Country; Country Code; Region; City; None.
- To configure advanced settings for the field, click Advanced. Otherwise, continue with step 9.
- In Ref Index, type the zero-based index of the source column. The regular expression will be extracted according to this reference.
- In Ref Name, type the zero-based name of the source column. The regular expression will be extracted according to this reference.
- In MaskIn Mask Column, define the masking of column text by selecting one of the following:
- Don't mask (default) - entire column value is displayed
- Mask entire column text - entire column value is not displayed
- Mask part of column text - part of the column value will be masked, use a regular expression and include the part you wish to mask inside a round brackets (). Note all masked values are replaced with six * - regardless of the masked value length.
- Admin user will see masking only in administration part, the values cannot be masked from users who are part of the XpoLog Administrators group.
- All users with patterns administration permissions (Edit log) will see all values in the patterns administration part.
- Users who are restricted from viewing masked data are not able to preform searches on this data, the masked data does not exist from these user's context.
- If this GeoIP field does not appear in all records, select the Optional checkbox.
- Click Apply.
The log records are refreshed in the bottom pane showing the added field.
...
- In Type, select Term.
- In Name, type the name of the field (column heading).
- To configure advanced settings for the field, click Advanced. Otherwise, continue with step 7.
- In MaskIn Mask Column, define the masking of column text by selecting one of the following:
- Don't mask (default) - entire column value is displayed
- Mask entire column text - entire column value is not displayed
- Mask part of column text - part of the column value will be masked, use a regular expression and include the part you wish to mask inside a round brackets (). Note all masked values are replaced with six * - regardless of the masked value length.
- Admin user will see masking only in administration part, the values cannot be masked from users who are part of the XpoLog Administrators group.
- All users with patterns administration permissions (Edit log) will see all values in the patterns administration part.
- Users who are restricted from viewing masked data are not able to preform searches on this data, the masked data does not exist from these user's context.
- If this string does not appear in all records, select the Optional checkbox.
- Click Apply.
The log records are refreshed in the bottom pane showing the added field.
...
- In Type, select IP Address.
- In Name, type the name of the field (column heading).
- To configure advanced settings for the field, click Advanced. Otherwise, continue with step 7.
- In Mask Column, define the masking of column text by selecting one of the following:
- Don't mask (default) - entire column value is displayed
- Mask entire column text - entire column value is not displayed
- Mask part of column text - part of the column value will be masked, use a regular expression and include the part you wish to mask inside a round brackets (). Note all masked values are replaced with six * - regardless of the masked value length.
- Admin user will see masking only in administration part, the values cannot be masked from users who are part of the XpoLog Administrators group.
- All users with patterns administration permissions (Edit log) will see all values in the patterns administration part.
- Users who are restricted from viewing masked data are not able to preform searches on this data, the masked data does not exist from these user's context.
- Select the GeoIP checkbox to enable GeoIP for this field.
- If this string does not appear in all records, select the Optional checkbox.
- Click Apply.
The log records are refreshed in the bottom pane showing the added field.