Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  1. In Type, select String.
  2. In Name, type the name of the field (column heading).
  3. To configure advanced settings for the field, click Advanced. Otherwise, continue with step 11.
  4. In UI Message Length, type the maximum length of data displayed in a column. If the data is longer than this value, it continues onto the next line(s).
  5. In Field Types, type the set of strings that describe the field.
  6. In Chars Length, type the length of the character string. If there are less characters for this field in a log record, characters are added to the string to force it to be this length.
  7. In Trim Chars, type a character or string to delete from the column value. For example, typing $ means that $ will be deleted from log records with $ in this field.
  8. In Delimiter Chars, type a character or string for delimiting the column.
  9. In Mask Column, define the masking of column text by selecting one of the following:
    1. Don't mask (default) - entire column value is displayed
    2. Mask entire column text entire column value is not displayed
    3. Mask part of column text - part of the column value will be masked, use a regular expression and include the part you wish to mask inside a round brackets (). Note all masked values are replaced with six * - regardless of the masked value length.
    Note: 
    1. Admin user will see masking only in the patterns administration part, the values cannot be masked from users who are part of the XpoLog Administrators group.
    2. All users with patterns administration permissions (Edit log) will see all values in the patterns administration part.
    3. Users who are restricted from viewing masked data are not able to preform searches on this data, the masked data does not exist from these user's context.
  10. Select the GeoIP checkbox to enable GeoIP for this field. 
  11. If this string does not appear in all records, select the Optional checkbox. 
  12. Click Apply.
    The log records are refreshed in the bottom pane showing the added field.

...

  1. In Type, select Priority.
  2. In Name, type the name of the field (column heading).
  3. In Set Priorities, specify the set of priorities that can appear in the field, in a semi-colon separated list. Example: DEBUG;INFO;WARN;ERROR;FATAL
  4. To configure advanced settings for the field, click Advanced. Otherwise, continue with step 9.
  5. In Chars Length, type the length of the character string. If there are less characters for this field in a log record, characters are added to the string to force it to be this length.
  6. In Trim Chars, type a character or string to delete from the column value. For example, typing $ means that $ will be deleted from log records with $ in this field.
  7. In Delimiter Chars, type a character or string for delimiting the column.
  8. In Mask Column, define the masking of column text by selecting one of the following:
    1. Don't mask (default) - entire column value is displayed
    2. Mask entire column text entire column value is not displayed
    3. Mask part of column text - part of the column value will be masked, use a regular expression and include the part you wish to mask inside a round brackets (). Note all masked values are replaced with six * - regardless of the masked value length.
    Note: 
    1. Admin user will see masking only in administration part, the values cannot be masked from users who are part of the XpoLog Administrators group.
    2. All users with patterns administration permissions (Edit log) will see all values in the patterns administration part.
    3. Users who are restricted from viewing masked data are not able to preform searches on this data, the masked data does not exist from these user's context.
  9. If this field does not appear in all records, select the Optional checkbox. 
  10. Click Apply.
    The log records are refreshed in the bottom pane showing the added field.

...

  1. In Type, select Choice.
  2. In Name, type the name of the field (column heading).
  3. In Set Choice, specify the set of choices that can appear in the field, in a semi-colon separated list. Example: RED;YELLOW;GREEN
  4. To configure advanced settings for the field, click Advanced. Otherwise, continue with step 10.
  5. In Chars Length, type the length of the character string. If there are less characters for this field in a log record, characters are added to the string to force it to be this length.
  6. In Trim Chars, type a character or string to delete from the column value. For example, typing $ means that $ will be deleted from log records with $ in this field.
  7. In Delimiter Chars, type a character or string for delimiting the column.
  8. In Mask Column, define the masking of column text by selecting one of the following:
    1. Don't mask (default) - entire column value is displayed
    2. Mask entire column text entire column value is not displayed
    3. Mask part of column text - part of the column value will be masked, use a regular expression and include the part you wish to mask inside a round brackets (). Note all masked values are replaced with six * - regardless of the masked value length.
    Note: 
    1. Admin user will see masking only in administration part, the values cannot be masked from users who are part of the XpoLog Administrators group.
    2. All users with patterns administration permissions (Edit log) will see all values in the patterns administration part.
    3. Users who are restricted from viewing masked data are not able to preform searches on this data, the masked data does not exist from these user's context.
  9. If this field does not appear in all records, select the Optional checkbox. 
  10. Click Apply.
    The log records are refreshed in the bottom pane showing the added field.

...

  1. In Type, select Number.
  2. In Name, type the name of the field (column heading).
  3. To configure advanced settings for the field, click Advanced. Otherwise, continue with step 9.
  4. In Chars Length, type the length of the character string. If there are less characters for this field in a log record, characters are added to the string to force it to be this length.
  5. In Trim Chars, type a character or string to delete from the column value. For example, typing $ means that $ will be deleted from log records with $ in this field.
  6. In Delimiter Chars, type a character or string for delimiting the column.
  7. In Mask Column, define the masking of column text by selecting one of the following:
    1. Don't mask (default) - entire column value is displayed
    2. Mask entire column text entire column value is not displayed
    3. Mask part of column text - part of the column value will be masked, use a regular expression and include the part you wish to mask inside a round brackets (). Note all masked values are replaced with six * - regardless of the masked value length.
    Note: 
    1. Admin user will see masking only in administration part, the values cannot be masked from users who are part of the XpoLog Administrators group.
    2. All users with patterns administration permissions (Edit log) will see all values in the patterns administration part.
    3. Users who are restricted from viewing masked data are not able to preform searches on this data, the masked data does not exist from these user's context.
  8. If this numeric field does not appear in all records, select the Optional checkbox. 
  9. Click Apply.
    The log records are refreshed in the bottom pane showing the added field.

...

  1. In Type, select GeoIP.
  2. In Name, type the name of the field (column heading).
  3. In Information, type the information appearing in the field: Country, Region, City; Country; Country Code; Region; City; None.
  4. To configure advanced settings for the field, click Advanced. Otherwise, continue with step 9.
  5. In Ref Index, type the zero-based index of the source column. The regular expression will be extracted according to this reference.
  6. In Ref Name, type the zero-based name of the source column. The regular expression will be extracted according to this reference.
  7. In MaskIn Mask Column, define the masking of column text by selecting one of the following:
    1. Don't mask (default) - entire column value is displayed
    2. Mask entire column text entire column value is not displayed
    3. Mask part of column text - part of the column value will be masked, use a regular expression and include the part you wish to mask inside a round brackets (). Note all masked values are replaced with six * - regardless of the masked value length.
    Note: 
    1. Admin user will see masking only in administration part, the values cannot be masked from users who are part of the XpoLog Administrators group.
    2. All users with patterns administration permissions (Edit log) will see all values in the patterns administration part.
    3. Users who are restricted from viewing masked data are not able to preform searches on this data, the masked data does not exist from these user's context. 
  8. If this GeoIP field does not appear in all records, select the Optional checkbox. 
  9. Click Apply.
    The log records are refreshed in the bottom pane showing the added field.

...

  1. In Type, select Term.
  2. In Name, type the name of the field (column heading).
  3. To configure advanced settings for the field, click Advanced. Otherwise, continue with step 7.
  4. In MaskIn Mask Column, define the masking of column text by selecting one of the following:
    1. Don't mask (default) - entire column value is displayed
    2. Mask entire column text entire column value is not displayed
    3. Mask part of column text - part of the column value will be masked, use a regular expression and include the part you wish to mask inside a round brackets (). Note all masked values are replaced with six * - regardless of the masked value length.
    Note: 
    1. Admin user will see masking only in administration part, the values cannot be masked from users who are part of the XpoLog Administrators group.
    2. All users with patterns administration permissions (Edit log) will see all values in the patterns administration part.
    3. Users who are restricted from viewing masked data are not able to preform searches on this data, the masked data does not exist from these user's context.
  5. If this string does not appear in all records, select the Optional checkbox. 
  6. Click Apply.
    The log records are refreshed in the bottom pane showing the added field.

...

  1. In Type, select IP Address.
  2. In Name, type the name of the field (column heading).
  3. To configure advanced settings for the field, click Advanced. Otherwise, continue with step 7.
  4. In Mask Column, define the masking of column text by selecting one of the following:
    1. Don't mask (default) - entire column value is displayed
    2. Mask entire column text entire column value is not displayed
    3. Mask part of column text - part of the column value will be masked, use a regular expression and include the part you wish to mask inside a round brackets (). Note all masked values are replaced with six * - regardless of the masked value length.
    Note: 
    1. Admin user will see masking only in administration part, the values cannot be masked from users who are part of the XpoLog Administrators group.
    2. All users with patterns administration permissions (Edit log) will see all values in the patterns administration part.
    3. Users who are restricted from viewing masked data are not able to preform searches on this data, the masked data does not exist from these user's context.
  5. Select the GeoIP checkbox to enable GeoIP for this field. 
  6. If this string does not appear in all records, select the Optional checkbox. 
  7. Click Apply.
    The log records are refreshed in the bottom pane showing the added field.