Creating a Pattern Using the Wizard

You can use the wizard to create or modify a pattern use the wizard to add and name columns that represent the structure of the records. The wizard includes features to set different indications on each column, such as type, length, optional, and column name. More information on each type is presented in the wizard itself.

Inserting a Field or Separator

To insert a field:

1. In the Wizard pattern editor, click the + button.
   The Add Field dialog box opens.
2. In Type, select Separator or another field type, such as String, Text, Date, Priority, Choices, Number, Timestamp, New Line, End of Event, GeoIP, IP Address, Term, Free Text, or an Advanced  Option –Regular Expression, Function, Converter, or Google App Engine.
   The parameters that have to be provided for the selected field type are displayed.
3. If you want to configure more parameters for the field, click the Advanced link to open the additional parameters for the selected field type.

4. Complete the parameters, and then click Apply.

Inserting a Separator

 You can insert between log fields one or more spaces or tabs, or any other separator that you choose.

1. In Type, select Separator.
2. In Separator, select Space, Tab, or Custom.
3. If you selected Custom, in Insert separator, type the character to be used as a separator.
4. In Num of repeats, type the number of the selected separator to insert.
5. To configure advanced settings for the separator, click Advanced. Otherwise, continue with step 7.
6. If the selected separator does not appear in all records, select the Optional checkbox.
7. Click Apply.
   The log records are refreshed in the bottom pane with the parsing results.

Note: After clicking Apply, you may get an error, such as The marked field causes the log to be unparsed. In this case, edit or remove the separator.

Inserting a String

 You can insert into a log record a field that has a string value.

1. In Type, select String.
2. In Name, type the name of the field.
3. To configure advanced settings for the field, click Advanced. Otherwise, continue with step    .
4. In UI Message Len
5. In Num of repeats, type the number of the selected separator to insert.
6. If the selected separator does not appear in all records, click Advanced, and then select the Optional checkbox.
7. Click Apply.
   The log records are refreshed in the bottom pane with the parsing results.

Note: After clicking Apply, you may get an error, such as The marked field causes the log to be unparsed. In this case, edit or remove the separator.

Modifying a Field

Removing a Field