Add Custom Definition
Last updated
Last updated
Before adding new Custom definition, you should create a new custom definition entry.
1. Click to Custom Definition on the left pane.
2. On the Custom Definitions Management screen, click Add (+) button on the right top section.
3. Select type of Server.
4. Fields will change based on the type.
File Based server type includes Windows (Server), Windows (Workstation), Linux (Server), Linux (Workstation)
Refer to the following table to understand the fields in the above screen.
Event based server type includes Windows (Server), Windows (Workstation)
Refer to the following table to understand the fields in the above screen.
Refer to the following table to understand the fields in the above screen.
As an example, the CSV format should be like this. You should fill the name and oid values.
You can use "1" instead of "String"
You can use "2" instead of "Integer"
"Name1","oidvalue1","String"
"Name2","oidvalue2","Integer"
Example:
Name1,1.3.6.1.4.1.11096.6.1.1.1.2.1.6,1
Name2,1.3.6.1.4.1.11096.6.1.1.1.2.1.7,2
Refer to the following table to understand the fields in the above screen.
Stream Based server type includes TCP, UDP, HTTP, SMTP
Refer to the following table to understand the fields in the above screen.
Refer to the following table to understand the fields in the above screen.
Refer to the following table to understand the fields in the above screen.
Stream Based queue systems includes Redis, Kafka, RabbitMQ, Nats
Refer to the following table to understand the fields in the above screen.
Refer to the following table to understand the fields in the above screen.
Refer to the following table to understand the fields in the above screen.
Refer to the following table to understand the fields in the above screen.
The scripts should be located under the package/scripts
directory within the directory found by the agent. If the package/scripts
directory does not exist, please create it.
Refer to the following table to understand the fields in the above screen.
5. After adding fields of the custom definition, additional configuration can be added from advance settings for some of the types.
1) Select a proper time zone mode.
Use time zone from log file. If none is detected use
Ignore time zone from log file and instead use
2) Select a proper time zone from dropdown.
Sometimes log files can contain different types of date format. Custom date format can be added from this field.
Example 1:
Date: 2022-09-06 05:48:20
Pattern: \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}
Date Format: YYYY-MM-DD HH:mm:ss
Example 2:
Date: 202209060548
Pattern: \d{12}n
Date Format: YYYYMMDDHHmm
Example 3:
Date: 05:48 06.09.2022
Pattern: \d{2}:\d{2} \d{4}-\d{2}-\d{2}
Date Format: YYYYMMDDHHmm
Sometimes log files can contain different types of field formats. Custom field parser can be added from this field. After adding a sample you will see data columns under the sample field. Columns can be selected.
Example 1:
Example 2:
Example 3:
Regex can be written for parse the line
Example:
There are two modes in this part. Users can write any word or regex.
Example:
There are two modes in this part. Users can write any word or regex.
Select a proper reader mode.
Ingest all except matched lines: Shows logs that contain written pattern.
Ingest only matched lines: Shows logs that do not contain written pattern.
Click Add button
Example:
You should add (*) to beginning and end of the expression.
Example: *error*
This is the process of converting data from one format or representation to another. For example, in computing, encoding can refer to converting text characters into binary code for storage or transmission, such as ASCII or UTF-8 encoding.
Select a proper encoding type from dropdown.
6. After adding all required fields click SUBMIT.
Fields | Description |
---|---|
Fields | Descriptions |
---|---|
Fields | Descriptions |
---|---|
Fields | Descriptions |
---|---|
Fields | Descriptions |
---|---|
Fields | Descriptions |
---|---|
Fields | Descriptions |
---|---|
Fields | Descriptions |
---|---|
Fields | Descriptions |
---|---|
Fields | Descriptions |
---|---|
Fields | Descriptions |
---|---|
Fields | Descriptions |
---|---|