A representation of a parser extension as a set of field extractors.
JSON representation |
---|
{ "extractors": [ { object ( |
Fields | |
---|---|
extractors[] |
List of FieldExtractors. |
transformed_cbn_snippet |
Output only. CBN snippet generated from field extractors. A base64-encoded string. |
log_format |
Format of the log. Ex. CSV,JSON,XML. |
append_repeated_fields |
Whether to append repeated fields or not. When false, repeated fields will be replaced. |
preprocess_config |
Pre-process configuration. |
FieldExtractor
An extractor for a single log field.
JSON representation |
---|
{
"precondition_path": string,
"precondition_value": string,
"precondition_op": enum ( |
Fields | |
---|---|
precondition_path |
Precondition path could be a json path, xml path or csv column name depending on log format. It refers to a section or substring in raw log. |
precondition_value |
Precondition value. |
precondition_op |
Operator used for precondition. |
field_path |
Field path could be a json path, xml path or csv column name depending on log format. It refers to a section or substring in raw log. This is required if the FieldExtractor is used to specify the parser extension. |
destination_path |
Path in generated event which is to be populated. This is required if the FieldExtractor is used to specify the parser extension. |
value |
Value to be mapped to the destination path directly. |
ComparisonOperator
Comparison operator used in precondition field.
Enums | |
---|---|
COMPARISON_OPERATOR_UNSPECIFIED |
Comparison operator was unspecified. |
EQUALS |
Comparison operator is equals "==". |
NOT_EQUALS |
Comparison operator is not equals. |
LogFormat
Log format of the raw log. valid log formats are JSON, XML and CSV.
Enums | |
---|---|
LOG_FORMAT_UNSPECIFIED |
Log format was unspecified. |
JSON |
Log format was JSON. |
CSV |
Log format was CSV. |
XML |
Log format was XML. |
PreProcessConfig
PreProcessConfig holds the GROK expression to extract the syslog header.
JSON representation |
---|
{ "grok_regex": string, "target": string } |
Fields | |
---|---|
grok_regex |
GROK Regex to extract the structured part of the log. syntax documentation: www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html |
target |
Target field name for the structured part of the log. This should match a SEMANTIC identifier from the grok expression. |