Administer > Policies > Structured Log File Policies > Structured Log File Policy User Interface > Configuring Mappings in Structured Log File Policies (Generic Output Only)

Configuring Mappings in Structured Log File Policies (Generic Output Only)

The Mappings page enables you to map the log file input data properties, which are the structural fields extracted from log files, to custom variables.

To access

  • In the Operations Connector user interface, click Create in the toolbar. Then click Generic output > Log file Structured Log File.

Alternatively, double-click an existing policy to edit it.

Click Mappings to open the policy Mappings page.

Mappings overview

The key field mapping consists of an input field qualifier, an eligible field name, and a mapped field name. To map the key field, map the eligible field name to the mapped field name. The eligible field name is automatically extracted from the input field qualifier.

Log policies integrate hierarchical data. Therefore, any field to be mapped must be a leaf node in the internal logical tree-like structure. As a result, the eligible field is the last entry in the tree.

For example, if the input data has the structure evt/event_type, the eligible field is event_type. This field is then mapped, for example to the field eventType.

You can add additional fields to data that is sent to Data Forwarding targets. Additional fields are simple key-value pairs and you must manually add both the keys and values. If a defined key field name equals a field name in the mapped data set, it is discarded.

Additional fields are added as immediate children of the highest level element.

The actual field value can consist of user defined strings and data references to the input data (<$DATA:…>).

Example:

Additional Field Name

Additional Field Value

combined_text At <$DATA:/evt/time_occured>, <$DATA:/evt/event_type> detected an <$DATA:/evt/event_impact> impact on system performance. This has happened <$DATA:/evt/event_counter> times.

The data references in the additional field combined_text are replaced when the policy is run. In the above example, after the variables are replaced, the resulting value in the field combined_text is:

At 12/05/2015 14:01:39, Monitoring: Threshold violation detected an substantial impact on system performance. This has happened 8264 times.

Note that data references must refer to the input format, not the mapped format.

Tasks

How to configure mappings for key fields

This task describes how to map key fields.

  1. Create one or more key field mappings.

    If you are working with meta data, drag the table column from the Meta Data list to the Input Field Qualifier column. Operations Connector automatically extracts the eligible field name.

    Alternatively, click above the Input Field Qualifier column and type the qualifier in the input field qualifier.

  2. Optionally, change the Keep all input fields setting. By default, the option is selected and all fields are kept, regardless whether they are mapped or not. To keep only the mapped fields, deselect the option.

  3. Add any additional fields as required.

Related tasks

UI Descriptions

This section includes:

Key Field Mapping Configuration

UI Element Description
Create new mapping definition. Adds a new mapping definition to the list of mappings.
Delete mapping definition. Deletes the selected mapping definition.
Input Field Qualifier

Input data property assigned to the custom variable.

Operations Connector replaces the pattern matching field at runtime with the value of the specified field. If you insert a value, the value will be used.

If you are working with meta data, you can drag and drop a key from the Meta Data tab.

Eligible Field Name

The field that is eligible for mapping. The field is extracted automatically from the Input Field Qualifier.

Some sources integrate hierarchical data (XML file, REST WS, and log file). In case of such data, any field to be mapped must be a leaf node in the internal logical tree-like structure.

Mapped Field Name The replacement for the input field.
Keep All Input Fields

If the option is selected, all input is kept regardless if the mapping does occur or not. If the option is not selected, the fields that are not mapped are dropped.

New item Adds a new additional, user defined field.
Delete item. Deletes the additional field.
Field Name

The name of the additional user defined field.

Field Value

The value of the additional user defined field. The value can contain static text defined by the user and data references into the input data (<$DATA:…>).

Meta Data tab

Input Data Properties A list of keys derived from input data. You can drag and drop the keys.

Meta Data tab

UI Element Description
Input Data Properties A list of keys derived from input data. You can drag and drop the keys onto the Key Field Mapping table.