Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

Operations Connector10.11

Administer > Policies > Structured Log File Policies > Structured Log File Policy User Interface > Configuring Mappings in Structured Log File Policies (Generic Output Only)

Configuring Mappings in Structured Log File Policies (Generic Output Only)

The Mappings page enables you to map the log file input data properties, which are the structural fields extracted from log files, to custom variables.

To access

In the Operations Connector user interface, click in the toolbar. Then click Generic output > Structured Log File.

Alternatively, double-click an existing policy to edit it.

Click Mappings to open the policy Mappings page.

Mappings overview

The key field mapping consists of an input field qualifier, an eligible field name, and a mapped field name. To map the key field, map the eligible field name to the mapped field name. The eligible field name is automatically extracted from the input field qualifier.

Log policies integrate hierarchical data. Therefore, any field to be mapped must be a leaf node in the internal logical tree-like structure. As a result, the eligible field is the last entry in the tree.

For example, if the input data has the structure evt/event_type, the eligible field is event_type. This field is then mapped, for example to the field eventType.

You can add additional fields to data that is sent to Data Forwarding targets. Additional fields are simple key-value pairs and you must manually add both the keys and values. If a defined key field name equals a field name in the mapped data set, it is discarded.

Additional fields are added as immediate children of the highest level element.

The actual field value can consist of user defined strings and data references to the input data (<$DATA:…>).

Example:

Additional Field Name	Additional Field Value
combined_text	At `<$DATA:/evt/time_occured>`, `<$DATA:/evt/event_type>` detected an `<$DATA:/evt/event_impact>` impact on system performance. This has happened `<$DATA:/evt/event_counter>` times.

The data references in the additional field combined_text are replaced when the policy is run. In the above example, after the variables are replaced, the resulting value in the field combined_text is:

At 12/05/2015 14:01:39, Monitoring: Threshold violation detected an substantial impact on system performance. This has happened 8264 times.

Note that data references must refer to the input format, not the mapped format.

Tasks

How to configure mappings for key fields

This task describes how to map key fields.

Create one or more key field mappings.

If you are working with meta data, drag the table column from the Meta Data list to the Input Field Qualifier column. Operations Connector automatically extracts the eligible field name.

Alternatively, click above the Input Field Qualifier column and type the qualifier in the input field qualifier.
Optionally, change the Keep all input fields setting. By default, the option is selected and all fields are kept, regardless whether they are mapped or not. To keep only the mapped fields, deselect the option.
Add any additional fields as required.

Related tasks

How to Collect Generic Output Data from Structured Log Files

UI Descriptions

This section includes:

Key Field Mapping Configuration

Key Field Mapping Configuration

UI Element	Description
	Create new mapping definition. Adds a new mapping definition to the list of mappings.
	Delete mapping definition. Deletes the selected mapping definition.
Input Field Qualifier	Input data property assigned to the custom variable. Operations Connector replaces the pattern matching field at runtime with the value of the specified field. If you insert a value, the value will be used. If you are working with meta data, you can drag and drop a key from the Meta Data tab.
Eligible Field Name	The field that is eligible for mapping. The field is extracted automatically from the Input Field Qualifier. Some sources integrate hierarchical data (XML file, REST WS, and log file). In case of such data, any field to be mapped must be a leaf node in the internal logical tree-like structure.
Mapped Field Name	The replacement for the input field.
Keep All Input Fields	If the option is selected, all input is kept regardless if the mapping does occur or not. If the option is not selected, the fields that are not mapped are dropped.
	New item Adds a new additional, user defined field.
	Delete item. Deletes the additional field.
Field Name	The name of the additional user defined field.
Field Value	The value of the additional user defined field. The value can contain static text defined by the user and data references into the input data (`<$DATA:…>`).
Meta Data tab
Input Data Properties	A list of keys derived from input data. You can drag and drop the keys.

Meta Data tab

UI Element	Description
Input Data Properties	A list of keys derived from input data. You can drag and drop the keys onto the Key Field Mapping table.

Send Help Center feedback