NXLog User Guide
- OS Support
- Enterprise Edition Reference Manual
- NXLog Manager
- NXLog Add-Ons
There is one thing common in all event log messages. All contain important data such as user names, IP addresses, application names, etc. This way an event can be represented as a list of key-value pairs which we call a "field". The name of the field is the key and the field data is the value. In another terminology this meta-data is sometimes referred to as event property or message tag.
As NX-Log4ensics and NXLOG operate with a set of fields belonging to a log message, it is important to manage these as well. Fields in NX-Log4ensics are typed, this allows complex operations and efficient storage of event log data. All of the major components depend on fields and these are used in various places in Log4ensics, including Patters, Correlation and Agent configuration.
Log4ensics comes with a set of predefiend fields which should be enough for the general cases but can be extended to suit custom requirements.
To list the available fields, click on the LIST FIELDS menu item under the PATTERN menu. A list similar to the following should appear:
The field properties will be explained shortly as we look at creating and modifying fields. To do this, click on Create or Edit under the field list.
The field properties are as follows:
The name of the field will be used to refer to the field from various places in Log4ensics and nxlog.
The following types can be chosen for a field:
If this option is not enabled, field values will be only available to the nxlog agent for correlation, pattern matching. Fields should be persisted if the information is needed in additional functions.
This is a special property and only takes effect when the field is persistent and is a string type. The lookup property should be enabled for fields whose values are highly repetitive such as user names, enumerations, host names etc. This enables the storage engine to map the value to an integer which yields significant compression and performance boost.
The description is only used as an information about the field.
The field list is keept in the configuration database.