Sign in

v1

latestOpenAPI 3.0.02026-08-064311,0881.3 MB
eventAnalytics

Update an event extraction rule.

Update an event extraction rule.

put/v1/eventExtractionRules/{id}

Path parameters

idstring required

The identifier of the event extraction rule.

Request body

namestring required

Name of event extraction rule.

descriptionstring

Description of event extraction rule.

querystring required

Query string for the Event Extraction Rule. Logs matching this query are periodically ingested into the sumologic_userdata_events index (Events).

Guidelines for creating the query:

  • Optimize the query to limit the number of returned log messages (intended for special logs only).
  • The query runs in Manual mode, explicitly parse and extract only the necessary fields for event correlation and visualization.
  • Use the fields operator to restrict the output to required fields.
configurationobject required

Configuration for the Event Extraction Rule.

This object defines how event fields are mapped to their corresponding values. Each field specifies a valueSource, which provides the actual value, and an optional mappingType, indicating the value is hardcoded.

The following fields are required:

  • eventType: Type of the event. Accepted values are Deployment, Feature Flag Change, Configuration Change or Infrastructure Change.
  • eventPriority: Indicates the priority of the event. Accepted values are High, Medium, or Low.
  • eventSource: Source system or component where the event originated (e.g., "Jenkins").
  • eventName: Descriptive name of the event (e.g., "monitor-manager deployed.").

The following fields are optional:

  • eventDescription: Additional context or details about the event.

Custom fields can also be added as needed to capture domain-specific event data.

Example request

{
  "name": "foo",
  "description": "foo",
  "query": "_sourceCategory=eventSource",
  "correlationExpression": {
    "queryFieldName": "_sourcecategory",
    "eventFieldName": "foo",
    "stringMatchingAlgorithm": "ExactMatch"
  },
  "configuration": {
    "eventType": {
      "valueSource": "Deploy",
      "mappingType": "HardCoded"
    },
    "eventPriority": {
      "valueSource": "High",
      "mappingType": "HardCoded"
    },
    "eventSource": {
      "valueSource": "Jenkins",
      "mappingType": "HardCoded"
    },
    "eventName": {
      "valueSource": "monitor-manager deployed.",
      "mappingType": "HardCoded"
    },
    "eventDescription": {
      "valueSource": "2 containers in monitor-manager were upgraded.",
      "mappingType": "HardCoded"
    }
  }
}

Response

The event extraction rule was updated.

namestring required

Name of event extraction rule.

descriptionstring

Description of event extraction rule.

querystring required

Query string for the Event Extraction Rule. Logs matching this query are periodically ingested into the sumologic_userdata_events index (Events).

Guidelines for creating the query:

  • Optimize the query to limit the number of returned log messages (intended for special logs only).
  • The query runs in Manual mode, explicitly parse and extract only the necessary fields for event correlation and visualization.
  • Use the fields operator to restrict the output to required fields.
configurationobject required

Configuration for the Event Extraction Rule.

This object defines how event fields are mapped to their corresponding values. Each field specifies a valueSource, which provides the actual value, and an optional mappingType, indicating the value is hardcoded.

The following fields are required:

  • eventType: Type of the event. Accepted values are Deployment, Feature Flag Change, Configuration Change or Infrastructure Change.
  • eventPriority: Indicates the priority of the event. Accepted values are High, Medium, or Low.
  • eventSource: Source system or component where the event originated (e.g., "Jenkins").
  • eventName: Descriptive name of the event (e.g., "monitor-manager deployed.").

The following fields are optional:

  • eventDescription: Additional context or details about the event.

Custom fields can also be added as needed to capture domain-specific event data.

idstring required

Id of the event extraction rule.

createdAtstring date-time

Creation timestamp in UTC in RFC3339 format.

createdBystring

Identifier of the user who created the resource.

modifiedAtstring date-time

Last modification timestamp in UTC.

modifiedBystring

Identifier of the user who last modified the resource.

enabledboolean

Flag indicating whether the event extraction rule is enabled or disabled.

disableReasonstring

Reason for disabling the event extraction rule, if applicable.

Example response

{
  "name": "foo",
  "description": "foo",
  "query": "_sourceCategory=eventSource",
  "correlationExpression": {
    "queryFieldName": "_sourcecategory",
    "eventFieldName": "foo",
    "stringMatchingAlgorithm": "ExactMatch"
  },
  "configuration": {
    "eventType": {
      "valueSource": "Deploy",
      "mappingType": "HardCoded"
    },
    "eventPriority": {
      "valueSource": "High",
      "mappingType": "HardCoded"
    },
    "eventSource": {
      "valueSource": "Jenkins",
      "mappingType": "HardCoded"
    },
    "eventName": {
      "valueSource": "monitor-manager deployed.",
      "mappingType": "HardCoded"
    },
    "eventDescription": {
      "valueSource": "2 containers in monitor-manager were upgraded.",
      "mappingType": "HardCoded"
    }
  },
  "id": "0000000001213227",
  "enabled": true,
  "disableReason": "Event Extraction Rule output exceeded maximum allowed rate of 1000 events per hour in last 24 hours."
}