Sign in

v1

latestOpenAPI 3.0.02026-08-064311,0881.3 MB
extractionRuleManagement

Get a field extraction rule.

Get a field extraction rule with the given identifier.

get/v1/extractionRules/{id}

Path parameters

idstring required

Identifier of field extraction rule to return.

Response

Extraction rule object that was requested.

namestring required

Name of the field extraction rule. Use a name that makes it easy to identify the rule.

scopestring required

Scope of the field extraction rule. This could be a sourceCategory, sourceHost, or any other metadata that describes the data you want to extract from. Think of the Scope as the first portion of an ad hoc search, before the first pipe ( | ). You'll use the Scope to run a search against the rule.

parseExpressionstring required

Describes the fields to be parsed.

enabledboolean

Is the field extraction rule enabled.

createdAtstring date-time required

Creation timestamp in UTC in RFC3339 format.

createdBystring required

Identifier of the user who created the resource.

modifiedAtstring date-time required

Last modification timestamp in UTC.

modifiedBystring required

Identifier of the user who last modified the resource.

idstring required

Unique identifier for the field extraction rule.

fieldNamesstring[]

List of extracted fields from "parseExpression".

Example response

{
  "name": "ExtractionRule123",
  "scope": "_sourceHost=127.0.0.1",
  "parseExpression": "csv _raw extract 1 as f1",
  "createdAt": "2018-10-16T09:10:00Z",
  "createdBy": "0000000006743FDD",
  "modifiedAt": "2018-10-16T09:10:00Z",
  "modifiedBy": "0000000006743FE8"
}