Sign in

v1

latestOpenAPI 3.0.02026-08-064311,0881.3 MB
extractionRuleManagement

Create a new field extraction rule.

Create a new field extraction rule.

post/v1/extractionRules

Request body

namestring required

Name of the field extraction rule. Use a name that makes it easy to identify the rule.

scopestring required

Scope of the field extraction rule. This could be a sourceCategory, sourceHost, or any other metadata that describes the data you want to extract from. Think of the Scope as the first portion of an ad hoc search, before the first pipe ( | ). You'll use the Scope to run a search against the rule.

parseExpressionstring required

Describes the fields to be parsed.

enabledboolean

Is the field extraction rule enabled.

Example request

{
  "name": "ExtractionRule123",
  "scope": "_sourceHost=127.0.0.1",
  "parseExpression": "csv _raw extract 1 as f1"
}

Response

The field extraction rule has been created.

namestring required

Name of the field extraction rule. Use a name that makes it easy to identify the rule.

scopestring required

Scope of the field extraction rule. This could be a sourceCategory, sourceHost, or any other metadata that describes the data you want to extract from. Think of the Scope as the first portion of an ad hoc search, before the first pipe ( | ). You'll use the Scope to run a search against the rule.

parseExpressionstring required

Describes the fields to be parsed.

enabledboolean

Is the field extraction rule enabled.

createdAtstring date-time required

Creation timestamp in UTC in RFC3339 format.

createdBystring required

Identifier of the user who created the resource.

modifiedAtstring date-time required

Last modification timestamp in UTC.

modifiedBystring required

Identifier of the user who last modified the resource.

idstring required

Unique identifier for the field extraction rule.

fieldNamesstring[]

List of extracted fields from "parseExpression".

Example response

{
  "name": "ExtractionRule123",
  "scope": "_sourceHost=127.0.0.1",
  "parseExpression": "csv _raw extract 1 as f1",
  "createdAt": "2018-10-16T09:10:00Z",
  "createdBy": "0000000006743FDD",
  "modifiedAt": "2018-10-16T09:10:00Z",
  "modifiedBy": "0000000006743FE8"
}