Field Extractions
Field extractions allow you to parse fields from your log messages at the time the messages are ingested, which eliminates the need to parse fields at the query level. With Field Extraction Rules (FERs) in place, users can use the pre-parsed fields for ad-hoc searches, scheduled searches, real-time alerts, and dashboards. In addition, field extraction rules help standardize field names and searches, simplify the search syntax and scope definition, and improve search performance.
Note that fields are extracted from the time you create your FER moving forward. Therefore, set your FERs early on to take advantage of this automatic parsing mechanism.
For best practices on naming your fields, see Field Naming Convention.
The Manage Data > Logs > Field Extraction Rules page displays the following information:
- Status shows a checkmark in a green circle
to indicate if the Rule is actively being applied or an exclamation mark in a red circle
to indicate if the Rule is disabled.
- Rule Name
- Applied At indicates when the field extraction process occurs, either at Ingest or Run time.
- Scope
- Created date and time by user
- Last Modified date and time by user
- Fields Capacity (bottom of table) shows how many fields your account is using, out of the total available for use.
On the Manage Data > Logs > Field Extraction Rules page you can:
- Click + Add to create a Field Extraction Rule.
- Search Field Extraction Rules by name and scope.
- Edit a Field Extraction Rule
- Disable a Field Extraction Rule
- Delete a Field Extraction Rule
Micro Lesson: Field Extraction Rules Basics
Edit a Field Extraction Rule
Changes to Field Extraction Rules are implemented immediately.
- In Sumo Logic, go to Manage Data > Logs > Field Extraction Rules.
- Find the rule in the table and click it. A window appears on the right of the table, click the Edit button.
- Make changes as needed and click Save when done.
Delete a Field Extraction Rule
Deleting a Field Extraction Rule doesn't delete the fields it was parsing. You can delete any unwanted fields on the Fields page.
- In Sumo Logic, go to Manage Data > Logs > Field Extraction Rules.
- Find the rule to delete in the table and click it. A window appears on the right of the table, click the More Actions button, and select Delete.