Skip to main content
Sumo Logic

Field Extractions

  1. Last updated
  2. Save as PDF

Field extractions allow you to parse fields from your log messages at the time the messages are ingested, which eliminates the need to parse fields at the query level. With Field Extraction Rules (FERs) in place, users can use the pre-parsed fields for ad-hoc searches, scheduled searches, real-time alerts, and dashboards. In addition, field extraction rules help standardize field names and searches, simplify the search syntax and scope definition, and improve search performance. 

Note that fields are extracted from the time you create your FER moving forward. Therefore, set your FERs early on to take advantage of this automatic parsing mechanism.

For best practices on naming your fields, see Field Naming Convention. 

FER page.png

The Manage Data > Logs > Field Extraction Rules page displays the following information: 

  • Status shows a checkmark in a green circle check in green circle.png to indicate if the Rule is actively being applied or an exclamation mark in a red circle exclamation in red circle.png to indicate if the Rule is disabled.
  • Rule Name
  • Applied At indicates when the field extraction process occurs, either at Ingest or Run time.
  • Scope 
  • Created date and time by user
  • Last Modified date and time by user
  • Fields Capacity (bottom of table) shows how many fields your account is using, out of the total available for use.

On the Manage Data > Logs > Field Extraction Rules page you can:

Limitations

Ingest Time FERs have the following limitations.

  • There is a limit of 50 Ingest Time rules and 200 fields. Fields created as log metadata and from Ingest Time rules share the same quota of 200 fields. You can manage your fields on the Fields page.
  • Ingest Time rule expressions are limited to a maximum of 16k (16,384) characters.
  • Ingest Time rules can extract up to a maximum of 16k (16,384) characters for each field.
  • The cumulative size of all fields extracted by a rule for a message/event is limited to 64kb.
  • Ingest Time rules only apply to data moving forward. If you want to parse data ingested before the creation of your Ingest Time FER, you can either parse your data in your query, or create Scheduled Views to extract fields for your historical data.  

Micro Lesson: Field Extraction Rules Basics

Edit a Field Extraction Rule

Changes to Field Extraction Rules are implemented immediately.

  1. In Sumo Logic, go to Manage Data > Logs > Field Extraction Rules.
  2. Find the rule in the table and click it. A window appears on the right of the table, click the Edit button.
  3. Make changes as needed and click Save when done.

Delete a Field Extraction Rule

Deleting a Field Extraction Rule doesn't delete the fields it was parsing. You can delete any unwanted fields on the Fields page.

  1. In Sumo Logic, go to Manage Data > Logs > Field Extraction Rules.
  2. Find the rule to delete in the table and click it. A window appears on the right of the table, click the More Actions button, and select Delete.