Exclude, or blocklist, files from the defined source rule(s). Input the relative path of the file(s) to exclude, using wildcards to exclude multiple files.

• Example for a single file:
• Source File: /var/log/**/*.log Exclude Files: cassandra/system.log
• Example for multiple files: Source File: /var/log/**/*.log Exclude Files: */system.log

If no port number is provided, port 514 is used. Both the syslog utility and analytics-agent should have root access to send logs to port 514 (binding to ports less than 1024 requires root access).

This checkbox enables extraction of fields from the path name. Add a grok pattern in the text box.

The syntax for a grok pattern is {%{SYNTAX:SEMANTIC}. For example, to extract AdminSever from /opt/apps/oracle/middleware/user_projects/domains/ouaf_domain1/servers/AdminServer/logs/AdminServer.log, enter the following GROK pattern: servers/%{DATA:servername}/%{GREEDYDATA}, where %{DATA:server} filters the server name and %{GREEDYDATA} filters rest of the message from the log path.

Specify the number of threads that the Analytics Agent will use for log processing. You must specify the thread counts after analyzing the performance of your environment as increased thread counts might impact system resources.

Minimum Value: 5

Maximum Value: 25

Specify the time in seconds that the agent will wait to update a log file. After this time limit, the agent begins monitoring a new log file. The default value is 30 seconds.

Indicate where to begin tailing (collecting the log records). Options are:

• From the beginning of the log file
• From the end of the log file
• A specific time range (in hours) - For example, if you set this to four hours, then when you enable the rule and analytics starts tailing the log data, only the last four hours of data is ingested. When tailing starts, the watermark state is maintained for that file. If the agent is now stopped and restarted, it will start tailing from where it left off for any old file. For new files, it will only tail the last four hours of data.

Use this to override the time zone for eventTimestamp in log events. If your log events don't have a time zone assigned and you are not overriding it, the host machine time zone is assigned to the log events. You cannot override the timezone in the pickupTimestamp field.If you override the time zone, you must provide a timestamp format. Time zone formats should conform to Joda-Time Available Time Zones, and the timestamp format should be created with the Joda-Time formatting system.

You can override the format if needed. Time zone formats should conform to Joda-Time Available Time Zones, and the timestamp format should be created with the Joda-Time formatting system.

• startsWith: A simple prefix that matches the start of the multiline log record.

• regex: A regular expression that matches the multiline log record.

The multiline format is not supported when you are collecting log data from a network connection.

Select a message from the preview grid that is representative of the fields that you want to extract from the log records. You can select only one definer sample per source rule.

Preview

• All
• Matching
• Non-Matching

Use to change the data type of the field. For example, from string to number. Available types are String, Boolean, and Number.

Note that after a source rule has been saved with a field of a specified data type, you cannot later change the data type of that field. Once the fields are indexed in the analytics database trying to specify a new type will cause a validation error.