Enterprise SIEM, Centralized Log Management, Security, Compliance, Server Monitoring and Uptime Monitoring Software
Table of Contents

Define Log Entry Columns

The Columns Tab, found within both Log Consolidation and Log Monitor template properties views, enables you to extract values from log entries then, in the case of log consolidation, save those values to custom columns in your log repository database. Log Monitors use the column definitions to extract key value pairs before applying filters.

Depending on the type of log you are monitoring, different options for extracting key value pairs are utilized.

Log TypeDescriptionHelp Link
Event LogsUses Regular Expressions to extract values.Define Log Entry Columns with Regular Expressions
SyslogsUses Regular Expressions to extract values.Define Log Entry Columns with Regular Expressions
Text LogsUses Regular Expressions to extract values.Define Log Entry Columns with Regular Expressions
CSV FilesScans rows using column definitions.Define Log Entry Columns with Separated Values
W3C LogsScans rows using column definitions.Define Log Entry Columns with Separated Values

To define column definitions:

  • From the Column Definitions List, click the Add button. A new line is added to the list.
  • Each column definition includes the following configurable parameters:
    ParameterDescription
    EnabledEnables or disables the column from the result set.
    KeyDefines the value's key for log monitor filters and defines the column name for log consolidation database tables.
    NameDefines the display value for the column.
    Data TypeDefines the value's data type for log monitor filters and defines the column data type for log consolidation database tables.
    Column SizeWhen applied to a log consolidation template, defines the maximum size for a string column.
    IndexWhen applied to a log consolidation template, creates a database index for the column.
  • Use the Up Button and Down Button to reorder the column definitions.
    Multiple regular expressions enable you to test for different key value pairs. If the same key exists for multiple regular expression results, the last matching regular expression in the list is applied to the result set.

The following data types are supported:

Data TypeDescription
boolA Boolean value, which can be either true or false.
byteUnsigned 8-bit integer
shortSigned 16-bit integer
intSigned 32-bit integer
longSigned 64-bit integer
ushortUnsigned 16-bit integer
uintUnsigned 32-bit integer
ulongUnsigned 64-bit integer
DateTimeA DateTime value that is parsed from a string using the current locale.
TimeSpanA TimeSpan value that is parsed from a string using the current locale.
floatA 4-byte floating point value.
doubleAn 8-byte floating point value.
decimalA 16-byte floating point value.
LevelAn internal data type for mapping verbose log message level integer values to Levels (e.g. Info, Notice, Critical and Error).
File System SizeUnsigned 64-bit integer that is formatted to a file system size string value (e.g. 1 GB).
PercentSigned 32-bit integer that is formatted to a percent string value.
GaugeSigned 32-bit integer that is formatted to a percent then displays as a percentage graphic.

Related Topics

Define Log Entry Columns with Regular Expressions

Define Log Entry Columns with Separated Values

Log Management Templates

Filters