Labels
Last updated
Was this helpful?
Last updated
Was this helpful?
Use Onum's labels to cut out the noise with filters and search criteria based on specific metadata. This way, you can categorize the events that Listeners receive before being processed in your Pipelines.
As different log formats are being ingested in real-time, the same Listener may ingest different technologies. Labels are useful for categorizing events based on specific criteria.
When creating or editing a Listener, use Labels to categorize and assign filters to your data.
For most Listeners, you will see two main event categories on this screen:
All Data - Events that follow the structure defined by the specified protocol, for example, Syslog events with the standard fields, or most of them.
Unparsed - These are events that do not follow the structure defined in the selected protocol.
You can define filters and rules for each of these main categories.
Once you've defined your labels to filter specific events, you can use them in your Pipelines.
Instead of using the whole set of events that come into your Listeners, you can use your defined labels to use only specific sets of data filtered by specific rules.
When you create a new Listener, you'll be prompted to the Labels screen after configuring your Listener data.
Click the + button under the set of data you want to filter (All Data or Unparsed). You'll see your first label. Click the pencil icon a give it a name that describes the data that will filter out.
In this example, we want to filter only events whose version is 2.x
, so we named our label accordingly:
Below, see the Add filter button. This is where you add the criteria to categorize the content under that label. Choose the field you want to filter by.
In this example, we're choosing Version
.
Now, define the filter criteria:
Condition - Choose between:
Contains - Checks when the indicated value appears anywhere in the log.
Equals - Filters for exact matches of the value in the log.
Matches - Filters for exact matches of the value in the log, allowing for regular expressions.
Value - Enter the value to filter by.
In this example, we are setting the Condition to Contains
and Value to 2
.
Click Save and see the header appear for your first label.
From here, you have various options:
To create a new subset of data, select the + sign that extends directly from the All data or Unparsed bars. Be aware that if you select the + sign extending from the header bar, you will create a subheader.
You can create a branch from your primary header by clicking the plus button that extends from the main header. There is no limit to the amount that you can add.
Notice that the subheader shows a filter icon with a number next to it to indicate the string of filters applied to it already.
To duplicate a label, simply select the duplicate button in its row.
To delete a label, simply select the delete button in its row.
If you attempt to delete a Label that is being used in a Pipeline, you will be asked to confirm where to remove it from.
Once you have completed your chain, click Save.
Any data that has not been assigned a label will be automatically categorized as unlabeled. This allows you to see the data that is not being processed by any Pipeline, but has not been lost.
This label will appear in the list of Labels for use in your Pipeline so that you can process the data in its unfiltered form.
Your Listener is now ready to use and will appear in the list.