You can configure the rules for converting incoming events to the KUMA format when creating event parsing rules in the normalizer settings window, on the Normalization scheme tab.
Available settings:
This setting is not available for extra parsing rules.
Available parsing methods:
Raw
field of the normalized event if errors occurred when parsing it. This value is convenient to use when debugging a service. In this case, every time an event has a non-empty Raw
field, you know there was a problem.If fields containing the names *Address
or *Date*
do not comply with normalization rules, these fields are ignored. No normalization error occurs in this case, and the values of the fields are not displayed in the Raw
field of the normalized event even if the Keep raw event → Only errors option was selected.
Raw
field of the normalized event.This setting is not available for extra parsing rules.
Extra
event field. Normalized events can be searched and filtered based on the data stored in the Extra
field.Filtering based on data from the Extra event field
By default, no extra fields are saved.
This setting is not available for extra parsing rules.
This setting is not available for the following parsing methods: netflow5, netflow9, sflow5, ipfix, sql.
The Event examples field is populated with data obtained from the raw event if the event was successfully parsed and the type of data obtained from the raw event matches the type of the KUMA field.
For example, the value "192.168.0.1" enclosed in quotation marks is not displayed in the SourceAddress field, in this case the value 192.168.0.1 is displayed in the Event examples field.
Clicking the button next to the field names in the Source column opens the Conversion window, in which you can use the Add conversion button to create rules for modifying the original data before they are written to the KUMA event fields. In the Conversion window, you can swap the added rules by dragging them by the icon; you can also delete them using the icon.
DeviceCustom*
and Flex*
.New table rows can be added by using the Add row button. Rows can be deleted individually using the button or all at once using the Clear all button.
If you have loaded data into the Event examples field, the table will have an Examples column containing examples of values carried over from the raw event field to the KUMA event field.
If the size of the KUMA event field is less than the length of the value placed in it, the value is truncated to the size of the event field.
Extended event schema
When normalizing events, extended event schema fields can be used in addition to standard KUMA event schema fields. Information about the types of extended event schema fields is shown in the table below.
Using many unique fields of the extended event schema can reduce the performance of the system, increase the amount of disk space required for storing events, and make the information difficult to understand.
We recommend consciously choosing a minimal set of additional fields of the extended event schema that you want to use in normalizers and correlation.
To use extended event schema fields:
Fields of the extended data model of normalized events:
Field name Specified in the KUMA field setting |
Data type |
Availability in the normalizer |
Description |
---|---|---|---|
S.< |
String |
All types |
Field of the "String" type |
N.< |
Number |
All types |
Field of the "Number" type |
F.< |
Float |
All types |
Field of the "Float" type |
SA.< |
Array of strings |
KV, JSON |
Field of the "Array of strings" type The order of the array elements is the same as the order of the elements of the raw event. |
NA.< |
Array of integers |
KV, JSON |
A field of the "Array of integers" type. The order of the array elements is the same as the order of the elements of the raw event. |
FA.< |
Array of floats |
KV, JSON |
Field of the "Array of floats" type The order of the array elements is the same as the order of the elements of the raw event. |
The prefixes "S.", "N.", "F.", "SA.", "NA.", "FA." are required when creating fields of the extended event schema; the prefixes must be strictly uppercase.
Replace <field name> with the field name. You may use letters of the English alphabet and numerals in the field name. The space character is not allowed.
The normalizer is saved, and the additional field is created. After saving the normalizer, the additional field can be used in other normalizers.
Note: If the data in the fields of the raw event does not match the type of the KUMA field, the value is not saved during the normalization of events. For example, the string "test" cannot be written to the DeviceCustomNumber1 KUMA field of the Number type.
If you want to minimize the load on the storage server when searching events, preparing reports, and performing other operations on events in storage, use KUMA event schema fields as your first preference, extended event schema fields as your second preference, and the Extra fields as your last resort.
Page top