Skip to main content
During the ingestion phase, after parsing your data, Chronosphere Observability Platform applies your preferred field normalization rules to populate predefined keys such as service, severity, and timestamp. This mapping provides consistency in your data, and optimizes querying in Logs Explorer. After applying these mappings, Observability Platform applies control rules, and then stores your log data. In addition to these mappings, you can apply custom field mappings to normalize log data. For example, you can normalize values from several fields that all relate to different environments, such as environment and region. You can then add optional mappings for individual environments, such as mapping dev to development, which standardizes and enriches your log data. 
"custom_field_normalization": [
        {
          "target": "environment",
          "normalization": {
            "source": [
              {
                "selector": "env"
              },
              {
                "selector": "region"
              }
            ],
            "default_value": "production",
            "value_map": {
              "dev": "development",
              "prod": "production",
              "stg": "staging"
            }
          }
        }
    ...
]
Custom field mappings are applied after log data is ingested, but before Observability Platform stores it.

​
View custom field mappings

Select from the following methods to view custom field mappings.
To view custom field mappings:
  1. In the navigation menu, click Go to Admin and then select Control > Logs Parsing and Mapping. All field mappings display in the Field Normalization section, including both predefined and custom field mappings.
  2. Choose which custom field mappings to view:
    • To view an individual custom field mapping, click it in the list to open the configuration in the Field normalization drawer.
    • To view the code definition for all configured custom field mappings, click the Code Config tab.

​
Create custom field mappings

Use one of the following methods to create custom field mappings.
Define the custom field mapping definition in Observability Platform, and then use the Code Config tool to apply the definition.
  1. In the navigation menu, click Go to Admin and then select Control > Logs Parsing and Mapping.
  2. In the Field Normalization section, click Create custom field mapping.
  3. Enter the custom field name to map data to, such as environment, region, or userID.
  4. In the Mapped fields field, enter field names from your log data to map to the custom field you’re creating. Fields are matched in priority order.
  5. In the Default value field, enter a default value as the mapping if the custom field contains no values.
  6. Optionally, select either Regex or Value map as the normalization mode:
    • Regex: Enter a regular expression pattern to extract and normalize values, such as for removing extraneous data. For example, use the following regular expression to remove prefixes and suffixes from any environments including production in the name: 
      ^.*?(production).*?$
    • Value map: Enter key:value pairs to map additional metadata within your custom field. For example, map "warn" to "Warning" and "err" to "Error" for different severity types.
  7. Click Save to save the custom field mapping definition.
  8. Click the Code config tab and use the Code Config tool to apply your changes.

​
Edit custom field mappings

When creating or editing a custom field mapping, you can use the Code Config tool to view code representations of a field mapping. The displayed code also responds to changes you make in the Visual editor tab. Select from the following methods to edit custom field mappings.
  1. In the navigation menu, click Go to Admin and then select Control > Logs Parsing and Mapping.
  2. In the Field Normalization section, click the custom field mapping you want to edit.
  3. In the Field normalization drawer, make changes to your custom field mapping, and then click Save. Observability Platform saves changes to your custom field mapping.
  4. Click the Code config tab and use the Code Config tool to apply your changes.

​
Delete custom field mappings

Select from one of the following methods to delete custom field mappings.
  1. In the navigation menu, click Go to Admin and then select Control > Logs Parsing and Mapping.
  2. In the Field Normalization section, click the custom field mapping you want to delete.
  3. Click Delete custom field mapping to delete the selected field mapping.
Observability Platform deletes your custom field mapping.