Configuration parameters
Use the parameters in this section to configure the . The Telemetry Pipeline web interface uses the items in the Name column to describe these parameters. Pipeline configuration files use the items in the Key column as YAML keys.| Name | Key | Description | Default |
|---|---|---|---|
| Source key | src | Required. The key whose value contains data to parse. | none |
| Destination key | dst | Required. The key of the object to store your structured key/value pairs. This rule can’t overwrite an existing key, so this value must be a unique name within your telemetry data. | none |
| Regex | regex | Required. The regular expression for extracting values from the value of Source key and assigning keys to those values. | none |
| Regex engine | regexEngine | Required. The engine to parse your regular expression. Accepted values: GNU, Oniguruma, PCRE2, POSIX, TRE. | PCRE2 |
| Comment | comment | A custom note or description of the rule’s function. This text is displayed next to the rule’s name in the Actions list in the processing rules interface. | none |
GPT generation
Keep in mind that this feature is experimental, and that Chronosphere can’t guarantee
the accuracy or quality of generated scripts.To enable or disable GPT generation, see
Project settings.
Example
Using the parse processing rule lets you extract any data from a string and turn that data into parsable key/value pairs. You can then use these key/value pairs in other processing rules or for general storage and analysis. For example, given the following sample website logs:log, the Destination key
value parsed, the Regex value
^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>.*)")?$, and the Regex engine
value PCRE2 returns the following result:
log key, assigned a key
to each value, then stored the resulting key/value pairs in a new structured object
named parsed.