Skip to content

Commit 4d9206f

Browse files
updating FER section
1 parent a44f0ee commit 4d9206f

File tree

10 files changed

+11
-204
lines changed

10 files changed

+11
-204
lines changed

docs/integrations/amazon-aws/dynamodb.md

Lines changed: 1 addition & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -113,20 +113,7 @@ The “**tablename**” field will be created.
113113

114114
### Field Extraction Rule(s)
115115

116-
Create Field Extraction Rule for CloudTrail Logs. Learn how to create Field Extraction Rule [here](/docs/manage/field-extractions/create-field-extraction-rule).
117-
118-
```sql
119-
Rule Name: AwsObservabilityDynamoDBCloudTrailLogsFER
120-
Applied at: Ingest Time
121-
Scope (Specific Data):
122-
account=* eventname eventsource "dynamodb.amazonaws.com"
123-
Parse Expression:
124-
| json "eventSource", "awsRegion", "requestParameters.tableName", "recipientAccountId" as eventSource, region, tablename, accountid nodrop
125-
| where eventSource = "dynamodb.amazonaws.com"
126-
| "aws/dynamodb" as namespace
127-
| tolowercase(tablename) as tablename
128-
| fields region, namespace, tablename, accountid
129-
```
116+
Field Extraction Rule for CloudTrail Logs are automatically created for Database Application Components named as **AwsObservabilityDynamoDBCloudTrailLogsFER**.
130117

131118

132119
### Centralized AWS CloudTrail Log Collection

docs/integrations/databases/cassandra.md

Lines changed: 1 addition & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -263,26 +263,7 @@ Pivoting to Tracing data from Entity Inspector is possible only for “Cassandra
263263
5. Sumo Logic Kubernetes collection will automatically start collecting logs from the pods having the annotations defined above.
264264
6. Verify logs in Sumo Logic.
265265

266-
3. Add an FER to normalize the fields in Kubernetes environments. Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, we need to create a Field Extraction Rule if not already created for Proxy Application Components. This step is not needed if one is using application components solution terraform script. To do so:
267-
1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**.
268-
2. Click the **+ Add** button on the top right of the table.
269-
3. The **Add Field Extraction Rule** form will appear:
270-
4. Enter the following options:
271-
* **Rule Name**. Enter the name as **App Observability - Database**.
272-
* **Applied At.** Choose **Ingest Time**
273-
* **Scope**. Select **Specific Data**
274-
* **Scope**: Enter the following keyword search expression:
275-
```sql
276-
pod_labels_environment=* pod_labels_component=database pod_labels_db_system=* pod_labels_db_cluster=*
277-
```
278-
* **Parse Expression**. Enter the following parse expression:
279-
```sql
280-
if (!isEmpty(pod_labels_environment), pod_labels_environment, "") as environment
281-
| pod_labels_component as component
282-
| pod_labels_db_system as db_system
283-
| if (!isEmpty(pod_labels_db_cluster), pod_labels_db_cluster, null) as db_cluster
284-
```
285-
5. Click **Save** to create the rule.
266+
3. **FER to normalize the fields in Kubernetes environments.** Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, we will have Field Extraction Rule automatically created for Database Application Components named as **AppObservabilityCassandraDatabaseFER**.
286267

287268
</TabItem>
288269
<TabItem value="non-k8s">

docs/integrations/databases/couchbase.md

Lines changed: 1 addition & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -199,28 +199,7 @@ This section explains the steps to collect Couchbase logs from a Kubernetes envi
199199
```
200200
5. Sumo Logic Kubernetes collection will automatically start collecting logs from the pods having the annotations defined above.
201201
6. Verify logs in Sumo Logic.
202-
3. **Add a FER to normalize the fields in Kubernetes environments**. This step is not needed if using application components solution terraform script. Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, we need to create a Field Extraction Rule if not already created for Proxy Application Components. To do so:
203-
1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**.
204-
2. Click the **+ Add Rule** button on the top right of the table.
205-
3. The **Add Field Extraction Rule** form will appear:
206-
4. Enter the following options:
207-
* **Rule Name**. Enter the name as **App Observability - Proxy**.
208-
* **Applied At.** Choose **Ingest Time**
209-
* **Scope**. Select **Specific Data**
210-
* **Scope**: Enter the following keyword search expression:
211-
```sql
212-
pod_labels_environment=* pod_labels_component=database \
213-
pod_labels_db_cluster=* pod_labels_db_system=*
214-
```
215-
* **Parse Expression**. Enter the following parse expression:
216-
```sql
217-
if (!isEmpty(pod_labels_environment), pod_labels_environment, "") as environment
218-
| pod_labels_component as component
219-
| pod_labels_db_system as db_system
220-
| pod_labels_db_cluster as db_cluster
221-
| if (!isEmpty(pod_labels_db_cluster), pod_labels_db_cluster, null) as db_cluster
222-
```
223-
5. Click **Save** to create the rule.
202+
3. **FER to normalize the fields in Kubernetes environments.** Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, we will have Field Extraction Rule automatically created for Database Application Components named as **AppObservabilityCouchbaseDatabaseFER**.
224203

225204
</TabItem>
226205
<TabItem value="non-k8s">

docs/integrations/databases/mariadb.md

Lines changed: 1 addition & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -200,27 +200,7 @@ This section explains the steps to collect MariaDB logs from a Kubernetes enviro
200200
```
201201
5. Sumo Logic Kubernetes collection will automatically start collecting logs from the pods having the annotations defined above.
202202
6. Verify logs in Sumo Logic.
203-
3. **Add an FER to normalize the fields in Kubernetes environments**. This step is not needed if using application components solution terraform script. Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, we need to create a Field Extraction Rule if not already created for Proxy Application Components:
204-
1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**.
205-
2. Click the **+ Add** button on the top right of the table.
206-
3. The **Add Field Extraction Rule** form will appear:
207-
4. Enter the following options:
208-
* **Rule Name**. Enter the name as **App Observability - database**.
209-
* **Applied At.** Choose **Ingest Time**
210-
* **Scope**. Select **Specific Data**
211-
* **Scope**. Enter the following keyword search expression:
212-
```sql
213-
pod_labels_environment=* pod_labels_component=database
214-
pod_labels_db_cluster=* pod_labels_db_system=*
215-
```
216-
* **Parse Expression**. Enter the following parse expression:
217-
```sql
218-
if (!isEmpty(pod_labels_environment), pod_labels_environment, "") as environment
219-
| pod_labels_component as component
220-
| pod_labels_db_system as db_system
221-
| if (!isEmpty(pod_labels_db_cluster), pod_labels_db_cluster, null) as db_cluster
222-
```
223-
5. Click **Save** to create the rule.
203+
3. **FER to normalize the fields in Kubernetes environments.** Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, we will have Field Extraction Rule automatically created for Database Application Components named as **AppObservabilityMariaDBDatabaseFER**.
224204

225205

226206
</TabItem>

docs/integrations/databases/memcached.md

Lines changed: 1 addition & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -217,27 +217,7 @@ This section explains the steps to collect Memcached logs from a Kubernetes envi
217217
kubectl describe pod <Memcached_pod_name>
218218
```
219219
4. Sumo Logic Kubernetes collection will automatically start collecting logs from the pods having the annotations defined above.
220-
3. **Add a FER to normalize the fields in Kubernetes environments**. This step is not needed if one is using application components solution terraform script. Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, we need to create a Field Extraction Rule if not already created for Proxy Application Components. To do so:
221-
1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**.
222-
2. Click the + Add button on the top right of the table.
223-
3. The **Add Field Extraction Rule** form will appear:
224-
4. Enter the following options:
225-
* **Rule Name**. Enter the name as **App Observability - Database**.
226-
* **Applied At**. Choose **Ingest Time**
227-
* **Scope**. Select **Specific Data**
228-
* **Scope**: Enter the following keyword search expression:
229-
```sql
230-
pod_labels_environment=* pod_labels_component=database \
231-
pod_labels_db_system=* pod_labels_db_cluster=*
232-
```
233-
* **Parse Expression**. Enter the following parse expression:
234-
```sql
235-
if (!isEmpty(pod_labels_environment), pod_labels_environment, "") as environment
236-
| pod_labels_component as component
237-
| pod_labels_db_system as db_system
238-
| if (!isEmpty(pod_labels_db_cluster), pod_labels_db_cluster, null) as db_cluster
239-
```
240-
5. Click **Save** to create the rule.
220+
3. **FER to normalize the fields in Kubernetes environments.** Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, we will have Field Extraction Rule automatically created for Database Application Components named as **AppObservabilityMemcachedDatabaseFER**.
241221

242222
</TabItem>
243223
<TabItem value="non-k8s">

docs/integrations/databases/mongodb.md

Lines changed: 2 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -234,27 +234,8 @@ Pivoting to Tracing data from Entity Inspector is possible only for “MongoDB a
234234
kubectl describe pod <MongoDB_pod_name>
235235
```
236236
5. Sumo Logic Kubernetes collection will automatically start collecting logs from the pods having the annotations defined above.
237-
3. **Add an FER to normalize the fields in Kubernetes environments**. This step is not needed if one is using application components solution terraform script. Labels created in Kubernetes environments automatically are prefixed with `pod_labels`. To normalize these for our app to work, we need to create a Field Extraction Rule if not already created for Database Application Components. To do so:
238-
1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**.
239-
2. Click the + Add button on the top right of the table.
240-
3. The **Add Field Extraction Rule** form will appear:
241-
4. Enter the following options:
242-
* **Rule Name**. Enter the name as **App Observability - Database**.
243-
* **Applied At**. Choose **Ingest Time**
244-
* **Scope**. Select **Specific Data**
245-
* **Scope**: Enter the following keyword search expression:
246-
```sql
247-
pod_labels_environment=* pod_labels_component=database \
248-
pod_labels_db_system=* pod_labels_db_cluster=*
249-
```
250-
* **Parse Expression**.Enter the following parse expression:
251-
```sql
252-
| if (!isEmpty(pod_labels_environment), pod_labels_environment, "") as environment
253-
| pod_labels_component as component
254-
| pod_labels_db_system as db_system
255-
| pod_labels_db_cluster as db_cluster
256-
```
257-
4. Click **Save** to create the rule.
237+
238+
3. **FER to normalize the fields in Kubernetes environments.** Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, we will have Field Extraction Rule automatically created for Database Application Components named as **AppObservabilityMongoDBDatabaseFER**.
258239

259240
</TabItem>
260241
<TabItem value="non-k8s">

docs/integrations/databases/mysql.md

Lines changed: 1 addition & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -345,29 +345,7 @@ Sumo Logic Kubernetes collection will automatically start collecting logs from t
345345

346346
</details>
347347

348-
2. **Add an FER to normalize the fields in Kubernetes environments**. This step is not needed if using application components solution terraform script. Labels created in Kubernetes environments are automatically prefixed with pod_labels. To normalize these for our app to work, we'll create a [Field Extraction Rule](/docs/manage/field-extractions/create-field-extraction-rule), Database Application Components, assuming it does not already exist:
349-
1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**.
350-
2. Click the **+ Add**.
351-
3. The **Add Field Extraction** pane appears.
352-
4. **Rule Name.** Enter "App Observability - Database".
353-
5. **Applied At**. Choose "Ingest Time".
354-
6. **Scope**. Select "Specific Data".
355-
* **Scope**. Enter the following keyword search expression:
356-
```sql
357-
pod_labels_environment=* pod_labels_component=database pod_labels_db_system=* pod_labels_db_cluster=*
358-
```
359-
* **Parse Expression**. Enter the following parse expression:
360-
```sql
361-
| if (!isEmpty(pod_labels_environment), pod_labels_environment, "") as environment
362-
| pod_labels_component as component
363-
| pod_labels_db_system as db_system
364-
| if (!isEmpty(pod_labels_db_cluster), pod_labels_db_cluster, null) as db_cluster
365-
```
366-
7. Click **Save** to create the rule.
367-
8. To verify that logs are flowing into Sumo Logic, run this query:
368-
```sql
369-
component=database db_system=mysql db_cluster=<your_mysql_cluster_name>
370-
```
348+
3. **FER to normalize the fields in Kubernetes environments.** Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, we will have Field Extraction Rule automatically created for Database Application Components named as **AppObservabilityMySQLDatabaseFER**.
371349

372350
</TabItem>
373351
<TabItem value="non-k8s">

docs/integrations/databases/oracle.md

Lines changed: 1 addition & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -252,27 +252,7 @@ annotations:
252252
2. The Sumo Logic Kubernetes collection will automatically start collecting logs from the pods having the annotations defined above.
253253
3. Verify logs in Sumo Logic.
254254

255-
**Add an FER to normalize the fields in Kubernetes environments**
256-
257-
This step is not needed if you're using application components solution terraform script. Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, we need to create a Field Extraction Rule if not already created for Proxy Application Components. To do so:
258-
1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**.
259-
1. Click the **+Add** button on the top right of the table.
260-
1. The **Add Field Extraction Rule** form will appear. Enter the following options:
261-
1. **Rule Name**. Enter the name as **App Observability - database**.
262-
2. **Applied At**. Choose **Ingest Time**.
263-
3. **Scope**. Select **Specific Data**.
264-
4. **Scope**: Enter the following keyword search expression.
265-
```sql
266-
pod_labels_environment=* pod_labels_component=database pod_labels_db_cluster=* pod_labels_db_system=*
267-
```
268-
5. **Parse Expression**. Enter the following parse expression.
269-
```sql
270-
if (!isEmpty(pod_labels_environment), pod_labels_environment, "") as environment
271-
| pod_labels_component as component
272-
| pod_labels_db_system as db_system
273-
| if(!isEmpty(pod_labels_db_cluster), pod_labels_db_cluster, null) as db_cluster
274-
```
275-
1. Click **Save** to create the rule.
255+
**FER to normalize the fields in Kubernetes environments.** Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, we will have Field Extraction Rule automatically created for Database Application Components named as **AppObservabilityOracleDatabaseFER**.
276256

277257
</TabItem>
278258
<TabItem value="non-k8s">

docs/integrations/databases/redis.md

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -244,25 +244,7 @@ This section explains the steps to collect Redis logs from a Kubernetes environm
244244
kubectl describe pod <redis_pod_name>
245245
```
246246
5. Sumo Logic Kubernetes collection will automatically start collecting logs from the pods having the annotations defined above.
247-
3. **Add an FER to normalize the fields in Kubernetes environments**. This step is not needed if using application components solution terraform script. Labels created in Kubernetes environments automatically are prefixed with `pod_labels`. To normalize these for our app to work, we need to create a Field Extraction Rule. To do so:
248-
* [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**.
249-
* Click the + Add button on the top right of the table.
250-
* The **Add Field Extraction Rule** form will appear:
251-
* Enter the following options:
252-
* **Rule Name**. Enter the name as **App Observability - Database**.
253-
* **Applied At**. Choose **Ingest Time**.
254-
* **Scope**. Select **Specific Data**. Enter the following keyword search expression:
255-
```sql
256-
pod_labels_environment=* pod_labels_component=database pod_labels_db_system=* pod_labels_db_cluster=*
257-
```
258-
* **Parse Expression**. Enter the following parse expression:
259-
```sql
260-
| if (!isEmpty(pod_labels_environment), pod_labels_environment, "") as environment
261-
| pod_labels_component as component
262-
| pod_labels_db_system as db_system
263-
| if (!isEmpty(pod_labels_db_cluster), pod_labels_db_cluster, null) as db_cluster
264-
```
265-
* Click **Save** to create the rule.
247+
3. **FER to normalize the fields in Kubernetes environments.** Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, we will have Field Extraction Rule automatically created for Database Application Components named as **AppObservabilityRedisDatabaseFER**.
266248

267249
</TabItem>
268250
<TabItem value="non-k8s">

0 commit comments

Comments
 (0)