Skip to content

Commit d4eb819

Browse files
authored
Update dynamic-parsing.md (#4953)
1 parent e2b1301 commit d4eb819

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

docs/search/get-started-with-search/build-search/dynamic-parsing.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,9 +37,7 @@ Run Time FERs have a scope, exactly like an Ingest Time FER, that defines which
3737
1. Enter the following options:
3838

3939
* **Rule Name**. Type a name that makes it easy to identify the rule.
40-
4140
* **Applied At**. Select **Run Time**.
42-
4341
* **Scope**. Select **Specific Data** and define the scope of your JSON data. You can define your JSON data source as a [Partition](/docs/manage/partitions) Name(index), sourceCategory, Host Name, Collector Name, or any other [metadata](../search-basics/built-in-metadata.md) that describes your JSON data. Think of the Scope as the first portion of an ad hoc search, before the first pipe (`|`). You will use the Scope to run a search against the rule. You can't use keywords like “info” or “error” in your scope.
4442

4543
Always set up JSON auto extraction (Run Time field extraction) on a specific Partition name (recommended) or a particular Source. Failing to do so might cause the auto parsing logic to run on data sources where it is not applicable and will add additional overhead that might deteriorate the performance of your queries.
@@ -111,7 +109,9 @@ Search results table:
111109
* The query `_sourceCategory = A or _sourceCategory = B` is applied, only within the log lines that fall within `_sourceCategory = A`, while the remaining log lines are not parsed by this Run Time FER.
112110

113111
1. If a field does not exist in the schema of the log message, null results are displayed for the field (instead of erroring out).
114-
112+
:::note
113+
When a field contains null values, dynamic parsing attempts to interpret those values and assigns them a string data type. This can create issues if you expect different data types for that field. To resolve the issue, use `field=*` in the source expression to eliminate null values.
114+
:::
115115
1. Ingest Time FERs take precedence for field assignments. A Run Time FER will not override a field assignment from an Ingest Time FER.
116116

117117
Conflicts between Ingest and Run Time fields are evaluated by each log line in the following ways:

0 commit comments

Comments
 (0)