Instead of typing context values for extracting fields dynamically, you can use the one-click extract function.
The one-click extract populates all context values that correspond to the field that you select in a log event.
The one-click extract option is available only in Events tab.
Verify that you are logged in to the vRealize Log Insight web user interface. The URL format is https://log_insight-host, where log_insight-host is the IP address or host name of the vRealize Log Insight virtual appliance.
- Navigate to the Interactive Analytics tab.
- In the list of log events, highlight the text that represents the field that you want to extract.
An action menu appears above the set of field names present in that event.
- Click Extract Field.
The pre and post context values in the Fields pane are populated automatically with the context needed to extract the highlighted field.
- (Optional) Modify the Extracted value regular expression in the Fields pane.
- (Optional) Modify the Pre and post context regular expressions in the Fields pane.
- (Optional) Click Add additional context to add more keywords and filters.
You can add one or more keywords and use a single static field as a filter.
- If you are an administrator user, select which users can access the field from the drop down menu.
All users will see the field in their events and in the filter drop-down menu.
Only the creator of the field will see the field in their events and filter drop down menu.
- (Optional) At the top of the Fields pane, click and then Edit to add notes to this field. Add notes in the Edit Notes window and click OK.
- Click Save.
What to do next
You can use the extracted field to search and filter the list of log events, or to aggregate events in the Interactive Analytics chart.
You can modify saved field definitions or delete them if you no longer need them.