You can modify the definitions of extracted fields.

vRealize Log Insight creates copies of the fields that you use when you create charts, queries, or alerts. If you modify a field definition, all charts, queries, and alerts that use the modified field are updated to reflect the new definition.

Administrators and users with edit access for the Explore Logs > Extracted Fields permission can modify their own content and their shared content. Other users can modify only their own content.

Content pack fields are read-only.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user associated with the User role, or a role that has the relevant permissions. For more information, see Create and Modify Roles in Administering vRealize Log Insight. The URL format of the web user interface is https://log_insight-host, where log_insight-host is the IP address or host name of the vRealize Log Insight virtual appliance.

Procedure

  1. Expand the main menu and click Explore Logs.
  2. At the top of the Fields pane, click Manage extracted fields "" and select an extracted field from the list.
  3. Modify the values and click Update.
    A dialog box displays a list of content that will be affected by the updated field. If the field is shared between multiple users, the dialog box also displays a list of affected users.
  4. (Optional) At the top of the Fields pane, click "" and then Edit to add notes to this field. Add notes in the Edit Notes window and click OK.
  5. Click Update to confirm your changes.

Results

vRealize Log Insight updates all queries, alerts, and charts that use the field that you modified.