Integrating Data With Operations Connector > Structured Log File Policies > Structured Log File Policy User Interface > Configuring Mappings in Structured Log File Policies (Generic Output Only)

Configuring Mappings in Structured Log File Policies (Generic Output Only)

The Mappings page enables you to map the log file input data properties, which are the structural fields extracted from log files, to custom variables.

Learn More

Mappings overview

The key field mapping consists of an input field qualifier, an eligible field name, and a mapped field name. To map the key field, map the eligible field name to the mapped field name. The eligible field name is automatically extracted from the input field qualifier.

Log policies integrate hierarchical data. Therefore, any field to be mapped must be a leaf node in the internal logical tree-like structure. As a result, the eligible field is the last entry in the tree.

For example, if the input data has the structure evt/event_type, the eligible field is event_type. This field is then mapped, for example to the field eventType.

You can add additional fields to data that is sent to Data Forwarding targets. Additional fields are simple key-value pairs and you must manually add both the keys and values. If a defined key field name equals a field name in the mapped data set, it is discarded.

Additional fields are added as immediate children of the highest level element.

The actual field value can consist of user defined strings and data references to the input data (<$DATA:…>).

Example:

Additional Field Name	Additional Field Value
combined_text	At `<$DATA:/evt/time_occured>`, `<$DATA:/evt/event_type>` detected an `<$DATA:/evt/event_impact>` impact on system performance. This has happened `<$DATA:/evt/event_counter>` times.

The data references in the additional field combined_text are replaced when the policy is run. In the above example, after the variables are replaced, the resulting value in the field combined_text is:

At 12/05/2015 14:01:39, Monitoring: Threshold violation detected an substantial impact on system performance. This has happened 8264 times.

Note that data references must refer to the input format, not the mapped format.

Tasks

UI Descriptions

This section includes:

Key Field Mapping Configuration

Key Field Mapping Configuration

UI Element	Description
	Create new mapping definition. Adds a new mapping definition to the list of mappings.
	Delete mapping definition. Deletes the selected mapping definition.
Input Field Qualifier	Input data property assigned to the custom variable. Operations Connector replaces the pattern matching field at runtime with the value of the specified field. If you insert a value, the value will be used. If you are working with meta data, you can drag and drop a key from the Meta Data tab.
Eligible Field Name	The field that is eligible for mapping. The field is extracted automatically from the Input Field Qualifier. Some sources integrate hierarchical data (XML file, REST WS, and log file). In case of such data, any field to be mapped must be a leaf node in the internal logical tree-like structure.
Mapped Field Name	The replacement for the input field.
Keep All Input Fields	If the option is selected, all input is kept regardless if the mapping does occur or not. If the option is not selected, the fields that are not mapped are dropped.
	New item Adds a new additional, user defined field.
	Delete item. Deletes the additional field.
Field Name	The name of the additional user defined field.
Field Value	The value of the additional user defined field. The value can contain static text defined by the user and data references into the input data (`<$DATA:…>`).
Meta Data tab
Input Data Properties	A list of keys derived from input data. You can drag and drop the keys.

Meta Data tab

UI Element	Description
Input Data Properties	A list of keys derived from input data. You can drag and drop the keys onto the Key Field Mapping table.