Standard Attributes
Standard Attributes define a naming convention for a set of log fields. The platform provides a set of default Standard Attributes and also supports users defining their own based on business needs.
- Supports promoting existing parsed attributes to Standard Attributes.
- Supports creating new Standard Attributes directly within the Standard Attributes page.
Standard Attributes List
The platform provides a set of default Standard Attributes. Users can add, delete, or edit Standard Attributes based on this foundation.
It is recommended to organize log attributes according to this specification. However, for large-scale, cross-team collaboration or due to historical reasons, it might not be feasible to adhere strictly to the规范. In such cases, for log analysis scenarios, the mapping feature can be used for attribute association. This allows you to meet the needs of correlated analysis without altering the log structure of your business systems.
The Standard Attributes currently supported by the platform include:
| Attribute Path | Display Name | Group | Format |
|---|---|---|---|
@network.client.geoip.country.name | Country Name | Geoip | string |
@network.client.geoip.district.name | District Name | Geoip | string |
@network.client.geoip.city.name | City Name | Geoip | string |
@http.url_details.host | URL Host | Web Access | string |
@http.url_details.port | URL Port | Web Access | string |
@http.url_details.path | URL Path | Web Access | string |
@http.useragent_details.browser.family | Browser | Web Access | string |
Creating a Standard Attribute
A Standard Attribute is defined by specifying its path, data type (string, integer, double, boolean), a description, and the names of the existing attributes that should be mapped to this Standard Attribute.
Multiple attribute names should be separated by English commas.
