Configure Logs Enrichment

Introduction

Log enrichment allows you to enhance your log data by adding or updating attributes based on specific rules. This is done using Lookup Tables and Enrichment Configs under Logs Configuration. The enriched data provides more context and value, making it easier to analyze and act upon logs.

To create an alert definition:

1. Navigate to Infrastructure > Logs.
2. On the left side of this page, click the Menu icon.
3. From the MY LOGS VIEWS page, under QUICK LINKS, select Logs Configuration.
   The configuration page is displayed.
4. From the configurations page, select the Enrichment tab.
   The enrichment details page is displayed with two sub-tabs:
   
   • Lookup Tables
   • Enrichment Configs

     

Configure Lookup Tables

Lookup Tables are essential for enriching logs. They define the attributes that will be added or updated in your logs based on matching rules.

To create a lookup table:

1. Click the LOOKUP TABLES tab within the Enrichment section.

2. Click the +ADD.
   The ADD LOOKUP TABLE screen is displayed.

   

3. Enter a name for your lookup table.

4. Upload a CSV file containing the attributes you want to use for enrichment. The CSV file should be structured according to your enrichment requirements.

5. Once the name and CSV file are provided, click ADD LOOKUP TABLE to save the changes.

Create Enrichment Configurations

After setting up a Lookup Table, you can create Enrichment Configs that specify how these attributes are applied to your logs.

To create a configuration:

1. Click the ENRICHMENT CONFIGS tab.

2. Click +ADD.
   The ENRICHMENT CONFIGURATION page is displayed.

   

3. On the ENRICHMENT CONFIGURATION page, provide below information:

   • GENERAL DETAILS:
     • Name: Enter a name for the configuration.
     • Priority Order: Set the priority for this configuration. This determines the order in which configurations are applied if multiple rules match.
     • Lookup Table: In the Lookup Table dropdown, select the lookup table for which you want to create a configuration.
       

       Note

       You can only add one lookup table for a configuration.
     • LOG FILTER CRITERIA: Click the +ADD FILTER option. Select the available attributes to define the filter criteria. This will determine which logs are enriched by this configuration.
   • ENRICHMENT RULES: Define conditions and matching fields under the Enrichment Rules section. These rules specify how and when the enrichment occurs.
     • LOG FIELDS: Choose the log fields that should be appended or updated when all conditions are met.
       

       Note

       You can include multiple rules within a single enrichment configuration.

4. After configuring all the necessary settings, click ADD CONFIGURATION to save your enrichment setup.