ECS Container (AWS) Inputs

Enter a descriptive label for this input. 

When you create a workflow, you will use this label to enter your input into the workflow. 

errorcheck is the default label.

This parameter is required. 

Review the following example: 

- labels: "errorcheck" 

Enter the ECS assets to include.

To specify which input to add, you must provide include/exclude regex filters.

• All rules in the same line with a comma(",") separated means AND:

   include:
     - "rule-1,rule-2"
  

• All rules under the same part (include/exclude) means OR:

   include:
     - "rule-1"
     - "rule-2"
  

• The ECS Exclude field takes precedence over the ECS Include field. 
• For the ECS Include and ECS Exclude parameters, note that if the value you provide after container-name= or task-family= is contained anywhere in the pod or namespace name, then the value will match.

This parameter is optional. 

Review the following example: 

test

Enter the ECS assets to exclude.

To specify which input to add, you must provide include/exclude regex filters.

• All rules in the same line with a comma(",") separated means AND:

   exclude:
     - "rule-1,rule-2"
  

• All rules under the same part (include/exclude) means OR:

   exclude:
     - "rule-1"
     - "rule-2"
  

• The ECS Exclude field takes precedence over the ECS Include field.
• For the ECS Include and ECS Exclude parameters, note that if the value you provide after container-name= or task-family= is contained anywhere in the pod or namespace name, then the value will match.

This parameter is optional. 

Review the following example: 

exclude:
  - "container-name=.*xray.*"

Enter true or false to enable auto line detection for log messages with multiple lines.

This parameter is optional. 

Review the following example: 

auto_detect_line_pattern: true

Enter true or false to enhance (or troubleshoot missed patterns) the Auto Line Detection parameter. 

This parameter is optional. 

Review the following example: 

boost_stacktrace_detection: true

Select an existing filter to add to this input. 

To learn how to create a filter, see Filters.

This parameter is optional. 

Review the following example: 

filters: 
  - info 
  - not_trace 
  - mask_card 
  - mask_password

late_arrival_handling

You can use this parameter to configure how to accommodate delayed data. 

Specifically, you can use the ignore_after parameter to configure when to ignore metrics or pattern logs.

For example, for ignore_after, if you enter 15m, then the input will ignore logs whose timestamp is older than 15 minutes. 

This parameter is optional. 

Review the following example:  

late_arrival_handling:
  rule_metrics:
    ignore_after: 15m
  patterns:
    ignore_after: 4h
    report_with_original_timestamp: true

late_arrival_handling

You can use this parameter to configure how to accommodate delayed data. 

Specifically, you can use the ignore_after parameter to configure when to ignore metrics or pattern logs.

For example, for ignore_after, if you enter 15m, then the input will ignore logs whose timestamp is older than 15 minutes. 

This parameter is optional. 

Review the following example:

      late_arrival_handling:
        rule_metrics:
          ignore_after: 15m
        patterns:
          ignore_after: 4h
          report_with_original_timestamp: true

enrichments

You can use this parameter to enrich data with specified extracted fields. 

To learn how to enrich data from inputs, see Enrich Input Data.

This parameter is optional. 

Review the following example: 

   - labels: k8s_log
      path: /var/logs/anyDir/MyApp/users/MyPodID/transaction.log
      enrichments:
        from_path:
          field_mappings:
            - field_name: application
              pattern: /var/logs/anyDir/(?:(.+)/)?users/.*