Column Properties

Fields in the Event list can be configured in the Format event list panel (see Figure 56, “Format Event List”). You can set the following column properties:

  • Type options are:

    • Field is the name of the field as it comes from the events.

    • Field as link is used with fields that contain URLs to display clickable links.

    • Custom link creates arbitrary links based on the contents of an event. Instead of just providing a field name, and using its content as the link, you write link templates, and use field interpolation to fill out the template.

      To use field interpolation, write two sets of curly braces (one nested in the other), and write fields ["nameOfField"] inside, like this: https://internal-tool/customers/{{fields["customerId"]}}. This creates a unique link for every value of customerId.

      The same mechanism can also be used to generate the text for the link, if you would like a different text than the raw URL to show as the link.

      Adding a New Custom Link Column

      Figure 63. Adding a New Custom Link Column


    • Field list is used to format all fields in an event as a list of key-value pairs. Enable the Group fields by prefix checkbox to organize data that share a prefix into a tree-structure. A prefix is any string followed by a dot in the field name, as actor in actor.ip and actor.organizationId, for instance.

      Group a field list by prefix

      Figure 64. Group a field list by prefix


      In the following example, all fields prefixed with actor. and user. will be grouped in a tree that can be expanded or collapsed.

      Field List as shown in the Event List

      Figure 65. Field List as shown in the Event List


  • Header is the custom field name you want to see displayed in the Event list.

  • Open link in new browser tab checkbox controls that the link is opened in new browser tab.

  • Show as controls whether the link should be displayed as a link or a button.