Configuring Field Aliasing
From your profile avatar, go to Field aliasing →→
Schemas and field aliasingon the side menu.
Go to Configure schemas and field aliasing tab and click , then provide a name for your new schema.
In the Define schema fields dialog enter your aliases along with a description, these are the names that you'll want to use as the standard fields in your schema, then click :
Clickto add any new field to the schema: once you've done, your schema is created but empty at this stage.
Now you need to create the mapping. Still in the Configure schemas and mappings tab, select the schema you've just created and click :
Give your field mapping a name then click:
Do the matching by specifying the original field names that correspond to your schema fields:
Refer to Understanding Schema Requirements on how to create consistent schemas with valid mappings.
You cannot install a field alias mapping that has no schema, field aliasing must always refer to a schema that you define.
Check the Doing Searches with Field Aliasing for more information on its behavior.box to keep all original fields in the mapping, see
Set the conditions: fill in tag field names and values in order to set at least one condition for your mapping; for example, you want field aliasing to apply when field #kind is equal to value
logsor if field #repo is equal to value
github(click to add more conditions):
Figure 77. Set Conditions
When setting the conditions for a mapping, tag field values do not accept glob patterns for the filtering (
humio*for repository names, for instance) — only literal values are allowed.
Now you need to activate your schema: go to the Active schemas tab, click and select the schema you've just created.
Choose the scope for your schema and select whether you want to:
Apply to whole organization — this sets a general rule that would apply the schema to all repositories and views.
Apply to a selection of repositories and views — the schema is associated with specific repositories or views that you select from those available; this choice will overwrite the organization level schema for the selected views, if one is applied.
Your schema is now ready and appears in the list of active schemas, meaning that fields that you have aliased (the mapping you've done in step 7) are renamed in the UI Fields Panel and ready to use at search: see Doing Searches with Field Aliasing for information on how Field Aliasing works during search.