Configuring Field Aliasing

  1. From your profile avatar, go to Organization Settings → Field aliasing → Schemas and field aliasing on the side menu.

  2. Go to Configure schemas and field aliasing tab and click + New schema, then provide a name for your new schema.

  3. In the Define schema fields dialog enter your aliases along with a description, these are the names that you'll want to use as the standard fields in your schema, then click Confirm:

  4. Click + Add field to add any new field to the schema: once you've done, your schema is created but empty at this stage.

  5. Now you need to create the mapping. Still in the Configure schemas and mappings tab, select the schema you've just created and click +Alias into this schema:

  6. Give your field mapping a name then click Next:

  7. Do the matching by specifying the original field names that correspond to your schema fields:

    Refer to Understanding Schema Requirements on how to create consistent schemas with valid mappings.

    Note

    You cannot install a field alias mapping that has no schema, field aliasing must always refer to a schema that you define.

  8. Check the Keep original field names box to keep all original fields in the mapping, see Searching with Field Aliasing for more information on its behavior.

  9. Set the conditions: fill in tag field names and values in order to set at least one condition for your mapping; for example, you want field aliasing to apply when field #kind is equal to value logs or if field #repo is equal to value github (click +Add condition to add more conditions):

    Set Conditions

    Figure 84. Set Conditions


    Note

    When setting the conditions for a mapping, tag field values do not accept glob patterns for the filtering (humio* for repository names, for instance) — only literal values are allowed.

  10. Now you need to activate your schema: go to the Active schemas tab, click Activate Schema and select the schema you've just created.

  11. Choose the scope for your schema and select whether you want to:

    • Apply to whole organization — this sets a general rule that would apply the schema to all repositories and views.

    • Apply to a selection of repositories and views — the schema is associated with specific repositories or views that you select from those available; this choice will overwrite the organization level schema for the selected views, if one is applied.

Your schema is now ready and appears in the list of active schemas, meaning that fields that you have aliased (the mapping you've done in step 7) are renamed in the UI Fields Panel and ready to use at search: see Searching with Field Aliasing for information on how Field Aliasing works during search.