extraLogFields
A query input parameter that specifies extra custom fields to
log in query audit and activity logs. Fields from
extraLogFields appear in the logs with
the customKey prefix. For
example, setting extraLogFields:
{alertId: "123", alertName: "MyAlert"} creates log
entries customKey.alertId=123
and customKey.alertName=MyAlert.
This parameter enables tracking and correlating queries with custom identifiers like alert IDs, trace IDs, or application-specific metadata. Used to distinguish features from queries that originate in NG-SIEM.
Validation and Limits
The following rules apply to both the key and value fields:
Maximum length is 128 characters.
Only the following characters are permitted:
a-z,A-Z,0-9, and the special characters,-._