Skip to main content

​
Supported Data Types

📘 Logs

​
Configuring the Sawmills Modify Attribute Processor for Logs

The Sawmills Modify Attribute Processor enables you to update or transform log attributes based on specified rules. This is useful for standardizing log data, enriching it with additional context, or correcting erroneous values.

​
Main Use Cases

  • Standardize fields: Normalize attribute names and values to a consistent schema.
  • Enrich logs: Add derived or static context like environment, service, or region.
  • Fix or redact values: Correct malformed values or replace sensitive data.
  • Optimize payloads: Truncate large string fields to reduce size.

​
Configuration Components

​
1. Name

  • Description: Identifier for your processor. Use a unique and descriptive name to differentiate between multiple processors.

​
2. Attribute Filters

  • Conditions: Specify conditions to filter events before processing. Events must satisfy all conditions (AND) or at least one (OR) based on the selected logic.
Each condition follows this sequence:
  1. Choose the condition type:
    • Log Level (Severity)
    • Body as String
  2. Select a comparison operator:
    • Log Level (Severity): Equals / Not Equals
    • Body as String: Equals, Not Equals, Contains, Not Contains, Starts With, Ends With, Regex, Not Regex
  3. Provide a value:
    • Log Level: Select from a dropdown (INFO, WARN, ERROR, etc.).
    • Body as String: Enter a free-text value for matching.

​
3. Actions

  • Description: A modify attribute processor can run one or more actions in order. Each action targets a specific path and applies a transformation.
    • Options:
      • Insert: Adds a new attribute with a specified value.
      • Update: Modifies the value of an existing attribute.
      • Upsert: Adds a new attribute if it doesn’t exist or updates the value of an attribute if it does.
      • Truncate: Trims string values to a maximum length.

​
4. Action Details

  • Insert / Update / Upsert
    • Attribute Key: Path to the attribute to modify. Must start with Attributes., Body., or Resources.
    • Value Source: Defines where the new value comes from:
      • Static Value: Enter a literal value.
      • From Attribute: Copy the value from another attribute path (must start with Attributes., Body., or Resources.).
  • Truncate
    • Attributes: One or more attribute paths to truncate. Paths must start with Attributes., Body., or Resources.
      • BodyString is also supported to truncate the raw body as string.
      • You can use a wildcard for all immediate children, e.g. Attributes.* or Resources.* (wildcard is not recursive).
    • Max Length: Required. Must be a positive integer. Truncation applies only to string fields.
For Insert / Update / Upsert, depending on the Value Source, an attribute’s value will be set either by:
  • A static value defined in the field Attribute Value or
  • An existing attibute value from an existing attribute with the key defined in Attribute Key.