Planning for Your Monitoring Policy Template
Before running the template creation wizard, you must review and collect the information that is required during the policy creation.
Use the following checklist as preliminary steps to consider before creating the template:
Determine the method for defining the template columns
When you create the template, you can define the log columns by using one of the following methods in the wizard:
- User Defined
Manually specify the template columns.
Automatically discover the columns by uploading the log file.
- Discovered (This option is available if Discovered templates is enabled.)
Manually specify the key for key value pairs. For example, if the key value pair is Skill[Algorithm], Skill is the key you add to the Discovered template. The match for the Discovered template is flexible. Not all of the keys you define in the template need to exist in the log file.
Important: Discovered templates are secondary templates and must be used with a primary template. Primary templates are User Defined or Delimited templates and are used to index the log data. The Discovered template is applied after the primary template and extracts the key value pairs.
Based on the log structure, determine which method simplifies your data entry. For example, if the log has 10 columns, you might want to use the Delimited method.
Determine the template properties
The template properties define the structure of the log.
- For User Defined and Delimited templates, you must define the following properties:
- Parsing criteria:
- Columns in the log file (see the next checklist for more information on column properties).
- Delimiting characters that separate each column.
- Number of lines in the log header.
- Extension of the log file to be monitored. All extensions are supported (such as .txt or .log).
- If you decided to automatically discover the columns, determine the lines that you want to read from the log.
Tip: To see examples on how to gather the properties for a template, review the template samples described in Examples for Monitoring Policy Templates.
- Parsing criteria:
- For Discovered templates, you must select a primary template.
Primary templates are User Defined or Delimited templates and are used to index the log data. The Discovered template is applied after the primary template and extracts the key value pairs.
Determine the column properties
To define columns in the template, you need to gather the following details for each of the columns in the log:
- Determine the data type and format of the column. For example, the data type could be a date using the MM-DD-YYYY format.
- Decide if the column will be used to monitor the logs. If there are columns that are not useful for monitoring the logs, you can prevent them from appearing in the Log Monitoring application.
- Decide if you want to index the column. Index the column if you want to search the log data in the Log Monitoring application.
- If you choose to index the column, decide if you want to display the column as a facet (search filter) in the application.