Skip to main content

event_extraction_rules

Creates, updates, deletes, gets or lists an event_extraction_rules resource.

Overview​

Nameevent_extraction_rules
TypeResource
Idsumologic.event_extraction_rules.event_extraction_rules

Fields​

The following fields are returned by SELECT queries:

Requested event extraction rule.

NameDatatypeDescription
idstringId of the event extraction rule. (example: 0000000001213227)
namestringName of event extraction rule. (example: foo)
configurationobjectConfiguration for the Event Extraction Rule. This object defines how event fields are mapped to their corresponding values. Each field specifies a valueSource, which provides the actual value, and an optional mappingType, indicating the value is hardcoded. The following fields are required: - eventType: Type of the event. Accepted values are Deployment, Feature Flag Change, Configuration Change or Infrastructure Change. - eventPriority: Indicates the priority of the event. Accepted values are High, Medium, or Low. - eventSource: Source system or component where the event originated (e.g., "Jenkins"). - eventName: Descriptive name of the event (e.g., "monitor-manager deployed."). The following fields are optional: - eventDescription: Additional context or details about the event. Custom fields can also be added as needed to capture domain-specific event data.
correlation_expressionobjectCorrelation Expression specifies how to determine related events for a log search query. The value of eventFieldName from Events is compared with the values of queryFieldName from the log search query output using the defined stringMatchingAlgorithm. Events that match according to this algorithm are considered correlated. (wire: correlationExpression)
created_atstring (date-time)Creation timestamp in UTC in [RFC3339](https:​//tools.ietf.org/html/rfc3339) format. (wire: createdAt)
created_bystringIdentifier of the user who created the resource. (wire: createdBy)
descriptionstringDescription of event extraction rule. (example: foo)
disable_reasonstringReason for disabling the event extraction rule, if applicable. (example: Event Extraction Rule output exceeded maximum allowed rate of 1000 events per hour in last 24 hours.) (wire: disableReason)
enabledbooleanFlag indicating whether the event extraction rule is enabled or disabled.
modified_atstring (date-time)Last modification timestamp in UTC. (wire: modifiedAt)
modified_bystringIdentifier of the user who last modified the resource. (wire: modifiedBy)
querystringQuery string for the Event Extraction Rule. Logs matching this query are periodically ingested into the sumologic_userdata_events index (Events). Guidelines for creating the query: - Optimize the query to limit the number of returned log messages (intended for special logs only). - The query runs in Manual mode, explicitly parse and extract only the necessary fields for event correlation and visualization. - Use the fields operator to restrict the output to required fields. (example: _sourceCategory=eventSource)

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
getselectid, regionGet an event extraction rule.
listselectregionGet all event extraction rules.
createinsertregion, configuration, name, queryCreate event extraction rule.
updateupdateid, region, configuration, name, queryUpdate an event extraction rule.
deletedeleteid, regionDelete an event extraction rule.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
idstringThe identifier of the event extraction rule. (example: 000000000000000A)
regionstringSumo Logic deployment (au, ca, ch, de, eu, fed, in, jp, kr, us1, us2). Resolved from the SUMOLOGIC_ENVIRONMENT environment variable when it is set (x-stackQL-envVar, the same variable the Terraform provider reads); otherwise defaults to us2. A WHERE region = '...' value always takes precedence. (enum: [au, ca, ch, de, eu, fed, in, jp, kr, us1, us2], default: us2, x-stackQL-envVar: SUMOLOGIC_ENVIRONMENT)

SELECT examples​

Get an event extraction rule.

SELECT
id,
name,
configuration,
correlation_expression,
created_at,
created_by,
description,
disable_reason,
enabled,
modified_at,
modified_by,
query
FROM sumologic.event_extraction_rules.event_extraction_rules
WHERE id = '{{ id }}' -- required
AND region = '{{ region }}' -- required unless SUMOLOGIC_ENVIRONMENT is set
;

INSERT examples​

Create event extraction rule.

INSERT INTO sumologic.event_extraction_rules.event_extraction_rules (
name,
description,
query,
correlation_expression,
configuration,
region
)
SELECT 
'{{ name }}' /* required */,
'{{ description }}',
'{{ query }}' /* required */,
'{{ correlation_expression }}',
'{{ configuration }}' /* required */,
'{{ region }}'
RETURNING
id,
name,
configuration,
correlation_expression,
created_at,
created_by,
description,
disable_reason,
enabled,
modified_at,
modified_by,
query
;

UPDATE examples​

Update an event extraction rule.

UPDATE sumologic.event_extraction_rules.event_extraction_rules
SET 
name = '{{ name }}',
description = '{{ description }}',
query = '{{ query }}',
correlation_expression = '{{ correlation_expression }}',
configuration = '{{ configuration }}'
WHERE 
id = '{{ id }}' --required
AND region = '{{ region }}' --required unless SUMOLOGIC_ENVIRONMENT is set
AND configuration = '{{ configuration }}' --required
AND name = '{{ name }}' --required
AND query = '{{ query }}' --required
RETURNING
id,
name,
configuration,
correlation_expression,
created_at,
created_by,
description,
disable_reason,
enabled,
modified_at,
modified_by,
query;

DELETE examples​

Delete an event extraction rule.

DELETE FROM sumologic.event_extraction_rules.event_extraction_rules
WHERE id = '{{ id }}' --required
AND region = '{{ region }}' --required unless SUMOLOGIC_ENVIRONMENT is set
;
Last updated on