Pipeline Quickstart: Delete Attributes

Overview

This is the fourth step in the Pipeline Quickstart guide. In the previous step, you learned how to Turn an unstructured log line into structured attributes so later processors can work with discrete fields.

In this section, you remove unnecessary attributes. Attributes are often parsed unnecessarily by upstream processors, or their utility has been fulfilled. Here, PID and TID are not required.

1. Use Delete Field Shortcut

You can select a field and use the shortcut to automatically create and configure a processor.

Click the PID field in the live capture pane and select Delete Field.

A Delete processor is added to the stack with the field already configured.

2. Delete a Second Field

1. To also delete the tid field, click Add row.

2. Select attributes tid in the new Delete from row.

3. Click Save on the Delete processor.

Note: The post processing size is now a decrease of about 23%.

Next Step

Normalize disparate severity words so dashboards and alerts can rely on a consistent set.