Enricher declarations

Enrichers supplement the parsed event with extra data.

An enricher can:

1. Create a new field in the event.
2. Transform a field's values in some way (changing a letter case, performing a calculation, etc).

Enrichers are most commonly used to:

1. Specify the dataset where the logs will be stored in ElasticSearch (add the field event.dataset).
2. Obtain facility and severity from the syslog priority field.

define:
    type: parsec/enricher

enrich:
    event.dataset: <dataset_name>
    new.field: <expression>
    ...

• Write enrichers in YAML.
• Specify parsec/enricher in the define field.

Example

The following example is enricher used for events in syslog format. Suppose you have parser for the events of the form:

<14>1 2023-05-03 15:06:12 server pid: Username 'HarryPotter' logged in.

The event is in the form:

{
    "log.syslog.priority": 14,
    "user.name": "HarryPotter"
}

You want to obtain syslog severity and facility, which are computed in the standard way:

(facility * 8) + severity = priority

You would also like to lower the name HarryPotter to harrypotter in order to unify the users across various log sources.

Therefore, you create an enricher:

enricher.yaml

define:
type: parsec/enricher

enrich:
    event.dataset: 'dataset_name'
    user.id: !LOWER { what: !GET {from: !ARG EVENT, what: user.name} }

    # facility and severity are computed from 'syslog.pri' in the standard way
    log.syslog.facility.code: !SHR
            what: !GET { from: !ARG EVENT, what: log.syslog.priority }
            by: 3
    log.syslog.severity.code: !AND [ !GET {from: !ARG EVENT, what: log.syslog.priority}, 7 ]