log10x-mcp 1.27.0 → 1.27.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/assets/tenx-mcp-file.config.yaml +106 -0
- package/assets/tenx-mcp-stdin.config.yaml +106 -0
- package/build/product-kb/docs/apps/dev/run.md +13 -6
- package/build/product-kb/docs/apps/mcp/run.md +10 -3
- package/build/product-kb/docs/apps/receiver/deploy.md +294 -41
- package/build/product-kb/docs/apps/receiver/run.md +12 -5
- package/build/product-kb/docs/apps/reporter/run.md +12 -5
- package/build/product-kb/docs/apps/retriever/deploy/k8s.md +51 -1
- package/build/product-kb/docs/apps/retriever/deploy/lambda.md +50 -32
- package/build/product-kb/docs/apps/retriever/run.md +10 -3
- package/build/product-kb/docs/compile/bootstrap/index.md +2 -2
- package/build/product-kb/docs/compile/deploy.md +9 -7
- package/build/product-kb/docs/compile/faq.md +1 -1
- package/build/product-kb/docs/compile/test.md +5 -3
- package/build/product-kb/docs/engine/launcher/sidecar.md +2 -2
- package/build/product-kb/docs/faq/security/data-protection.md +1 -1
- package/build/product-kb/docs/faq/stacks/datadog/optimization.md +2 -2
- package/build/product-kb/docs/faq/stacks/elasticsearch/configuration.md +1 -1
- package/build/product-kb/docs/install/docker.md +25 -6
- package/build/product-kb/docs/install/index.md +2 -0
- package/build/product-kb/docs/install/linux.md +45 -17
- package/build/product-kb/docs/install/win.md +5 -1
- package/build/product-kb/docs/manage/license.md +9 -119
- package/build/product-kb/docs/run/initialize/message/index.md +22 -4
- package/build/product-kb/docs/run/input/forwarder/filebeat/index.md +2 -0
- package/build/product-kb/docs/run/input/forwarder/fluentbit/index.md +2 -0
- package/build/product-kb/docs/run/input/forwarder/fluentd/index.md +2 -0
- package/build/product-kb/docs/run/input/forwarder/index.md +10 -3
- package/build/product-kb/docs/run/input/forwarder/logstash/index.md +31 -6
- package/build/product-kb/docs/run/input/forwarder/otel-collector/index.md +2 -0
- package/build/product-kb/docs/run/input/forwarder/vector/index.md +2 -0
- package/package.json +3 -2
|
@@ -0,0 +1,106 @@
|
|
|
1
|
+
# Log10x MCP — file-mode tenx runtime config.
|
|
2
|
+
#
|
|
3
|
+
# Reads events from LOG10X_MCP_INPUT_PATH, writes templates/encoded/
|
|
4
|
+
# decoded/aggregated to LOG10X_MCP_OUTPUT_DIR. Override this file via
|
|
5
|
+
# LOG10X_MCP_FILE_CONFIG_PATH.
|
|
6
|
+
|
|
7
|
+
tenx: run
|
|
8
|
+
runtimeName: $=TenXEnv.get("LOG10X_MCP_RUNTIME_NAME", "mcp-file")
|
|
9
|
+
|
|
10
|
+
# Include the input/output MODULES, not their config wrappers. The
|
|
11
|
+
# wrappers pre-define named entries reading/writing the image's bundled
|
|
12
|
+
# sample, and `allowMultiple: true` would run those alongside the MCP's
|
|
13
|
+
# own entries below.
|
|
14
|
+
include:
|
|
15
|
+
|
|
16
|
+
|
|
17
|
+
# Shared bootstrap (symbols, template loading, transform, etc.)
|
|
18
|
+
- apps/shared
|
|
19
|
+
|
|
20
|
+
# Input module
|
|
21
|
+
- run/modules/input/file
|
|
22
|
+
|
|
23
|
+
# Full enrichment chain.
|
|
24
|
+
- run/initialize/inputField
|
|
25
|
+
- run/initialize/level
|
|
26
|
+
- run/initialize/group
|
|
27
|
+
- run/initialize/message
|
|
28
|
+
- run/initialize/httpCode
|
|
29
|
+
- run/initialize/lookup
|
|
30
|
+
- run/initialize/custom
|
|
31
|
+
- run/initialize/k8s
|
|
32
|
+
|
|
33
|
+
# Aggregator. Without this NO TenXSummary is produced, so the
|
|
34
|
+
# `filter: isSummary` output below matches nothing and aggregated.csv
|
|
35
|
+
# is a header with zero data rows. That silently strips the only
|
|
36
|
+
# source of per-pattern severity, and `isReducibleSeverity(undefined)`
|
|
37
|
+
# then treats every ERROR pattern as reducible. Do not remove.
|
|
38
|
+
#
|
|
39
|
+
# DELIBERATELY EXPLICIT. DO NOT RELY ON FLAVOR DEFAULTS. If a future
|
|
40
|
+
# engine emits summary rows by default, this stays. Flavors differ:
|
|
41
|
+
# the compiler-flavor image emitted neither summary rows nor anchors
|
|
42
|
+
# while the edge-flavor host binary emitted both, on the same input
|
|
43
|
+
# and version family. A pinned older image, or a flavor we have not
|
|
44
|
+
# met, silently stops producing them, severity coverage returns to
|
|
45
|
+
# 0%, every ERROR pattern is marked reducible, and NOTHING ERRORS.
|
|
46
|
+
# That silence is how this defect survived unnoticed the first time.
|
|
47
|
+
- run/aggregate/mcp
|
|
48
|
+
|
|
49
|
+
# Output module
|
|
50
|
+
- run/modules/output/event/file
|
|
51
|
+
|
|
52
|
+
# Template cache: in local-binary mode the runner shadows the install's
|
|
53
|
+
# run/template/config.yaml with files: [] so persistent state under
|
|
54
|
+
# data/templates/ and data/sample/output/ doesn't pre-load. Docker is
|
|
55
|
+
# ephemeral, so the runner skips the shadow there.
|
|
56
|
+
|
|
57
|
+
# ========================== Input options ==========================
|
|
58
|
+
|
|
59
|
+
inputFile:
|
|
60
|
+
- name: mcpFileInput
|
|
61
|
+
path: $=TenXEnv.get("LOG10X_MCP_INPUT_PATH")
|
|
62
|
+
printProgress: false
|
|
63
|
+
extractors: []
|
|
64
|
+
sourcePattern: null
|
|
65
|
+
|
|
66
|
+
# ========================= Output options =========================
|
|
67
|
+
|
|
68
|
+
outputFile:
|
|
69
|
+
|
|
70
|
+
- path: $=TenXEnv.get("LOG10X_MCP_OUTPUT_DIR") + "/templates.json"
|
|
71
|
+
writeTemplates: true
|
|
72
|
+
append: false
|
|
73
|
+
|
|
74
|
+
# DELIBERATELY EXPLICIT. DO NOT RELY ON FLAVOR DEFAULTS. Asking for
|
|
75
|
+
# these here is not redundant even once the engine emits them by
|
|
76
|
+
# default: it is what makes the MCP independent of which flavor and
|
|
77
|
+
# which image tag it happens to be talking to. See the note above.
|
|
78
|
+
#
|
|
79
|
+
# The four anchor fields after encode() are what carry Reporter-tier
|
|
80
|
+
# identity out of the engine: `pattern=,<symbolMessage>` and
|
|
81
|
+
# `patternHash=,<tenx_hash>`. cli-output-parser reads them off each
|
|
82
|
+
# encoded line, and pattern-extraction joins aggregated.csv on the
|
|
83
|
+
# tenx_hash to resolve severity. Drop them and every pattern loses its
|
|
84
|
+
# tenxHash, the aggregated join misses, and collapseBySymbolMessage
|
|
85
|
+
# becomes a no-op.
|
|
86
|
+
- path: $=TenXEnv.get("LOG10X_MCP_OUTPUT_DIR") + "/encoded.log"
|
|
87
|
+
fields:
|
|
88
|
+
- encode()
|
|
89
|
+
- patternPrefix="pattern="
|
|
90
|
+
- $=yield TenXEnv.get("symbolMessageField")
|
|
91
|
+
- patternHashPrefix="patternHash="
|
|
92
|
+
- $=yield TenXEnv.get("symbolMessageHashField")
|
|
93
|
+
|
|
94
|
+
- path: $=TenXEnv.get("LOG10X_MCP_OUTPUT_DIR") + "/decoded.log"
|
|
95
|
+
filter: isEncoded
|
|
96
|
+
fields:
|
|
97
|
+
- text
|
|
98
|
+
|
|
99
|
+
- path: $=TenXEnv.get("LOG10X_MCP_OUTPUT_DIR") + "/aggregated.csv"
|
|
100
|
+
filter: isSummary
|
|
101
|
+
header: $=yield TenXString.join(",", TenXEnv.get("enrichmentFields"), "summaryVolume", "summaryBytes", "summaryTotals") + "\n"
|
|
102
|
+
fields:
|
|
103
|
+
- $=yield TenXEnv.get("enrichmentFields")
|
|
104
|
+
- summaryVolume
|
|
105
|
+
- summaryBytes
|
|
106
|
+
- summaryTotals
|
|
@@ -0,0 +1,106 @@
|
|
|
1
|
+
# Log10x MCP — stdin-mode tenx runtime config.
|
|
2
|
+
#
|
|
3
|
+
# Used by log10x_resolve_batch. The batch is piped to tenx over stdin,
|
|
4
|
+
# templates + encoded rows + aggregated summary are written to a
|
|
5
|
+
# per-invocation temp dir via LOG10X_MCP_OUTPUT_DIR.
|
|
6
|
+
#
|
|
7
|
+
# Safe to edit: copy to ~/.log10x-mcp/stdin.config.yaml and set
|
|
8
|
+
# LOG10X_MCP_STDIN_CONFIG_PATH in the MCP env.
|
|
9
|
+
|
|
10
|
+
tenx: run
|
|
11
|
+
runtimeName: $=TenXEnv.get("LOG10X_MCP_RUNTIME_NAME", "mcp-stdin")
|
|
12
|
+
|
|
13
|
+
# Stdin input is controlled by the `stdinEnabled` env var. Force it on
|
|
14
|
+
# so the stdin reader consumes piped batches.
|
|
15
|
+
stdinEnabled: "true"
|
|
16
|
+
|
|
17
|
+
include:
|
|
18
|
+
|
|
19
|
+
# --------------------------- Shared bootstrap ---------------------------
|
|
20
|
+
# apps/shared chains run/bootstrap, run/symbol, run/template,
|
|
21
|
+
# run/transform, run/reload, run/monitor, run/console — everything
|
|
22
|
+
# the runtime needs before input/enrichment/output. Intentionally
|
|
23
|
+
# NOT including `dev` or `run/aggregate/dev` — those pull in
|
|
24
|
+
# DevOutputStream which requires an API key, and we want local
|
|
25
|
+
# offline validation to work without one.
|
|
26
|
+
- apps/shared
|
|
27
|
+
|
|
28
|
+
# --------------------------- Input ---------------------------
|
|
29
|
+
- run/input/stdin
|
|
30
|
+
|
|
31
|
+
# ------------------------ Enrichment --------------------------
|
|
32
|
+
# Full chain — keeps validation realistic. Matches the modules the
|
|
33
|
+
# paste Lambda and in-cluster fluentd use, so templates and
|
|
34
|
+
# identities here are byte-compatible with the production pipeline.
|
|
35
|
+
- run/initialize/inputField
|
|
36
|
+
- run/initialize/level
|
|
37
|
+
- run/initialize/group
|
|
38
|
+
- run/initialize/message
|
|
39
|
+
- run/initialize/httpCode
|
|
40
|
+
- run/initialize/lookup
|
|
41
|
+
- run/initialize/custom
|
|
42
|
+
- run/initialize/k8s
|
|
43
|
+
|
|
44
|
+
# --------------------------- Output ---------------------------
|
|
45
|
+
# File sink only. Output paths are constructed per-invocation from
|
|
46
|
+
# LOG10X_MCP_OUTPUT_DIR. The MCP creates a fresh tempdir per call
|
|
47
|
+
# so concurrent invocations don't collide.
|
|
48
|
+
#
|
|
49
|
+
# IMPORTANT: include the bare module (`run/modules/output/event/file`)
|
|
50
|
+
# not the full config-bearing path (`run/output/event/file`). The
|
|
51
|
+
# full path's `config.yaml` defines `outputFile:` entries pointing at
|
|
52
|
+
# `data/sample/output/*.json` — those entries APPEND to ours and the
|
|
53
|
+
# engine writes newly-discovered templates into the system cache at
|
|
54
|
+
# `/usr/local/etc/tenx/config/data/sample/output/templates.json`. On
|
|
55
|
+
# subsequent MCP runs the engine loads that system cache and
|
|
56
|
+
# correctly deduplicates already-known templates, so our tempdir's
|
|
57
|
+
# `templates.json` comes back empty even though `encoded.log` is full
|
|
58
|
+
# — which makes `resolve_batch` return "No patterns resolved" for any
|
|
59
|
+
# input whose templates were learned in a previous MCP run.
|
|
60
|
+
# Caught live by the eval-harness sub-agent on cart logs (templates
|
|
61
|
+
# were cached system-wide after the first run; second run returned
|
|
62
|
+
# 0 templates with the same input).
|
|
63
|
+
- run/modules/output/event/file
|
|
64
|
+
|
|
65
|
+
# Template cache: the engine loads cached templates from
|
|
66
|
+
# data/templates/*.json and data/sample/output/*.json at startup.
|
|
67
|
+
# The MCP's runner sets TENX_INCLUDE_PATHS with the per-invocation
|
|
68
|
+
# tempdir FIRST, so template-file globs resolve to empty directories
|
|
69
|
+
# there before hitting the install's cache. This forces all templates
|
|
70
|
+
# produced during the run to be "new" and written to templates.json.
|
|
71
|
+
|
|
72
|
+
# ========================== Input options ==========================
|
|
73
|
+
|
|
74
|
+
stdin:
|
|
75
|
+
extractors: []
|
|
76
|
+
sourcePattern: null
|
|
77
|
+
|
|
78
|
+
# ========================= Output options =========================
|
|
79
|
+
|
|
80
|
+
outputFile:
|
|
81
|
+
|
|
82
|
+
# Full structural identity library — one line per unique template.
|
|
83
|
+
- path: $=TenXEnv.get("LOG10X_MCP_OUTPUT_DIR") + "/templates.json"
|
|
84
|
+
writeTemplates: true
|
|
85
|
+
append: false
|
|
86
|
+
|
|
87
|
+
# Per-event encoded rows — one per input event, mapping to template hash.
|
|
88
|
+
- path: $=TenXEnv.get("LOG10X_MCP_OUTPUT_DIR") + "/encoded.log"
|
|
89
|
+
fields:
|
|
90
|
+
- encode()
|
|
91
|
+
|
|
92
|
+
# Per-event decoded text — for human inspection / round-trip checks.
|
|
93
|
+
- path: $=TenXEnv.get("LOG10X_MCP_OUTPUT_DIR") + "/decoded.log"
|
|
94
|
+
filter: isEncoded
|
|
95
|
+
fields:
|
|
96
|
+
- text
|
|
97
|
+
|
|
98
|
+
# Aggregated summary — used for severity / service / volume rollups.
|
|
99
|
+
- path: $=TenXEnv.get("LOG10X_MCP_OUTPUT_DIR") + "/aggregated.csv"
|
|
100
|
+
filter: isSummary
|
|
101
|
+
header: $=yield TenXString.join(",", TenXEnv.get("enrichmentFields"), "summaryVolume", "summaryBytes", "summaryTotals") + "\n"
|
|
102
|
+
fields:
|
|
103
|
+
- $=yield TenXEnv.get("enrichmentFields")
|
|
104
|
+
- summaryVolume
|
|
105
|
+
- summaryBytes
|
|
106
|
+
- summaryTotals
|
|
@@ -90,7 +90,7 @@ Run the dev app on your log files locally to preview how edge and cloud apps wil
|
|
|
90
90
|
-v $TENX_CONFIG:/etc/tenx/config/ \
|
|
91
91
|
-e TENX_CONFIG=/etc/tenx/config/ \
|
|
92
92
|
-e TENX_LICENSE_KEY="$(cat license.jwt)" \
|
|
93
|
-
log10x/pipeline-10x:
|
|
93
|
+
log10x/pipeline-10x:1.1.39 \
|
|
94
94
|
@apps/dev
|
|
95
95
|
```
|
|
96
96
|
|
|
@@ -105,7 +105,7 @@ Run the dev app on your log files locally to preview how edge and cloud apps wil
|
|
|
105
105
|
```bash
|
|
106
106
|
docker run --rm \
|
|
107
107
|
-e TENX_LICENSE_KEY="$(cat license.jwt)" \
|
|
108
|
-
log10x/pipeline-10x:
|
|
108
|
+
log10x/pipeline-10x:1.1.39 \
|
|
109
109
|
'@github={"token": "<gh-token>", "repo": "my-user/my-repo"}' \
|
|
110
110
|
@apps/dev
|
|
111
111
|
```
|
|
@@ -186,7 +186,7 @@ Run the dev app on your log files locally to preview how edge and cloud apps wil
|
|
|
186
186
|
=== ":simple-docker: Docker"
|
|
187
187
|
|
|
188
188
|
```bash
|
|
189
|
-
docker rmi log10x/pipeline-10x:
|
|
189
|
+
docker rmi log10x/pipeline-10x:1.1.39
|
|
190
190
|
```
|
|
191
191
|
|
|
192
192
|
## :material-wrench-outline: Config Files
|
|
@@ -2399,7 +2399,7 @@ To configure the Dev app, [:material-cog: Edit](https://doc.log10x.com/config/ap
|
|
|
2399
2399
|
</div>
|
|
2400
2400
|
</dialog>
|
|
2401
2401
|
|
|
2402
|
-
<template class="tenx-config-schema" data-encoding="base64">
|
|
2402
|
+
<template class="tenx-config-schema" data-encoding="base64">ewogICJ0eXBlIiA6ICJvYmplY3QiLAogICJwcm9wZXJ0aWVzIiA6IHsKICAgICJpbmNsdWRlIiA6IHsKICAgICAgInR5cGUiIDogInN0cmluZyIKICAgIH0sCiAgICAidGVueCIgOiB7CiAgICAgICJ0eXBlIiA6ICJzdHJpbmciCiAgICB9LAogICAgInN5bWJvbCIgOiB7CiAgICAgICJ0eXBlIiA6ICJvYmplY3QiLAogICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiIDogZmFsc2UsCiAgICAgICJwcm9wZXJ0aWVzIiA6IHsKICAgICAgICAiY29udGV4dHMiIDogewogICAgICAgICAgInR5cGUiIDogWwogICAgICAgICAgICAic3RyaW5nIiwKICAgICAgICAgICAgIm51bGwiCiAgICAgICAgICBdLAogICAgICAgICAgIm1hcmtkb3duRGVzY3JpcHRpb24iIDogIlR5cGVzIG9mIHN5bWJvbHMgdG8gc2VhcmNoXG5cblNwZWNpZmllcyBhIGNvbW1hIGRlbGltaXRlZCBsaXN0IG9mIFtzeW1ib2wgY29udGV4dHNdKGh0dHBzOi8vZG9jLmxvZzEweC5jb20vcnVuL3RyYW5zZm9ybS9zeW1ib2wvI2NvbnRleHRzKSB2YWx1ZXMuIFRoaXMgaXMgYXJndW1lbnQgaXMgcGFzc2VkIGFzIHRoZSBgc3ltYm9sQ29udGV4dHNgIGFyZ3VtZW50IHZhbHVlIGZvciB0aGUgW3N5bWJvbFNlcXVlbmNlXShodHRwczovL2RvYy5sb2cxMHguY29tL2FwaS9qcy8jVGVuWE9iamVjdCtzeW1ib2xTZXF1ZW5jZSkgZnVuY3Rpb24uICBUaGUgbGlzdGVkIGNvbnRleHRzIGFyZSBldmFsdWF0ZWQgaW4gYSBzaW5nbGUgcGFzcywgc28gbGlzdCBvcmRlciBhY3RzIGFzIGEgZmlsdGVyIHJhdGhlciB0aGFuIGEgcHJlY2VkZW5jZSBjaGFpbi4gKERlZmF1bHQ6IGxvZyxleGVjKSIsCiAgICAgICAgICAiZGVmYXVsdCIgOiAibG9nLGV4ZWMiCiAgICAgICAgfSwKICAgICAgICAibWF4TGVuIiA6IHsKICAgICAgICAgICJ0eXBlIiA6IFsKICAgICAgICAgICAgIm51bWJlciIsCiAgICAgICAgICAgICJzdHJpbmciLAogICAgICAgICAgICAibnVsbCIKICAgICAgICAgIF0sCiAgICAgICAgICAibWFya2Rvd25EZXNjcmlwdGlvbiIgOiAiTWF4IG51bWJlciBvZiBvdXRwdXQgY2hhcnNcblxuU3BlY2lmaWVzIHRoZSBtYXggbnVtYmVyIG9mIGNoYXJzIG9mIHRoZSBbc3ltYm9sTWVzc2FnZUZpZWxkXShodHRwczovL2RvYy5sb2cxMHguY29tL3J1bi9pbml0aWFsaXplL21lc3NhZ2UvI3N5bWJvbG1lc3NhZ2VmaWVsZCkuIFNldCAwIHRvIHVubGltaXRlZC4gKEFjY2VwdHMgbnVtYmVyIG9yIHN0cmluZyB3aXRoICQ9IHByZWZpeCBmb3IgcnVudGltZSBldmFsdWF0aW9uKSAoRGVmYXVsdDogMCkiLAogICAgICAgICAgImRlZmF1bHQiIDogMAogICAgICAgIH0sCiAgICAgICAgIm1lc3NhZ2UiIDogewogICAgICAgICAgInR5cGUiIDogIm9iamVjdCIsCiAgICAgICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiIDogZmFsc2UsCiAgICAgICAgICAicHJvcGVydGllcyIgOiB7CiAgICAgICAgICAgICJmaWVsZCIgOiB7CiAgICAgICAgICAgICAgInR5cGUiIDogWwogICAgICAgICAgICAgICAgInN0cmluZyIsCiAgICAgICAgICAgICAgICAibnVsbCIKICAgICAgICAgICAgICBdLAogICAgICAgICAgICAgICJtYXJrZG93bkRlc2NyaXB0aW9uIiA6ICJGaWVsZCBuYW1lIHRvIGFzc2lnbiB3aXRoIHN5bWJvbCBzZXF1ZW5jZSB2YWx1ZVxuXG5TcGVjaWZpZXMgdGhlIG5hbWUgb2YgdGhlIGZpZWxkIHRvIGFzc2lnbiB0aGUgcmV0dXJuIHZhbHVlIG9mIFtzeW1ib2xTZXF1ZW5jZV0oaHR0cHM6Ly9kb2MubG9nMTB4LmNvbS9hcGkvanMvI1RlblhPYmplY3Qrc3ltYm9sU2VxdWVuY2UpIGZ1bmN0aW9uIHdoZW4gaW52b2tpbmcgaXQgd2l0aCB0aGUgYSBzeW1ib2xDb250ZXh0IGFyZ3VtZW50IHZhbHVlIG9mIFtzeW1ib2xDb250ZXh0c10oaHR0cHM6Ly9kb2MubG9nMTB4LmNvbS9ydW4vaW5pdGlhbGl6ZS9tZXNzYWdlLyNzeW1ib2xjb250ZXh0cykuICBGb3IgYW4gZXhhbXBsZSwgc2VlIFtzeW1ib2xJbnB1dEZpZWxkXShodHRwczovL2RvYy5sb2cxMHguY29tL3J1bi9pbml0aWFsaXplL21lc3NhZ2UvI3N5bWJvbGlucHV0ZmllbGQpLiAoRGVmYXVsdDogc3ltYm9sTWVzc2FnZSkiLAogICAgICAgICAgICAgICJkZWZhdWx0IiA6ICJzeW1ib2xNZXNzYWdlIgogICAgICAgICAgICB9LAogICAgICAgICAgICAiaGFzaEZpZWxkIiA6IHsKICAgICAgICAgICAgICAidHlwZSIgOiBbCiAgICAgICAgICAgICAgICAic3RyaW5nIiwKICAgICAgICAgICAgICAgICJudWxsIgogICAgICAgICAgICAgIF0sCiAgICAgICAgICAgICAgIm1hcmtkb3duRGVzY3JpcHRpb24iIDogIkZpZWxkIG5hbWUgdG8gYXNzaWduIHdpdGggdGhlIGhhc2ggb2YgdGhlIHN5bWJvbCBzZXF1ZW5jZSB2YWx1ZVxuXG5TcGVjaWZpZXMgdGhlIG5hbWUgb2YgdGhlIGZpZWxkIHRvIGFzc2lnbiBhIHN0YWJsZSwgVVJMLXNhZmUgaGFzaCBvZiB0aGUgW3N5bWJvbE1lc3NhZ2VGaWVsZF0oaHR0cHM6Ly9kb2MubG9nMTB4LmNvbS9ydW4vaW5pdGlhbGl6ZS9tZXNzYWdlLyNzeW1ib2xtZXNzYWdlZmllbGQpIHZhbHVlLCBjb21wdXRlZCB2aWEgW1RlblhTdHJpbmcuaGFzaF0oaHR0cHM6Ly9kb2MubG9nMTB4LmNvbS9hcGkvanMvI1RlblhTdHJpbmcuaGFzaCkuICBUaGUgdmFsdWUgaXMgYW4gMTEtY2hhcmFjdGVyIGJhc2U2NHVybCBpZGVudGlmaWVyICh4eEhhc2g2NCBvZiB0aGUgVVRGLTggYnl0ZXMsIGJpZy1lbmRpYW4sIG5vIHBhZGRpbmcpLiBJdCBpcyBvbmUtd2F5IGFuZCByZXByb2R1Y2VzIGJ5dGUtZm9yLWJ5dGUgb3V0c2lkZSB0aGUgZW5naW5lLCBzbyBpdCBpcyBzYWZlIHRvIHVzZSBkaXJlY3RseSBhcyBhIGRlZHVwbGljYXRpb24ga2V5LCBtZXRyaWMgZGltZW5zaW9uLCBhbmFseXplciBxdWVyeSB0ZXJtLCBvciBmb3J3YXJkZXIgZmlsdGVyIGtleS4gICoqVW5zZXQgYnkgZGVmYXVsdC4qKiBUaGUgZW5yaWNobWVudCBmaWVsZCBpdHNlbGYgaXMgYWx3YXlzIHByZXNlbnQgb24gdGhlIFRlblhPYmplY3QgdW5kZXIgdGhlIGludGVybmFsIG5hbWUgYHRlbnhfaGFzaGAsIHNvIG1ldHJpY3MgZGltZW5zaW9ucywgdGhlIGFnZ3JlZ2F0aW9uIGtleSBhbmQgdGhlIE1DUCBhcnRpZmFjdHMgY2FycnkgdGhlIHBhdHRlcm4gaGFzaCB3aGV0aGVyIG9yIG5vdCB0aGlzIG9wdGlvbiBpcyBzZXQuIFdoYXQgdGhlIG9wdGlvbiBjb250cm9scyBpcyB0aGUgKndpcmUqIG5hbWUsIGFuZCB3aXRoIGl0IHdoZXRoZXIgdGhlIGhhc2ggcmVhY2hlcyBhIGNvdXBsZWQgbG9nIGZvcndhcmRlcjogb24gdGhlIFtmb3J3YXJkZXIgcmVjZWl2ZSBwYXRoXShodHRwczovL2RvYy5sb2cxMHguY29tL3J1bi9pbnB1dC9mb3J3YXJkZXIvKSB0aGUgcmVjb3JkIGdvZXMgYmFjayB0byB0aGUgZm9yd2FyZGVyIGJ5dGUtZm9yLWJ5dGUgYXMgaXQgYXJyaXZlZCB1bmxlc3MgdGhpcyBvcHRpb24gbmFtZXMgYSBmaWVsZCwgYW5kIHRoZW4gdGhhdCBmaWVsZCBpcyBzcGxpY2VkIG9udG8gdGhlIHJldHVybmVkIHJlY29yZC4gIFNldCBpdCB0byBgdGVueF9oYXNoYCB0byBnZXQgdGhlIGhpc3RvcmljYWwgbmFtZSwgb3IgdG8gYW55IG90aGVyIG5hbWUgdG8gYm90aCByZW5hbWUgdGhlIGVucmljaG1lbnQgZmllbGQgYW5kIHNoaXAgaXQsIGZvciBleGFtcGxlIGBzeW1ib2xNZXNzYWdlSGFzaEZpZWxkIG15X2N1c3RvbV9oYXNoYC4iCiAgICAgICAgICAgIH0KICAgICAgICAgIH0KICAgICAgICB9LAogICAgICAgICJvcmlnaW5GaWVsZCIgOiB7CiAgICAgICAgICAidHlwZSIgOiBbCiAgICAgICAgICAgICJzdHJpbmciLAogICAgICAgICAgICAibnVsbCIKICAgICAgICAgIF0sCiAgICAgICAgICAibWFya2Rvd25EZXNjcmlwdGlvbiIgOiAiRmllbGQgbmFtZSB0byBhc3NpZ24gd2l0aCBzeW1ib2wgbWVzc2FnZSBvcmlnaW4gZmlsZVxuXG5TcGVjaWZpZXMgdGhlIG5hbWUgb2YgdGhlIGZpZWxkIHRvIGFzc2lnbiB0aGUgcmV0dXJuIHZhbHVlIG9mIFtzeW1ib2xPcmlnaW5dKGh0dHBzOi8vZG9jLmxvZzEweC5jb20vYXBpL2pzLyNUZW5YT2JqZWN0K3N5bWJvbE9yaWdpbikgZnVuY3Rpb24uIChEZWZhdWx0OiApIiwKICAgICAgICAgICJkZWZhdWx0IiA6ICIiCiAgICAgICAgfQogICAgICB9CiAgICB9LAogICAgIm1lc3NhZ2VOZWdhdG9ycyIgOiB7CiAgICAgICJ0eXBlIiA6IFsKICAgICAgICAiYXJyYXkiLAogICAgICAgICJzdHJpbmciLAogICAgICAgICJudWxsIgogICAgICBdLAogICAgICAibWFya2Rvd25EZXNjcmlwdGlvbiIgOiAiTGlzdCBvZiBzdHJpbmdzIHRoYXQsIHdoZW4gbWF0Y2hlZCBhdCB0aGUgc3RhcnQgb2YgYSBsb2cgbGluZSdzIHRleHQsIG1hcmsgaXQgYXMgbG93LXZhbHVlIGNvbnRpbnVhdGlvbi9ib2lsZXJwbGF0ZSB0aGF0IGRvZXMgTk9UIHJlY2VpdmUgaXRzIG93biBtZXNzYWdlIHBhdHRlcm4uXG5cbkEgbGlzdCBvZiBzdHJpbmdzIHRoYXQsIHdoZW4gbWF0Y2hlZCBhdCB0aGUgc3RhcnQgb2YgYSBsb2cgbGluZSdzIHRleHQsIG1hcmsgaXQgYXMgYSBrbm93biBjb250aW51YXRpb24gcGF0dGVybiAoZS5nLiwgc3RhY2sgdHJhY2UgZnJhbWUsIGluZGVudGVkIGRldGFpbCwgYmFubmVyKSB0aGF0IHNob3VsZCBub3QgcmVjZWl2ZSBpdHMgb3duIG1lc3NhZ2UgcGF0dGVybi4gIE5lZ2F0b3JzIGFyZSBldmFsdWF0ZWQgYnkgdGhlIG1lc3NhZ2UgdGVtcGxhdGUncyBnYXRlIHdoZW4gdGhlIGV2ZW50IGlzIG5laXRoZXIgcGFydCBvZiBhIG11bHRpLWV2ZW50IGdyb3VwIChncm91cFNpemUgPiAxKSBub3IgYSBncm91cCBoZWFkOiBpbiB0aGF0IGNhc2UsIGFuIGV2ZW50IHN0aWxsIHJlY2VpdmVzIGEgcGF0dGVybiB1bmxlc3MgaXQgbWF0Y2hlcyBhIG5lZ2F0b3IuIFRoaXMgaXMgdGhlIFwiSGVsbG8gV29ybGQgdnMgb3JwaGFuIHN0YWNrIGZyYW1lXCIgZGlzY3JpbWluYXRvci4gIC0gYCBgIC0gYW55IGluZGVudGVkIGxpbmUgKHVuaXZlcnNhbCBjb250aW51YXRpb24gc2lnbmFsKS4gLSBgXHRgIC0gYW55IHRhYi1wcmVmaXhlZCBsaW5lIChKYXZhL0dvIHN0YWNrIGZyYW1lcyBldGMuKS4gLSBgQ2F1c2VkIGJ5OiBgIC0gSmF2YSBjaGFpbmVkIGV4Y2VwdGlvbiAoY29sdW1uIDApLiAtIGBTdXBwcmVzc2VkOiBgIC0gSmF2YSBzdXBwcmVzc2VkIGV4Y2VwdGlvbiAoY29sdW1uIDApLiAtIGAtLS0gRW5kIG9mIGAgLSAuTkVUIGlubmVyIGV4Y2VwdGlvbiBtYXJrZXIuIC0gYGNyZWF0ZWQgYnkgYCAtIEdvIGdvcm91dGluZSBjcmVhdG9yLiAtIGAjMCBgLi5gIzUgYCAtIFBIUCBzdGFjayBmcmFtZXMgKGRlcHRoIDAtNSkuIiwKICAgICAgIml0ZW1zIiA6IHsKICAgICAgICAidHlwZSIgOiAic3RyaW5nIgogICAgICB9CiAgICB9CiAgfSwKICAiYWRkaXRpb25hbFByb3BlcnRpZXMiIDogdHJ1ZQp9</template>
|
|
2403
2403
|
|
|
2404
2404
|
```yaml
|
|
2405
2405
|
# 🔟❎ 'run' symbol lookup configuration
|
|
@@ -2429,8 +2429,15 @@ To configure the Dev app, [:material-cog: Edit](https://doc.log10x.com/config/ap
|
|
|
2429
2429
|
# explains. Span length is the last tiebreak. The origin file name itself goes to 'originField'.
|
|
2430
2430
|
messageField: message_pattern
|
|
2431
2431
|
|
|
2432
|
-
# 'messageHashField' specifies the field name to assign a stable, URL-safe pattern hash (xxHash64 of the messageField value, base64url, 11 chars). Safe as a SIEM query term or forwarder filter key.
|
|
2433
|
-
|
|
2432
|
+
# 'messageHashField' specifies the field name to assign a stable, URL-safe pattern hash (xxHash64 of the messageField value, base64url, 11 chars). Safe as a SIEM query term or forwarder filter key.
|
|
2433
|
+
#
|
|
2434
|
+
# Left unset on purpose. The hash enrichment is always computed and carried on the TenXObject under
|
|
2435
|
+
# its internal name 'tenx_hash', so metric dimensions, the aggregation key and the MCP artifacts are
|
|
2436
|
+
# unaffected. Setting this key is what names the field on the wire, and on the forwarder receive path
|
|
2437
|
+
# that is also what puts it on the record returned to the forwarder; leave it unset and the forwarder
|
|
2438
|
+
# gets its record back byte-for-byte. Uncomment and name a field to opt in:
|
|
2439
|
+
#
|
|
2440
|
+
# messageHashField: tenx_hash
|
|
2434
2441
|
|
|
2435
2442
|
# 'maxLen' specifies the max char len of the output messageField
|
|
2436
2443
|
maxLen: 120
|
|
@@ -556,7 +556,7 @@ To configure the MCP test-drive app, [:material-cog: Edit](https://doc.log10x.co
|
|
|
556
556
|
</div>
|
|
557
557
|
</dialog>
|
|
558
558
|
|
|
559
|
-
<template class="tenx-config-schema" data-encoding="base64">
|
|
559
|
+
<template class="tenx-config-schema" data-encoding="base64">ewogICJ0eXBlIiA6ICJvYmplY3QiLAogICJwcm9wZXJ0aWVzIiA6IHsKICAgICJpbmNsdWRlIiA6IHsKICAgICAgInR5cGUiIDogInN0cmluZyIKICAgIH0sCiAgICAidGVueCIgOiB7CiAgICAgICJ0eXBlIiA6ICJzdHJpbmciCiAgICB9LAogICAgInN5bWJvbCIgOiB7CiAgICAgICJ0eXBlIiA6ICJvYmplY3QiLAogICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiIDogZmFsc2UsCiAgICAgICJwcm9wZXJ0aWVzIiA6IHsKICAgICAgICAiY29udGV4dHMiIDogewogICAgICAgICAgInR5cGUiIDogWwogICAgICAgICAgICAic3RyaW5nIiwKICAgICAgICAgICAgIm51bGwiCiAgICAgICAgICBdLAogICAgICAgICAgIm1hcmtkb3duRGVzY3JpcHRpb24iIDogIlR5cGVzIG9mIHN5bWJvbHMgdG8gc2VhcmNoXG5cblNwZWNpZmllcyBhIGNvbW1hIGRlbGltaXRlZCBsaXN0IG9mIFtzeW1ib2wgY29udGV4dHNdKGh0dHBzOi8vZG9jLmxvZzEweC5jb20vcnVuL3RyYW5zZm9ybS9zeW1ib2wvI2NvbnRleHRzKSB2YWx1ZXMuIFRoaXMgaXMgYXJndW1lbnQgaXMgcGFzc2VkIGFzIHRoZSBgc3ltYm9sQ29udGV4dHNgIGFyZ3VtZW50IHZhbHVlIGZvciB0aGUgW3N5bWJvbFNlcXVlbmNlXShodHRwczovL2RvYy5sb2cxMHguY29tL2FwaS9qcy8jVGVuWE9iamVjdCtzeW1ib2xTZXF1ZW5jZSkgZnVuY3Rpb24uICBUaGUgbGlzdGVkIGNvbnRleHRzIGFyZSBldmFsdWF0ZWQgaW4gYSBzaW5nbGUgcGFzcywgc28gbGlzdCBvcmRlciBhY3RzIGFzIGEgZmlsdGVyIHJhdGhlciB0aGFuIGEgcHJlY2VkZW5jZSBjaGFpbi4gKERlZmF1bHQ6IGxvZyxleGVjKSIsCiAgICAgICAgICAiZGVmYXVsdCIgOiAibG9nLGV4ZWMiCiAgICAgICAgfSwKICAgICAgICAibWF4TGVuIiA6IHsKICAgICAgICAgICJ0eXBlIiA6IFsKICAgICAgICAgICAgIm51bWJlciIsCiAgICAgICAgICAgICJzdHJpbmciLAogICAgICAgICAgICAibnVsbCIKICAgICAgICAgIF0sCiAgICAgICAgICAibWFya2Rvd25EZXNjcmlwdGlvbiIgOiAiTWF4IG51bWJlciBvZiBvdXRwdXQgY2hhcnNcblxuU3BlY2lmaWVzIHRoZSBtYXggbnVtYmVyIG9mIGNoYXJzIG9mIHRoZSBbc3ltYm9sTWVzc2FnZUZpZWxkXShodHRwczovL2RvYy5sb2cxMHguY29tL3J1bi9pbml0aWFsaXplL21lc3NhZ2UvI3N5bWJvbG1lc3NhZ2VmaWVsZCkuIFNldCAwIHRvIHVubGltaXRlZC4gKEFjY2VwdHMgbnVtYmVyIG9yIHN0cmluZyB3aXRoICQ9IHByZWZpeCBmb3IgcnVudGltZSBldmFsdWF0aW9uKSAoRGVmYXVsdDogMCkiLAogICAgICAgICAgImRlZmF1bHQiIDogMAogICAgICAgIH0sCiAgICAgICAgIm1lc3NhZ2UiIDogewogICAgICAgICAgInR5cGUiIDogIm9iamVjdCIsCiAgICAgICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiIDogZmFsc2UsCiAgICAgICAgICAicHJvcGVydGllcyIgOiB7CiAgICAgICAgICAgICJmaWVsZCIgOiB7CiAgICAgICAgICAgICAgInR5cGUiIDogWwogICAgICAgICAgICAgICAgInN0cmluZyIsCiAgICAgICAgICAgICAgICAibnVsbCIKICAgICAgICAgICAgICBdLAogICAgICAgICAgICAgICJtYXJrZG93bkRlc2NyaXB0aW9uIiA6ICJGaWVsZCBuYW1lIHRvIGFzc2lnbiB3aXRoIHN5bWJvbCBzZXF1ZW5jZSB2YWx1ZVxuXG5TcGVjaWZpZXMgdGhlIG5hbWUgb2YgdGhlIGZpZWxkIHRvIGFzc2lnbiB0aGUgcmV0dXJuIHZhbHVlIG9mIFtzeW1ib2xTZXF1ZW5jZV0oaHR0cHM6Ly9kb2MubG9nMTB4LmNvbS9hcGkvanMvI1RlblhPYmplY3Qrc3ltYm9sU2VxdWVuY2UpIGZ1bmN0aW9uIHdoZW4gaW52b2tpbmcgaXQgd2l0aCB0aGUgYSBzeW1ib2xDb250ZXh0IGFyZ3VtZW50IHZhbHVlIG9mIFtzeW1ib2xDb250ZXh0c10oaHR0cHM6Ly9kb2MubG9nMTB4LmNvbS9ydW4vaW5pdGlhbGl6ZS9tZXNzYWdlLyNzeW1ib2xjb250ZXh0cykuICBGb3IgYW4gZXhhbXBsZSwgc2VlIFtzeW1ib2xJbnB1dEZpZWxkXShodHRwczovL2RvYy5sb2cxMHguY29tL3J1bi9pbml0aWFsaXplL21lc3NhZ2UvI3N5bWJvbGlucHV0ZmllbGQpLiAoRGVmYXVsdDogc3ltYm9sTWVzc2FnZSkiLAogICAgICAgICAgICAgICJkZWZhdWx0IiA6ICJzeW1ib2xNZXNzYWdlIgogICAgICAgICAgICB9LAogICAgICAgICAgICAiaGFzaEZpZWxkIiA6IHsKICAgICAgICAgICAgICAidHlwZSIgOiBbCiAgICAgICAgICAgICAgICAic3RyaW5nIiwKICAgICAgICAgICAgICAgICJudWxsIgogICAgICAgICAgICAgIF0sCiAgICAgICAgICAgICAgIm1hcmtkb3duRGVzY3JpcHRpb24iIDogIkZpZWxkIG5hbWUgdG8gYXNzaWduIHdpdGggdGhlIGhhc2ggb2YgdGhlIHN5bWJvbCBzZXF1ZW5jZSB2YWx1ZVxuXG5TcGVjaWZpZXMgdGhlIG5hbWUgb2YgdGhlIGZpZWxkIHRvIGFzc2lnbiBhIHN0YWJsZSwgVVJMLXNhZmUgaGFzaCBvZiB0aGUgW3N5bWJvbE1lc3NhZ2VGaWVsZF0oaHR0cHM6Ly9kb2MubG9nMTB4LmNvbS9ydW4vaW5pdGlhbGl6ZS9tZXNzYWdlLyNzeW1ib2xtZXNzYWdlZmllbGQpIHZhbHVlLCBjb21wdXRlZCB2aWEgW1RlblhTdHJpbmcuaGFzaF0oaHR0cHM6Ly9kb2MubG9nMTB4LmNvbS9hcGkvanMvI1RlblhTdHJpbmcuaGFzaCkuICBUaGUgdmFsdWUgaXMgYW4gMTEtY2hhcmFjdGVyIGJhc2U2NHVybCBpZGVudGlmaWVyICh4eEhhc2g2NCBvZiB0aGUgVVRGLTggYnl0ZXMsIGJpZy1lbmRpYW4sIG5vIHBhZGRpbmcpLiBJdCBpcyBvbmUtd2F5IGFuZCByZXByb2R1Y2VzIGJ5dGUtZm9yLWJ5dGUgb3V0c2lkZSB0aGUgZW5naW5lLCBzbyBpdCBpcyBzYWZlIHRvIHVzZSBkaXJlY3RseSBhcyBhIGRlZHVwbGljYXRpb24ga2V5LCBtZXRyaWMgZGltZW5zaW9uLCBhbmFseXplciBxdWVyeSB0ZXJtLCBvciBmb3J3YXJkZXIgZmlsdGVyIGtleS4gICoqVW5zZXQgYnkgZGVmYXVsdC4qKiBUaGUgZW5yaWNobWVudCBmaWVsZCBpdHNlbGYgaXMgYWx3YXlzIHByZXNlbnQgb24gdGhlIFRlblhPYmplY3QgdW5kZXIgdGhlIGludGVybmFsIG5hbWUgYHRlbnhfaGFzaGAsIHNvIG1ldHJpY3MgZGltZW5zaW9ucywgdGhlIGFnZ3JlZ2F0aW9uIGtleSBhbmQgdGhlIE1DUCBhcnRpZmFjdHMgY2FycnkgdGhlIHBhdHRlcm4gaGFzaCB3aGV0aGVyIG9yIG5vdCB0aGlzIG9wdGlvbiBpcyBzZXQuIFdoYXQgdGhlIG9wdGlvbiBjb250cm9scyBpcyB0aGUgKndpcmUqIG5hbWUsIGFuZCB3aXRoIGl0IHdoZXRoZXIgdGhlIGhhc2ggcmVhY2hlcyBhIGNvdXBsZWQgbG9nIGZvcndhcmRlcjogb24gdGhlIFtmb3J3YXJkZXIgcmVjZWl2ZSBwYXRoXShodHRwczovL2RvYy5sb2cxMHguY29tL3J1bi9pbnB1dC9mb3J3YXJkZXIvKSB0aGUgcmVjb3JkIGdvZXMgYmFjayB0byB0aGUgZm9yd2FyZGVyIGJ5dGUtZm9yLWJ5dGUgYXMgaXQgYXJyaXZlZCB1bmxlc3MgdGhpcyBvcHRpb24gbmFtZXMgYSBmaWVsZCwgYW5kIHRoZW4gdGhhdCBmaWVsZCBpcyBzcGxpY2VkIG9udG8gdGhlIHJldHVybmVkIHJlY29yZC4gIFNldCBpdCB0byBgdGVueF9oYXNoYCB0byBnZXQgdGhlIGhpc3RvcmljYWwgbmFtZSwgb3IgdG8gYW55IG90aGVyIG5hbWUgdG8gYm90aCByZW5hbWUgdGhlIGVucmljaG1lbnQgZmllbGQgYW5kIHNoaXAgaXQsIGZvciBleGFtcGxlIGBzeW1ib2xNZXNzYWdlSGFzaEZpZWxkIG15X2N1c3RvbV9oYXNoYC4iCiAgICAgICAgICAgIH0KICAgICAgICAgIH0KICAgICAgICB9LAogICAgICAgICJvcmlnaW5GaWVsZCIgOiB7CiAgICAgICAgICAidHlwZSIgOiBbCiAgICAgICAgICAgICJzdHJpbmciLAogICAgICAgICAgICAibnVsbCIKICAgICAgICAgIF0sCiAgICAgICAgICAibWFya2Rvd25EZXNjcmlwdGlvbiIgOiAiRmllbGQgbmFtZSB0byBhc3NpZ24gd2l0aCBzeW1ib2wgbWVzc2FnZSBvcmlnaW4gZmlsZVxuXG5TcGVjaWZpZXMgdGhlIG5hbWUgb2YgdGhlIGZpZWxkIHRvIGFzc2lnbiB0aGUgcmV0dXJuIHZhbHVlIG9mIFtzeW1ib2xPcmlnaW5dKGh0dHBzOi8vZG9jLmxvZzEweC5jb20vYXBpL2pzLyNUZW5YT2JqZWN0K3N5bWJvbE9yaWdpbikgZnVuY3Rpb24uIChEZWZhdWx0OiApIiwKICAgICAgICAgICJkZWZhdWx0IiA6ICIiCiAgICAgICAgfQogICAgICB9CiAgICB9LAogICAgIm1lc3NhZ2VOZWdhdG9ycyIgOiB7CiAgICAgICJ0eXBlIiA6IFsKICAgICAgICAiYXJyYXkiLAogICAgICAgICJzdHJpbmciLAogICAgICAgICJudWxsIgogICAgICBdLAogICAgICAibWFya2Rvd25EZXNjcmlwdGlvbiIgOiAiTGlzdCBvZiBzdHJpbmdzIHRoYXQsIHdoZW4gbWF0Y2hlZCBhdCB0aGUgc3RhcnQgb2YgYSBsb2cgbGluZSdzIHRleHQsIG1hcmsgaXQgYXMgbG93LXZhbHVlIGNvbnRpbnVhdGlvbi9ib2lsZXJwbGF0ZSB0aGF0IGRvZXMgTk9UIHJlY2VpdmUgaXRzIG93biBtZXNzYWdlIHBhdHRlcm4uXG5cbkEgbGlzdCBvZiBzdHJpbmdzIHRoYXQsIHdoZW4gbWF0Y2hlZCBhdCB0aGUgc3RhcnQgb2YgYSBsb2cgbGluZSdzIHRleHQsIG1hcmsgaXQgYXMgYSBrbm93biBjb250aW51YXRpb24gcGF0dGVybiAoZS5nLiwgc3RhY2sgdHJhY2UgZnJhbWUsIGluZGVudGVkIGRldGFpbCwgYmFubmVyKSB0aGF0IHNob3VsZCBub3QgcmVjZWl2ZSBpdHMgb3duIG1lc3NhZ2UgcGF0dGVybi4gIE5lZ2F0b3JzIGFyZSBldmFsdWF0ZWQgYnkgdGhlIG1lc3NhZ2UgdGVtcGxhdGUncyBnYXRlIHdoZW4gdGhlIGV2ZW50IGlzIG5laXRoZXIgcGFydCBvZiBhIG11bHRpLWV2ZW50IGdyb3VwIChncm91cFNpemUgPiAxKSBub3IgYSBncm91cCBoZWFkOiBpbiB0aGF0IGNhc2UsIGFuIGV2ZW50IHN0aWxsIHJlY2VpdmVzIGEgcGF0dGVybiB1bmxlc3MgaXQgbWF0Y2hlcyBhIG5lZ2F0b3IuIFRoaXMgaXMgdGhlIFwiSGVsbG8gV29ybGQgdnMgb3JwaGFuIHN0YWNrIGZyYW1lXCIgZGlzY3JpbWluYXRvci4gIC0gYCBgIC0gYW55IGluZGVudGVkIGxpbmUgKHVuaXZlcnNhbCBjb250aW51YXRpb24gc2lnbmFsKS4gLSBgXHRgIC0gYW55IHRhYi1wcmVmaXhlZCBsaW5lIChKYXZhL0dvIHN0YWNrIGZyYW1lcyBldGMuKS4gLSBgQ2F1c2VkIGJ5OiBgIC0gSmF2YSBjaGFpbmVkIGV4Y2VwdGlvbiAoY29sdW1uIDApLiAtIGBTdXBwcmVzc2VkOiBgIC0gSmF2YSBzdXBwcmVzc2VkIGV4Y2VwdGlvbiAoY29sdW1uIDApLiAtIGAtLS0gRW5kIG9mIGAgLSAuTkVUIGlubmVyIGV4Y2VwdGlvbiBtYXJrZXIuIC0gYGNyZWF0ZWQgYnkgYCAtIEdvIGdvcm91dGluZSBjcmVhdG9yLiAtIGAjMCBgLi5gIzUgYCAtIFBIUCBzdGFjayBmcmFtZXMgKGRlcHRoIDAtNSkuIiwKICAgICAgIml0ZW1zIiA6IHsKICAgICAgICAidHlwZSIgOiAic3RyaW5nIgogICAgICB9CiAgICB9CiAgfSwKICAiYWRkaXRpb25hbFByb3BlcnRpZXMiIDogdHJ1ZQp9</template>
|
|
560
560
|
|
|
561
561
|
```yaml
|
|
562
562
|
# 🔟❎ 'run' symbol lookup configuration
|
|
@@ -586,8 +586,15 @@ To configure the MCP test-drive app, [:material-cog: Edit](https://doc.log10x.co
|
|
|
586
586
|
# explains. Span length is the last tiebreak. The origin file name itself goes to 'originField'.
|
|
587
587
|
messageField: message_pattern
|
|
588
588
|
|
|
589
|
-
# 'messageHashField' specifies the field name to assign a stable, URL-safe pattern hash (xxHash64 of the messageField value, base64url, 11 chars). Safe as a SIEM query term or forwarder filter key.
|
|
590
|
-
|
|
589
|
+
# 'messageHashField' specifies the field name to assign a stable, URL-safe pattern hash (xxHash64 of the messageField value, base64url, 11 chars). Safe as a SIEM query term or forwarder filter key.
|
|
590
|
+
#
|
|
591
|
+
# Left unset on purpose. The hash enrichment is always computed and carried on the TenXObject under
|
|
592
|
+
# its internal name 'tenx_hash', so metric dimensions, the aggregation key and the MCP artifacts are
|
|
593
|
+
# unaffected. Setting this key is what names the field on the wire, and on the forwarder receive path
|
|
594
|
+
# that is also what puts it on the record returned to the forwarder; leave it unset and the forwarder
|
|
595
|
+
# gets its record back byte-for-byte. Uncomment and name a field to opt in:
|
|
596
|
+
#
|
|
597
|
+
# messageHashField: tenx_hash
|
|
591
598
|
|
|
592
599
|
# 'maxLen' specifies the max char len of the output messageField
|
|
593
600
|
maxLen: 120
|