Routing Policies allow you to selectively direct the incoming logs into different repos in the system. You can perform routing by key-value match or key-present criteria.
Routing Policies¶
Go to Settings >> Configuration from the navigation bar and click Routing Policies.
Routing Policies¶
Click Add Policy.
Add Policy panel¶
Provide the Policy Name for the routing policy.
Choose a repo from the Catch All drop-down menu. If an incoming log does not match any routing criteria, it gets stored in the Catch All repo.
Select the Type from the drop-down menu. The type can either be KeyPresent or KeyPresentValueMatches.
If you select KeyPresent, provide a Key. In this case, LogPoint applies the routing criteria to all the log messages containing the specified key.
If you select KeyPresentValueMatches, enter a Key and a Value. In this case, LogPoint applies the routing criteria to all the log messages conforming with the provided Key-Value match.
Note
The Key for both the KeyPresent and the KeyPresentValueMatches types must be a normalized field name of the log message.
Choose an Operation:
Store raw message: LogPoint stores both the raw message and the normalized data in the target repository.
Discard raw message: LogPoint discards the raw message and stores the normalized data.
Discard entire event: LogPoint discards both the raw message and the normalized data.
Select the target Repository from the drop-down menu for the Routing Criteria.
Click Add.
Once you add a criterion, it is listed in the table below the Routing Criteria section. The priority of the routing criteria can be changed by clicking the up and down arrows in the Actions column.
Click Submit.
Note
Click the ? icon near the top-right corner to get help on the inputs.
You cannot specify routing specifications for the repo _logpoint.
You can find the _LogPointAlerts routing policy by default in LogPoint. It routes the log messages with norm_id as LogPointAlerts to the _LogPointAlerts repo. Otherwise, it forwards them to the default repo.
If an incoming log message matches any of the configured routing criteria, it is either forwarded to the target repository, or dropped as per the configurations.
Go to Settings >> Configuration from the navigation bar and click Routing Policies.
Click the Name of the required routing policy.
Routing Policies¶
Update the information.
Click Submit.
Go to Settings >> Configuration from the navigation bar and click Routing Policies.
Click the Delete icon under the Actions column of the policy.
Routing Policies¶
To delete multiple routing policies, select the policies. Click the More drop-down menu and choose Delete Selected.
Routing Policies¶
To delete all the routing policies, click the More drop-down menu and choose Delete All.
Routing Policies¶
A delete confirmation dialog box appears on the screen. Click Yes to proceed.