sequence

Predefined Fields

The goal of any log parser is to extract meaningful parts from a log message and then semantically tag them so other tools can perform analysis on the tags and values. In sequence, these tags are called fields.

sequence predefines a set of fields based on the analysis of many system and network logs. However, analysts can add their own fields to the file as well. When adding a new field, user can add a field of the format field:type to the parser portion of the configuration file in the fields array.

[parser]
fields = [
	"msgid:string",				# The message identifier
	.
	.
	.
	"userdefined1:string"			# This is user defined field #1
]

The field name can be any alphanumeric a-zA-Z0-9_] string chosen by the user. The type can be any of the pre-defined token types. The type is considered to be the default type of the field. When a field is defined in a message pattern, if no type is defined in pattern, then the default type is used. This helps reduce the amount of typing analysts have to do.

It’s highly recommended that all user defined fields are added to the end of the array, after the predefined fields. A comment explaning what it is and how it might be used is also highly recommended.

The following list of fields are predefined in the sequence.toml file.