8 Replies Latest reply on May 12, 2017 12:35 PM by klance

    MEF fields

    aleksa

      Hi all,

       

      is there any way to extend default field list that is suggested when You do field mapping with your custom table (view)? I need more string fields .

      I successfully connected Oracle database with receiver and map fields from my view to fields that are exists in client (example: i have field SY_ACTION and I mapped it with suggested field Action etc.).

       

      Thank You in advance,

      Alex

        • 1. Re: MEF fields
          xded

          You can add custom Types  and after you adding this custom type you can these new custom type to your field mapping.

          • 2. Re: MEF fields
            aleksa

            Hi xded,

             

            thank You for answer. Is there any way if You can describe me that procedure or point to literature? Where I can add custom type field?

             

            Thank You in advance.

             

            Best regards,

            Alex.

            • 3. Re: MEF fields
              xded

              Sure i can =).

               

              1. Go to the System Properties of the ESM

              2. On the leftside of the new windows there is a menupoint called "Custom Types" click on it

              3. Now you have two options. First there is a Custom Types for your need or ther is no one.

              4. If is the last point correct than you can creat your own Custom Type with the add button.  In the porductguid of version 10 on the site 335

              5. After that you should add this new custom type in the parser rule under field mapping or you can it via the + button

              1 of 1 people found this helpful
              • 4. Re: MEF fields
                andy777

                To expand on xded's well stated steps, you can have 10 custom fields per rule but they do overload other fields so if you're missing a field that you expect, go to System Properties | Custom Types and sort by Event Field. Note that you can only use one of any given field that shares an Event Field ID.

                1 of 1 people found this helpful
                • 5. Re: MEF fields
                  aleksa

                  Hi xded,

                   

                  thank You for Your help. Now, I'm not using parser, I'm using MEF. Is it possible to have custom fields mapping on event collector?

                   

                  Thank You in advance,

                  Alex.

                  • 6. Re: MEF fields
                    xded

                    Hi Alex,

                     

                    all logs must be parsed it make no matters that the receiver get this logs via MEF or Syslog. But you can't change the orig. Windows Parser.

                    • 7. Re: MEF fields
                      aleksa

                      Thanks in prompt answer,

                      but I have field mapping in collector. Can I leave field mapping to <none>?

                       

                      Best regards

                      • 8. Re: MEF fields
                        klance

                        It might be simpler to change from MEF field mappings to syslog transmission and then generate custom rules.