Modify Extraction for Existing Custom Fields
Need to have the ability to modify the extraction criteria for existing Custom Fields. I have added a handful based on SharePoint ULS, but they aren't always matching properly. The only way that I have found to "improve" them is to remove the column and re-add it again.
Matt
shared this idea
8 comments
-
Anonymous
commented
Any updates on modifying the custom field extraction or even change the data type of the custom field? Since I deleted the existing custom field and tried creating a new one with the same name, a different data type and modified the extraction as well, the new logs are either not reflecting the new extraction rules or coming as blank or appearing as the old data type and not the new data type
-
Jiwanand, Ajay
commented
This is the same for Azure sentinel, any update?
-
Ryan
commented
This is a much needed feature. I have many CF's that are being used for alerts. We have alerts configured to email when a specific set of services enter a stopped state. New services have been created since the creation of the CF's. The extraction is not extracting the full name of the service. I need to edit the extraction rule to include this new service name, but cannot.
-
Anonymous
commented
Ran into this same issue! Created a bunch of custom field. Now I need to delete and re-create them as there still doesn't appear to be a way to edit.
-
Anonymous
commented
I could not agree more! This is essential. If nothing else Microsoft should allow us to write a CustomField parser that handles the parsing specifically if their attempt to match the field fails.
-
Tomas Charvat
commented
Hi, any news about this topic? I really need this for working with custom logs/custom fields
-
Stick it in Azure
commented
Any update on this? It seems like Custom Field extraction has been in preview forever! It's a very powerful component of Log Analytics which needs just a little more polish before being able to use it on a larger scale.
-
Timothy Bowen
commented
It would even be helpful to have more logs populated in the search summary after extracting a value, or an option to load more to improve the custom field more. We definitely need a way to further modify an existing custom field!