Processors: Categorized
Processors are fundamental components in log processing pipelines that perform specific operations on log data. They are responsible for transforming, enriching, and manipulating log entries as they flow through the system. Each processor is designed to handle a specific type of operation, from simple field modifications to complex data transformations.
๐ง AIโ
AI processors harness the power of artificial intelligence APIs for sophisticated content analysis and processing. These processors utilize various AI services to perform advanced text analysis, classification, and generation tasks. They enable intelligent processing of content, making it possible to extract insights and meaning from complex data.
๐ญ Anthropic
Processes content with Anthropic's Claude API
โก Azure OpenAI
Processes content with Azure OpenAI API
๐ OpenAI
Uses OpenAI's API for content analysis
๐น Analyticsโ
Analytics processors gather and manipulate data to render the data points suitable for metrics and analyses. They select the data points that reveal critical information about the generators of data, and process them to make the relevant information contained in them more visible.
๐ Confidence
Calculates confidence scores from scoring data with multiple normalization methods
๐ Debug
Logs debugging information
๐ Dynamic Sample
Adjusts sampling rates
๐ฒ Sample
Reduces data volume by sampling
๐ฏ Score
Evaluates and scores data against configurable rules for pattern recognition and classification
๐งฎ Arithmeticโ
Arithmetic processors perform mathematical operations and calculations on numeric field values within log data. They support basic mathematical functions like addition, subtraction, multiplication, and division, as well as more complex operations such as calculating percentages, averages, and statistical computations. These processors enable quantitative analysis of log data by transforming raw numbers into meaningful metrics and derived values.
๐ Abs
Absolute value of a field
โ Add
Adds numeric values
๐ผ Ceil
Rounds numbers up
โ Divide
Divides values
๐ฝ Floor
Rounds numbers down
๐ต Math
Performs mathematical operations
๐ผ Max
Calculates the maximum value
๐ฝ Min
Calculates the minimum value
๐ Modulo
Calculates the remainder
โ๏ธ Multiply
Multiplies two numeric values
โก Power
Raises a numeric value to a power
๐ Round
Rounds numeric values
โ Sqrt
Calculates the square root
โ Subtract
Subtracts numeric values
โ๏ธ Control Flowโ
Control Flow processors manage the execution paths and logic within processing pipelines. They direct how documents move through the system, handle conditional processing, and organize pipeline structure. These processors are essential for creating sophisticated processing logic and maintaining efficient pipeline organization.
๐ Case
Conditional field assignment using case-when logic
๐ Contains
Checks the presence of a value
๐ Date Index
Generates time-based index names
โ Fail
Raises failures when conditions are met
๐ Final
Terminates a pipeline
๐ Foreach
Applies processors to arrays
๐ฆ Group
Groups multiple processors together for conditional execution and organization
โ IFF
Conditional field assignment processor
๐ Pipeline
Executes another pipeline
๐ Reroute
Directs logs to specific destinations
๐ Script
Executes scripts
โ Date and Timeโ
Date and Time processors handle temporal data operations including parsing, formatting, and manipulating date and time values. They convert between different date formats, extract time components, calculate time differences, and manage timezone conversions. These processors are essential for standardizing temporal data and performing time-based analysis on log entries.
๐ Date
Parses dates from date fields
โฑ๏ธ Duration
Converts durations to seconds
โธ๏ธ Wait
Introduces a time delay
๐ Enrichโ
Enrichment processors enhance log data by incorporating additional context and information from external sources. They add value to existing data by integrating geographical information, performing DNS lookups, and adding domain intelligence. These processors connect with external databases and services to provide comprehensive context to your log data, making it more valuable for analysis and understanding.
๐ AAD Error Code
Converts Azure Active Directory error codes to human-readable descriptions
๐ Attachment
Extracts content and metadata
โญ Circle
Converts circles to polygons
๐ DNS Lookup
Performs and caches DNS lookups
๐ Enrich
Enriches documents using lookup tables and SQL queries
๐ Geo Grid
Converts geo-grid definitions to shapes
๐บ๏ธ Geo IP
Adds geographic information
๐ Lookup
Enriches documents using lookup tables
๐ Registered Domain
Extracts domain components
โ๏ธ Snowflake
Generates a unique Snowflake ID
๐ฏ Filterโ
Filter processors selectively process or exclude data based on specific criteria. They help maintain data quality by removing unwanted information, applying pattern matching for selection, and standardizing content. These processors are crucial for ensuring that only relevant data continues through the pipeline, improving processing efficiency and data clarity.
๐ซ Drop
Conditionally stops processing a document
๐ฏ Regex Filter
Filters events using regexes
๐ฏ Select
Extracts a specific element from arrays by position
โ๏ธ Slice
Extracts a portion of an array field
โ๏ธ Take
Extracts a specified number of characters or elements from strings and arrays
โ๏ธ Mutateโ
Mutation processors modify existing data fields and values to ensure proper formatting and structure. They handle tasks such as appending values, converting data types, managing dates, and manipulating strings. These processors are fundamental for maintaining data consistency and preparing information for further processing or analysis.
โ Append
Appends values to fields
๐ Bytes
Expresses values in bytes
๐งน Clean
Removes unwanted characters from string fields with configurable cleaning modes
๐ Community ID
Computes a community ID hash
๐ฏ Compact
Removes empty fields from documents
๐ Convert
Converts values between types
๐ Gsub
Regular expression-based replacement
๐ Join KV
Converts key-value pairs to a string
โ Keep
Keeps only specified fields
๐๏ธ Minify
Minifies XML, JSON, and HTML content for performance optimization
๐๏ธ Remove
Removes fields
๐ท๏ธ Rename
Renames fields
๐ฆ Serialize
Converts structured data to serialized formats like JSON, XML, CSV, and TSV
โ๏ธ Set
Sets the value of a field
๐ Sort
Sorts values in a field
โ Split
Split a string on a separator
๐ง Networkingโ
Networking processors handle network-related data operations and communications. They perform network protocol analysis, manage IP address operations, conduct DNS lookups, and handle network connectivity tasks. These processors are vital for processing network logs, analyzing network traffic patterns, and enriching data with network intelligence.
๐ DNS Query Type
Converts DNS query type numbers to human-readable names
๐ก DNS Response Code
Converts DNS response code numbers to human-readable names
๐ HTTP Status
Converts HTTP status codes to human-readable status names
๐ก ICMP Type
Converts ICMP type codes to human-readable type names
๐ IP Type
Determines IP address type (IPv4/IPv6) and network classification (Public/Private)
๐ Network Direction
Determines network traffic direction
๐ Network Protocol
Converts network protocol numbers to human-readable protocol names
๐ Parseโ
Parsing processors transform raw data into structured formats by extracting meaningful information from various input types. They handle multiple data formats and message types, converting them into structured data. These processors excel at converting unstructured or semi-structured data into well-organized, usable formats by applying patterns and rules to extract relevant fields.
๐จ CEF
Parses CEF messages
๐ Concat
Concatenates values from multiple fields into a single string
๐ CSV
Parses CSV data
๐ช Dissect
Parses data using pre-defined patterns
๐ท๏ธ FQDN
Parses and extracts components from fully qualified domain names and hostnames
๐ฏ Grok
Extracts fields with patterns
๐งน HTML Strip
Removes HTML tags
๐ JSON
Parses JSON data
๐งฉ KV Pair
Extracts key-values pairs
๐ฉ LEEF
Parses LEEF messages
๐ถ Level
Extracts log levels from messages
๐งฉ Pattern
Extracts structured patterns from log messages
๐งฉ Regex Extract
Extracts fields with named capture groups
๐ Regex Replace
Replaces text patterns using regular expressions
๐ Syslog
Parses syslog messages
๐ URI Parts
Parses URI strings into fields
๐ URL Decode
Decodes URL-encoded strings
๐ค User Agent
Parses agent strings
๐ XML
Parses XML into maps
๐ก๏ธ Securityโ
Security processors focus on protecting sensitive information and managing data security. They implement encryption and decryption operations, generate document signatures, and handle data masking and redaction. These processors ensure that sensitive information is properly protected while maintaining the utility of the data for analysis.
๐ Decrypt
Removes AES encryption from a field
๐ Encrypt
Encrypts string values using AES encryption with optional compression
๐ Fingerprint
Generates hashes to sign documents
๐ญ Mask
Masks sensitive data with hashes
โฌ Redact
Masks sensitive data
๐ค Username Type
Identifies and classifies username formats according to ASIM standards
๐ช Windows User Type
Classifies Windows user accounts based on username and SID patterns according to ASIM standards