cfxdm - dm:fixcolumns
Remove special character from Column names
dm:fixcolumns: This cfxdm tag allows the user to remove the special characters like @,. (dot) etc from a column name. If there is a special character in between a column name (ex: First.Last), it replaces it with (underscore) (Ex: First_Last)
dm:fixcolumns syntax: It doesn't require any arguments. Just ingest the data into this tag using a pipe (-->)
In the below example, for a reference, we are going to use Netflow data that is ingested into Elasticsearch as an extension to query the data and ingest it into dm:mergecolumns to select specific columns using include/exclude or both together and merge them into a single target column.
Enter the below command to select Netflow tag (#es:netflow). (In this example, es name is used as a label to identify Elasticsearch extension and it's tags that are pointing to Netflow data index. The label is defined while adding the extension in cfxdx configuration file or through UI)
1
tag #es:netflow
Copied!
Example 1: Select three columns using the GET option from the Netflow tag.
Get the TCP protocol data from Elasticsearch Netflow tag (#es:netflow) for the last 1 hour and select the below three columns and ingest them into dm:fixcolumns tag to rename the names of the columns by replacing the special character (. (dot) with _ (underscore).
Source Columns:
    flow.client.addr
    flow.server.addr
    flow.service.port
Output Columns: (after replacing the special character ". (dot)" with "_ (underscore)"
    flow_client_addr
    flow_server_addr
    flow_service_port
1
data * get `flow.client_addr`,`flow.server_addr`,`flow.service_port` --> dm:fixcolumns
Copied!
Last modified 7mo ago
Copy link