Creating Source Types

Source Types define how a particular kind of data is split, annotated, and indexed so that it can be searched using IBM® Operations Analytics - Log Analysis. You must create a Source Type before you can create a Data Source.

Before you begin

Before you create a Source Type, you must complete the following prerequisite tasks:
  • You must create an Insight Pack Eclipse project.
  • You must also define the Rule Sets or File Sets that are used to split and annotate the Source Type that you are creating.
  • You must define an index configuration. The index configuration determines how data of that Source Type is indexed. Index configuration is specified using JSON configuration notation.
Note: If you manually edit the metadata\sourcetypes.json for a project that you have opened in the Log Analysis Insight Pack Tooling, any changes you make are not displayed and are overwritten by changes made within the Tooling.

Procedure

  1. Open the Insight Pack editor.
  2. To open the Source Types tab, click Source Types.
  3. To create a Source Type, click Add and complete the following fields:
    1. Enter a name for the Source Type.
    2. Select a splitter that you want to use. This list is populated with the Split Rule Sets and File Sets that you created previously.
    3. Select the annotator that you wan to use. This list is populated with the Annotate Rule Sets and File Sets that you created previously.
    4. (Optional) Select the Post data on annotator execution failure option if you want data records that fail during annotation to be added.
    5. Select an index configuration for your Source Type from the Index config list.
    Note: To use an existing Source Type as a basis for a new Source Type, select a Source Type and click Copy. The copied Source Type instance is displayed in the Source Type tab and is named with the prefix CopyOf. Edit the name in the Attributes field and make any additional changes you require before you proceed.
  4. Click Finish and then save the Source Type.