What the examples help you do

The examples show how to use dedicated OpenSearch indices, filter out data, or obfuscate data.

Using dedicated OpenSearch indices

Depending on your data, time series can grow very large. As a result, many fields are by default indexed to a single OpenSearch document. By customizing the processing configuration, you get the following benefits.
  • Process and write common data and business data to distinct OpenSearch indices, thereby reducing the number of fields that are written to each OpenSearch index.
  • Group the related business data into the same OpenSearch index.
Example 1: Processing and writing business data or common data
Example 2: Writing time series to dedicated OpenSearch indices based on the ruleset path

Filtering out data

Raw events might contain information that you do not need for your monitoring objectives. Each transformer in a processing configuration can be customized to filter out data. By customizing the processing configuration, you get the following capabilities.
  • Removing specific data fields
  • Removing items from arrays of specific business data fields
Example 3: Filtering out data

Obfuscating data

While still referencing the name of the properties, you might need to obfuscate the values to meet data privacy regulations. Thus, you can obfuscate the business data values of time series before they are written to OpenSearch. By customizing the processing configuration, you get the following capabilities.
  • Obfuscate data with nonreversible values (sha-256 or '*' character replacement)
  • Obfuscate data with a reversible value (Base64)
Example 4: Obfuscating data