Excluding and combining columns

Excluding columns

If you do not want to display a column that is included in a DSV log file, do not specify that column when you add indexConfig sections to the properties file. For example, if you do not want to display columns 2, 3, and 4 of a 5 column log file, only specify the field1_indexConfig and field5_indexConfig property sections.

Combining columns

You can combine multiple columns from the DSV log file into one column in the Search workspace by specifying multiple paths in one indexConfig section. The section with multiple paths must be the one with the highest column number to ensure that the correct annotation is applied to the DSV log file. Fields that are part of the combined column, but are otherwise unimportant, can have all true/false index configuration fields set to false to ensure that data that is not required is not indexed.

The sample properties file combines the 2nd and 4th columns of the DSV log file into one column when it is displayed in the IBM Operations Analytics Log Analysis Search workspace.

[field2_indexConfig]
name: shortMessage
dataType: TEXT
retrievable: false
retrieveByDefault: false
sortable: false
filterable: false
searchable: false


[field4_indexConfig]
name: longMessage
dataType: TEXT
retrievable: true
retrieveByDefault: true
sortable: false
filterable: false
searchable: true
path_1: shortMessage
combine: ALL