Skip to content

Enricher declarations

Enrichers supplement the parsed event with extra data.

An enricher can:

  1. Create a new field in the event.
  2. Transform a field's values in some way (changing a letter case, performing a calculation, etc).

Enrichers are most commonly used to:

  1. Specify the dataset where the logs will be stored in ElasticSearch (add the field event.dataset).
  2. Obtain facility and severity from the syslog priority field.

Default IP enrichers in the common library also add geolocation and ASN (Autonomous System) data to IP fields. See Geolocation lookups and ASN enrichment.

To attach a MaxMind .mmdb database to IP fields (group and mapping), see Custom MaxMind enricher.

Declaration

define:
    type: parsec/enricher
    schema: /Schemas/ECS.yaml

enrich:
    event.dataset: <dataset_name>
    new.field: <expression>
    ...
Example

The following example is enricher used for events in syslog format. Suppose you have parser for the events of the form: 

<14>1 2023-05-03 15:06:12 server pid: Username 'HarryPotter' logged in.
The event is in the form:

{
    "log.syslog.priority": 14,
    "user.name": "HarryPotter"
}

You want to obtain syslog severity and facility, which are computed in the standard way:

(facility * 8) + severity = priority

You would also like to lower the name HarryPotter to harrypotter in order to unify the users across various log sources.

Therefore, you create an enricher:

enricher.yaml
define:
    type: parsec/enricher
    schema: /Schemas/ECS.yaml

enrich:
    event.dataset: 'dataset_name'
    user.id: !LOWER { what: !GET {from: !ARG EVENT, what: user.name} }

    # facility and severity are computed from 'syslog.pri' in the standard way
    log.syslog.facility.code: !SHR
            what: !GET { from: !ARG EVENT, what: log.syslog.priority }
            by: 3
    log.syslog.severity.code: !AND [ !GET {from: !ARG EVENT, what: log.syslog.priority}, 7 ]