- 필수 기능
- 시작하기
- Glossary
- 표준 속성
- Guides
- Agent
- 통합
- 개방형텔레메트리
- 개발자
- API
- Datadog Mobile App
- CoScreen
- Cloudcraft
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- APM
- Continuous Profiler
- 스팬 시각화
- 데이터 스트림 모니터링
- 데이터 작업 모니터링
- 디지털 경험
- 소프트웨어 제공
- 보안
- AI Observability
- 로그 관리
- 관리
Use calculated fields to transform and enrich your log data at query time. Define formulas to:
Once defined, a calculated field can be used like any log attribute for search, aggregation, visualization, and even defining other calculated fields.
Notes:
There are two entry points for creating a calculated field in the Log Explorer: from the Add menu or from within a specific log event or attribute.
This is a quick way to create a calculated field when you are already familiar with the structure and content of the logs you are interested in.
This approach allows you to adapt quickly during an investigation or explore unfamiliar logs. For example, you may want to multiply or concatenate two values and store the result in a single field to simplify a graph or answer a specific question.
Set a descriptive name that clearly indicates the purpose of the calculated field. For example, if the goal is to capitalize users’ first and last names and concatenate them into one field, you might use the name formatted_name
for the calculated field. To subsequently filter logs from a user named Bob Smith
, update your query to include #formatted_name:"Bob Smith"
.
Note: You must use the #
prefix to refer to calculated fields in searches, aggregation, or other calculated field definitions.
The formula (or expression) determines the result to be computed and stored as the value of the calculated field for each log event. Valid constructs include log attributes, other calculated fields, and a set of supported functions and operators. Relevant fields, functions, and operators are automatically suggested as you write or edit the formula.
See Calculated Fields Expression Language for the available functions and operators.
After successful creation of a calculated field, the Log Explorer updates to:
Calculated fields function like log attributes and can be used for search, aggregation, visualization, and defining other calculated fields. Remember to use the # prefix when referencing calculated field names.
Calculated fields are not a replacement for log pipelines and processors for ingest-time parsing, normalization, and enrichment of logs. Use calculated fields in the following scenarios:
If you realize that a calculated field may be valuable in the long-term, update your log pipelines so you and the rest of your team can benefit from automated processing.
추가 유용한 문서, 링크 및 기사: