Create a Log Processor in ObserveOps
Processors run on a log after a parser has extracted its fields. They transform, enrich, or remove fields before the log reaches storage. You add processors inside a pipeline. Each processor runs in order after parsing, top to bottom.
Add a Processor to a Pipeline
Open a pipeline from Settings > Observability Pipeline > Log Pipeline. Click + Create New Processor inside the pipeline.
Choose the processor type from the list.
The Create Processor screen includes Indexed Logs and Live Trail tabs so you can test the processor configuration against real or sample logs:
The Indexed Logs tab displays the parsed logs.
Processor Types
ObserveOps supports eight processor types.
URL Enricher
Parses a URL field into its component parts. Set the source field that contains the full URL. ObserveOps adds each component as a new field on the log.
Fields added: scheme, host, path, port, query, and fragment.
| Setting | Description |
|---|---|
| Source Field(s) | The field on the log that contains the URL to parse. |
| Target Field Path | The field path where ObserveOps upends the parsed URL components. |
User-Agent Enricher
Parses a User-Agent string into individual metadata fields. Set the source field that contains the User-Agent value.
Fields added: browser name, version, os.name, os.version, device.
| Setting | Description |
|---|---|
| Source Field(s) | The field on the log that contains the User-Agent string. |
| Target Field Path | The field path where ObserveOps upends the parsed user-agent components. |
Geo IP Enricher
Adds geographic location data to a log based on an IP address. Set the source field containing the IP address. ObserveOps queries the GeoIP database and adds location fields to the log.
Fields added: country, city, domain, isp, asn, aso, and threat.
| Setting | Description |
|---|---|
| Source Field(s) | The field on the log that contains the IP address to look up. |
| Target Field Path | The field path where ObserveOps upends the parsed geo-ip components. |
Remapper
Copies the value of a source field or tag into a new field or tag. You can add more than one mapping in a single Remapper processor. Each log passing through the processor is remapped based on the source fields it contains.
Configuration settings:
| Setting | Description |
|---|---|
| Source Field(s)/ Tag Key(s) | The field(s) or tag(s) to copy the value from. |
| Target Field/ Tag Key | The field or tag to copy the value into. |
| Retain Source Field | Enabled by default. When on, the original source stays on the log. Turn it off to remove the source after copying. |
| Override on Conflict | Controls what happens when the target already has a value on the log. |
You can define more than one source-to-target mapping in a single processor. Each log is processed based on which source field(s) it contains out of the defined mappings.
Tag Remapper
Applies a tag to a log when it matches a filter condition. Use it to classify logs based on field values without changing the fields themselves.
| Setting | Description |
|---|---|
| Filter | A condition the log must match to receive the tag. Uses standard filter syntax. |
| Tag | The tag to apply when the filter matches. Use key:value format. |
Example: Set filter to status.code in range 500 to 599 and tag to api_error:technical. Every log with a status code between 500 and 599 receives the tag api_error:technical.
Arithmetic Processor
Performs arithmetic on one or more numeric fields and stores the result in a new field.
Supported operators: + - * /
| Setting | Description |
|---|---|
| Field Operations | The arithmetic formula using {Field Names} and operators. |
| Target Field | The name of the new field to store the result in. |
Behavioral rules:
- If any field referenced in the expression is not present on the log, the processor skips that log entirely. No result is written.
- If the target field already exists on the log, the processor overwrites it.
String Builder
Concatenates two or more fields into a new field.
| Setting | Description |
|---|---|
| Field Operations | The {Fields} to concatenate, in the order they should appear. |
| Target Field | The name of the new field to store the concatenated result in. |
Behavioral rules:
- The processor only runs on logs where all specified source fields are present.
- Logs missing any source field are skipped entirely.
Like the Arithmetic Processor, the String Builder only runs when all referenced fields are present in the same log.
Field Remover
Removes one or more fields from a log after parsing. The fields are dropped before the log reaches storage. Use it to strip sensitive data or reduce log size.
| Setting | Description |
|---|---|
| Field(s) | A list of field names to remove from the log. |
The field(s) you list are deleted from every log that passes through this processor. If a listed field is not present on a particular log, the processor skips that field silently and continues.
Processor Ordering
Processors run in order, top to bottom, after parsing is complete. Every log parsed in the pipeline passes through each processor in sequence.
Processors always appear below parsers in the pipeline view. You can drag processors to reorder them among themselves, but you cannot move a processor above a parser.
-->