Customize an Oracle-Defined Source
You can use the administration page for Sources to edit the existing Oracle-defined or Custom sources. You can augment the configuration of an Oracle-defined source to make it work better for your needs. The content that is provided from Oracle can be disabled and you can add your own content.
It is recommended that you edit and customize an Oracle-defined source instead of making a duplicate of the Oracle-defined source and editing it. The new duplicated and edited source will not get any of the future Oracle updates.
The combination of Oracle-defined enrichment and the customizations you make in the Oracle-defined source for your tenancy result in a new source for your tenancy. When Oracle provides an update to the source, those new updates will exist along with any augmented configuration you added.
You can enable log collection on the Management Agent by associating a source to one or more entities. See Configure New Source-Entity Association.
When you customize the Oracle-defined source, you can:
-
Override the parsers used
-
Disable Oracle-defined include and exclude patterns (for file, odl), listening port (for syslog)
-
Add your include and exclude patterns or listening port
-
Add your data filters
-
Disable Oracle-defined extended field definitions
-
Add your extended field definitions
-
Disable Oracle-defined label definitions
-
Add your label definitions
However, the name, description, and the entity type defined in the original Oracle-defined source cannot be changed.
Edit Source
Modify the existing source to customize it for your use case, but ensure that you consider the dependencies such as data filters, labels, extended fields, and other parser dependencies when you edit.
-
Open the navigation menu and click Observability & Management. Under Logging Analytics, click Administration. The Administration Overview page opens.
-
The administration resources are listed in the left hand navigation pane under Resources. Click Sources.
-
Click menu icon next to the source entry that you want to edit and select Edit.
The Edit Source page is displayed.
-
Modify the source definition and click Save.
Override Oracle-defined parsers
In an Oracle-defined source, the default file parsers are already specified. If you want to override the Oracle-defined parsers used or change the order in which the parsers are applied on the logs, then follow these steps:
-
Under File Parser > Specific Parsers > click Custom > click the Select Parsers area.
-
Type a few characters from the name of the parser to get the list of suggestions. Select the parser.
Repeat the selection process to include multiple parsers. You can also include parsers that you've created for this customization. Ensure to specify the parsers in the same order in which they must be applied on the logs.
Follow the above steps to customize the source if your log files are slightly different. Otherwise, create a new source.
Important: Ensure that the new parsers that you selected have the same output fields as the old parsers because of the data enrichment dependency.