From 592d6c61559d6cdd49d55d87f47730d75e90280a Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Mon, 13 Jan 2025 12:23:33 +0530 Subject: [PATCH] Update dynamic-parsing.md --- .../get-started-with-search/build-search/dynamic-parsing.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/search/get-started-with-search/build-search/dynamic-parsing.md b/docs/search/get-started-with-search/build-search/dynamic-parsing.md index 1b1cffbe41..308c3b56f4 100644 --- a/docs/search/get-started-with-search/build-search/dynamic-parsing.md +++ b/docs/search/get-started-with-search/build-search/dynamic-parsing.md @@ -37,9 +37,7 @@ Run Time FERs have a scope, exactly like an Ingest Time FER, that defines which 1. Enter the following options: * **Rule Name**. Type a name that makes it easy to identify the rule. - * **Applied At**. Select **Run Time**. - * **Scope**. Select **Specific Data** and define the scope of your JSON data. You can define your JSON data source as a [Partition](/docs/manage/partitions) Name(index), sourceCategory, Host Name, Collector Name, or any other [metadata](../search-basics/built-in-metadata.md) that describes your JSON data. Think of the Scope as the first portion of an ad hoc search, before the first pipe (`|`). You will use the Scope to run a search against the rule. You can't use keywords like “info” or “error” in your scope. Always set up JSON auto extraction (Run Time field extraction) on a specific Partition name (recommended) or a particular Source. Failing to do so might cause the auto parsing logic to run on data sources where it is not applicable and will add additional overhead that might deteriorate the performance of your queries. @@ -111,7 +109,9 @@ Search results table: * The query `_sourceCategory = A or _sourceCategory = B` is applied, only within the log lines that fall within `_sourceCategory = A`, while the remaining log lines are not parsed by this Run Time FER. 1. If a field does not exist in the schema of the log message, null results are displayed for the field (instead of erroring out). - + :::note + When a field contains null values, dynamic parsing attempts to interpret those values and assigns them a string data type. This can create issues if you expect different data types for that field. To resolve the issue, use `field=*` in the source expression to eliminate null values. + ::: 1. Ingest Time FERs take precedence for field assignments. A Run Time FER will not override a field assignment from an Ingest Time FER. Conflicts between Ingest and Run Time fields are evaluated by each log line in the following ways: