ESA rule - Search on raw

[TiagoCardoso]

Hello,

Is there any way to make an ESA rule search for a particular word that is not parsed into meta key?

[MohammedMustafa]

Hi Tiago,

Sorry for the delay, was held up in few things.

The New Meta will show up in Investigation with values, when it receives new logs & it also takes sometime to reflect.

Can you check again & let me know if the Disposition meta is showing up now?.

[TiagoCardoso]

Hello Mohammed, 

No, still not working. and I have reference id 7036 logs. 

[MohammedMustafa]

Hey Tiago,

In Investigation you are querying from your Log concentrator or Broker?.

[MohammedMustafa]

I just did the same changes in my 11.2 lab & it works fine. here are the changes & screen shot from my Investigation using Log concentrator.

Table-map-custom.xml in Log decoder:

<mapping envisionName="disposition" nwName="disposition" flags="None" format="Text" envisionDisplayName="Disposition"/>

Index-concentrator-custom-xml in Log concentrator:

<key description="Disposition" level="IndexValues" name="disposition" format="Text" valueMax="1000" defaultAction="Open"

[TiagoCardoso]

in the log decoder, in table-map.xml don't you have already a key created for disposition? or did you put it in a comment line?

[MohammedMustafa]

The line in 'Table-map.xml' file will be there and it does not affect our changes, because the flag is set as 'Transient'

<mapping envisionName="disposition" nwName="disposition" flags="Transient" format="Text" envisionDisplayName="Disposition"/>

For any Meta to be indexed, flag should be set to 'None' & this is the change we are doing in 'table-map-custom.xml' file.

[TiagoCardoso]

I done as you and its still not working... im querying the concentrator. I also tried to query the broker and its the same. The meta key is there but nothing is parsed. 

[MohammedMustafa]

Ok, Can you go to Investigate->events & see if anything is parsed in 'Disposition' meta as below?.

[TiagoCardoso]

No, its not there. But if i open the log and click " View meta"  the disposition meta key is there and parsed.

[MohammedMustafa]

Ok. so from that it is clear that there is not no need to update the parser & changes on decoder has taken effect.

I would suggest to do the below steps one more time to see if it resolves.

1. Restart nwlogdecoder service on the Decoder that sending logs to Concentrator.

2. Restart nwconcentrator service on the Concentrator that you are using for Investigation.

3. Wait for about 30 minutes & Inject new logs to Log decoder.

4. Go to Investigate & load the default Meta group to verify if the Disposition meta shows up.