Rules and Rule Packs
In Apica Ascent, rules and rule packs play a pivotal role in data management, allowing users to effectively manage the cost and flow of their data. Here’s a
concise overview
Creating Rules: Users can create a new rule within a specific namespace and application flow. This is done by hovering over any log line and selecting “”Create rule.”” Once established, the rule applies to every log incoming in that flow.
Types of Rules
Filter Rule: It filters events based on certain criteria, controlling the volume of data stored or processed. For example, you can create a filter rule to drop all log lines containing DEBUG or INFO severity levels.
Extract Rule: This rule helps extract unstructured data from log lines using re2 RegEx pattern expressions. It evaluates incoming log lines and extracts specified fields.
SIEM (Log-to-Metric) Rule: Converts incoming log data into real-time timeseries metrics. It’s used for visualizing log data, plotting distributions, creating custom indexes, and alerting for events like user login failures or load-balancer status codes.
Rewrite Rule: Used for redacting or replacing sensitive data in compliance with data security regulations. It utilizes RegEx to match and mask patterns in incoming data.
Forward Rule: Applied when routing logs to downstream destinations. These rules can be used to selectively forward data, ensuring compliance and reducing data volume.
Rule Packs: Rule Packs are collections of various types of rules (FILTER, EXTRACT, SIEM, REWRITE, FORWARD). Users can access built-in rule packs or create new ones. Each pack can be edited to suit specific needs and activated or deactivated as required.
Managing Rules: Users can view, edit, and delete rules via the rules list page, which offers filters and status checks. The detailed view of each rule is accessible, providing options for modification or removal.