Fields tab

The purpose of this tab is to manage the fields used for the published events. This tab, together with the Published Event tab, is used to define published events.

Copied Fields group consists of a list of fields to be copied from the received events to the published events.

The fields must first be defined in the Field Meta data field list in the Subscribed Event tab before they can be added to this field list.

The Virtual Fields group consists of a list of new fields to be included in the published events. These fields use expressions to set values in runtime. You can use the fields in the received events and hard-coded values with the expressions.

Virtual fields are added to the published events after the copied fields. You can also add the virtual fields to the key value field for the published event.

See the information about virtual fields required when using time and event correlation in Correlation rules.