Only Administrators can take this action.
Modify a Message Processing Policy
To modify a processing policy under a log source type, you must use a raw log message from a log source associated with that log source type.
In the lower-left corner of the main screen, click the Administration cog icon.The Administration menu appears on the left side.
- Under Integrations, click Message Processing.
The Log Source Types list appears.
- Click the name of the log source type that contains the policy you want to modify.
The Log Source Type Details page appears.
- Click the Policies tab.
The Processing Policies list appears.
- Click the three-dot menu next to the policy name, and then click Edit Policy.
The Policy Builder Wizard appears.
Enter information in the following fields:
Policy Name. Enter a name for the processing policy.
Each policy name must be unique within your environment.
- (Optional) Policy Description. Enter a description for the processing policy.
- Paste a Log Message Here. Use a raw log message from a log source associated with the log source type.
The Policy Builder Workspace appears.