Warehouse Connector: Specify Meta Filters

Document created by RSA Information Design and Development on Jul 31, 2016
Version 1Show Document
  • View in full screen mode

This topic provides instructions on how to specify meta filters in Warehouse Connector.

You need to specify the filter for each stream in the export.session.meta.fields parameter in the Explore view of the Warehouse Connector.
The following table lists the values that you can provide as a filter:

*All the collected metas are written to SAW.
*, meta1, meta2All the metas except the defined metas are written to SAW.
For example,
All the metas except ip.src is written to SAW.
meta1, meta2, meta3Only the defined metas are written to SAW.

Note: By default, the following metas are wriiten to Warehouse even if you specify them in the filter:
- ng_source
- unique_id
- time

To specify meta filters:

  1. In the Security Analytics menu, select Administration > Services.
  2. In the Services view, select a Warehouse Connector services and Actions menu cropped > View > Explore.
    The Explore view of the Warehouse Connector service is displayed.
  3. In the options panel, select warehouseconnector > streams > <stream_name> > loader > config.
  4. In the export.session.meta.fields parameter, enter the filter.
  5. Restart the stream.
You are here: Configure Warehouse Connector > Specify Meta Filters