Warehouse: Specify Meta Filters

Document created by RSA Information Design and Development Employee on Nov 23, 2016
Version 1Show Document
  • View in full screen mode


This topic provides instructions on how to specify meta filters in Warehouse Connector. You need to specify the filter for each stream in the export.session.meta.fields parameter in the Explore view of the Warehouse Connector.

The following table lists the values that you can provide as a filter:

*All the collected metas are written to SAW.
*, meta1, meta2All the metas except the defined metas are written to SAW.
For example,
All the metas except ip.src is written to SAW.
meta1, meta2, meta3 Only the defined metas are written to SAW.

Note: By default, the following metas are wriiten to Warehouse even if you specify them in the filter:
- ng_source
- unique_id
- time


To specify meta filters:

  1. In the Security Analytics menu, select Administration > Services.
  2. In the Services view, select a Warehouse Connector services and Actions menu cropped > View > Explore.
    The Explore view of the Warehouse Connector service is displayed.
  3. In the options panel, select warehouseconnector > streams > <stream_name> > loader > config.
  4. In the export.session.meta.fields parameter, enter the filter.
  5. Restart the stream.
Previous Topic:Reload the Stream
You are here
Table of Contents > Additional Procedures > Specify Meta Filters