You can modify the definitions of extracted fields.

Log Insight creates copies of the fields that you use when you create charts, queries, or alerts. If you modify a field definition, all charts, queries, and alerts that use the modified field are updated to reflect the new definition.

You can modify only fields that have the Edit this field icon Click to edit next to their names. Normal users can modify only their own content. Administrator users can modify their own content and their shared content.

Content pack fields are read-only.

Verify that you are logged in to the Log Insight Web user interface. The URL format is https://log_insight-host, where log_insight-host is the IP address or host name of the Log Insight virtual appliance.


Navigate to the Interactive Analytics tab.


In the list of fields to the right, select the field that you want to modify, and click the Edit this field icon Click to edit. If the field does not appear in the list, click the Manage extracted fields icon Click to edit above the list and select a field.


Modify the values and click Update.

A dialog box displays a list of content that will be affected by the updated field. If the field is shared between multiple users, the dialog box also displays a list of affected users.


Click Update to confirm your changes.

Log Insight updates all queries, alerts, and charts that use the field that you modified.