You can modify the definitions of extracted fields.

vRealize Log Insight creates copies of the fields that you use when you create charts, queries, or alerts. If you modify a field definition, all charts, queries, and alerts that use the modified field are updated to reflect the new definition.

Normal users can modify only their own content. Administrator users can modify their own content and their shared content.

Content pack fields are read-only.

Verify that you are logged in to the vRealize Log Insight Web user interface. The URL format is https://log_insight-host, where log_insight-host is the IP address or host name of the vRealize Log Insight virtual appliance.


Navigate to the Interactive Analytics tab.


At the top of the Fields pane, click Manage extracted fields Click to edit and select an extracted field from the list.


Modify the values and click Update.

A dialog box displays a list of content that will be affected by the updated field. If the field is shared between multiple users, the dialog box also displays a list of affected users.


Click Update to confirm your changes.

vRealize Log Insight updates all queries, alerts, and charts that use the field that you modified.