signature

Generates a signature string composed of only the special characters in the line field and assigns it to the signature field. Use this command to extract log samples by pattern type before developing a parser.

Command properties

Syntax

Input fields

Output fields

Error codes

Parsing errors

N/A

Runtime errors

N/A

Description

The signature command extracts only the special characters from the line field string, excluding letters and digits, and assigns the result to the signature field. Special characters inside double-quoted (") sections are excluded from extraction.

This command is useful for classifying pattern types in log data. Logs with the same signature are likely to share the same format, so combining it with the stats command allows you to extract sample logs by type.

Records where the line field is null are excluded from the output.

Examples

1. Extract the first sample log per signature

   table duration=1h web_logs | signature | stats first(line) by signature
   

   Extracts the first log sample for each signature type.

2. Count logs per signature

   table duration=1d syslog | signature | stats count by signature | sort -count
   

   Counts log entries per signature and sorts them in descending order of count.

3. Filter logs matching a specific signature pattern

   table duration=1h app_logs | signature | search signature == "[] - : - //"
   

   Filters only logs that match the specified signature pattern.