signature

Generates a signature string composed of only the special characters in the line field and assigns it to the signature field. Use this command to extract log samples by pattern type before developing a parser.

Command properties

Syntax

The signature command does not accept any options or positional arguments. In the 4.0 series starting with 4.0.2609.0, entering a non-whitespace value after the command name causes an error.

Input fields

Output fields

Error codes

Parsing errors

Runtime errors

N/A

Description

The signature command extracts only the special characters from the line field string, excluding letters and digits, and assigns the result to the signature field. Special characters inside double-quoted (") sections are excluded from extraction.

This command is useful for classifying pattern types in log data. Logs with the same signature are likely to share the same format, so combining it with the stats command allows you to extract sample logs by type.

Records where the line field value is missing (null) do not get a signature field assigned. When records are processed one at a time, such records are excluded from the result; when multiple records are processed as a batch, they are included in the result with their original fields but without a signature field.

Examples

1. Extract the first sample log per signature

   table duration=1h web_logs | signature | stats first(line) by signature
   

   Extracts the first log sample for each signature type.

2. Count logs per signature

   table duration=1d syslog | signature | stats count by signature | sort -count
   

   Counts log entries per signature and sorts them in descending order of count.

3. Filter logs matching a specific signature pattern

   table duration=1h app_logs | signature | search signature == "[] - : - //"
   

   Filters only logs that match the specified signature pattern.

Change history