Glossary

Overview

When adding fields to a log schema or creating a new table, it is recommended to maintain consistency with terms used in other log schemas and tables. For example, src_ip and Source IP are terms commonly shared across all log schemas. Sharing the same expressions across multiple log schemas ensures a consistent normalization format.

The Glossary supports this by providing predefined terms for use in log schemas and tables. Terms categorized as fields serve as references when defining fields in a log schema, while terms categorized as tables serve as references when naming tables.

Note
Only users with administrator privileges can access the Glossary.
Using the Glossary

The Glossary is used in the Loggers > Log Schemas menu to suggest field names and display names when adding or editing a field. Selecting one of the suggested items automatically fills in the Type, Field Name, and Display Name with the selected term's information.

Viewing the term list

You can view or search the term list in Analysis > Glossary.

Glossary list

  • Locale: The language environment in which the term is used (Korean, English, Chinese (Simplified))
  • Category: The target to which the term is suggested (Field, Table)
  • Type: The data type of the term. Displayed only when the category is Field (String, Bool, Short, Integer, Long, Double, Date, Country, Port, IP Address, MD5, SHA1, SHA256, URL, Domain, BLOB).
  • Term: The string that represents the term
  • Code: The code that identifies the term. Corresponds to the Field Name in a log schema.
  • Description: A description of the term (up to 2,000 characters)
  • Modified At: The date the term was last modified, or (if no modification history exists) the date it was added

To find a specific term in the list, use the search tool in the toolbar or filter by category using the category dropdown.

  • Category dropdown: Select Field or Table to display only terms in that category.
  • Keyword search: Finds terms where the entered keyword appears in the Term, Code, or Description. The search is case-insensitive.
Download term list

To download the term list as a file to your local PC, click the Download button in the toolbar.

Refresh term list

To refresh the term list with the latest data, click the Refresh button in the toolbar.

Add term

To add a term:

  1. Click the Add button at the top of the term list.

  2. In the Add Term panel, enter or select the required values, then click OK.

    Add term

    • Locale: The language environment in which the term is used (range: Korean, English, Chinese (Simplified), default: the language set in the user's account)
    • Category: The target to which the term is suggested (range: Field, Table, default: Field)
    • Type: The data type of the term. Displayed only when Category is set to Field (range: String, Bool, Short, Integer, Long, Double, Date, Country, Port, IP Address, MD5, SHA1, SHA256, URL, Domain, BLOB, default: String)
    • Term: The term string (up to 50 characters; spaces and special characters are not allowed)
    • Code: The code that identifies the term (up to 50 characters; only letters, numbers, and underscores are allowed)
    • Description: A description of the term (up to 2,000 characters)

  3. Click OK to complete adding the term.

Note
In a multilingual environment, you must create terms separately for each language. For example, if you use Korean, English, and Chinese (Simplified), add a term for each language individually.

Edit term

To edit a term:

  1. In the term list, click the Term of the item you want to edit.
  2. In the Edit Term panel, modify the information and click OK.
Note
Editing a term does not change the properties of log schema fields or table names that reference the term.

View log schemas using a term

To view the log schemas that reference a term categorized as Field, open the Edit Term panel and check the Log Schema list at the bottom.

View log schemas using a term

The Log Schema list shows the log schemas and fields that use the Code defined in the term.

  • Log Schema: The name of the log schema that uses this code as a field
  • Type: The data type of the field
  • Field Name: The field name (code) used in the log schema
  • Display Name: The display name of the field used in the log schema

To find a specific log schema, use the search tool. The search tool finds items where the entered keyword appears in the Field Name or Display Name. The search is case-insensitive.

If there are many items in the list, click Show More to load additional items.

Delete term

To delete a term:

  1. Select the checkbox of the term you want to delete in the term list.
  2. Click the Delete button in the toolbar.
  3. In the Delete Term dialog, review the list of terms to be deleted, then click Delete. To cancel, click Cancel.