JSON PS setting is shown at the ingestion general setting menu below,
The maximum depth limitation the JSON log clustering method looks into for each JSON log.
Zero(0) is set for no maximum depth limitation.
The default maximum matching depth is set to three(3).
Off
Off
No PS generated (Everything is PS3)
Off
On
(default behavior)
Generic PS generation method for all incoming logs
On
Off
JSON pattern only and none JSON logs get PS3
On
On
JSON logs goes to JSON ps and non-JSON goes to generic PS
Pattern-Signature feature is activated and controlled via the configuration steps below,
Go to the “Ingest Configuration” menu item to display the PS configuration fillers.
Four rows are used to manage PS features: “PS_Configure”, “PS_STREAM_ENABLE”, “PS_STEAM_MAX_SIZE”, “PS_TOTAL_STREAM_MAX_SIZE”.
Maximum number of Pattern-Signatures (PS) that each namespace-application log stream can create. The ingestion turns off the Pattern-Signature engine and assigns default null PS id *6 to that log stream. The default max count is set to 8,000.
A maximum number of total Pattern-Signatures (PS) the cluster can create. Once the total maximum count is reached, subsequent log event PS will be set to default PS id *6. The default max count is set to 20,000.
[ ( <ns> <app>,)*]
<ns> is the namespace string, a valid namespace specifier.
<app> is the application name string, a valid application specifier.
Reserved for internal use.
*3 : Disable PS generation at the top level.
*4 : PS feature is turned off from log stream configuration or FlashOps level.
*6 : Exceed PS count at either total PS count or per log stream PS count max.
