Edit and Save a Remap Mapping

Overview

This page covers editing and saving remap rules. For how the engine resolves paths and what each mapping section controls, see Remap Concepts.

Add an input path to a field

To add an input path to a field, follow these steps:

  1. In the new Kloudfuse UI, go to Admin > Logs Remap.

  2. Select the agent tab for the ingestion agent you want to change.

  3. Click Load a live sample to pull a real payload. To supply or adjust one by hand, switch to Raw and edit the Input pane directly.

  4. Find the field in Core, Cloud metadata, or Kubernetes, and click + Path.

  5. Enter the JSONPath, starting with $.. The input suggests paths found in the loaded sample.

  6. Drag the row to position it — higher rows win over lower ones.

  7. Confirm the result in the Output pane. A USED badge marks the row that resolved.

  8. Click Save, then confirm.

To add a custom label, expand Custom labels, click + Add label, and enter the path. To remove a custom row, use the x control at the end of the row; default rows have no remove control.

Unsaved changes

Edits are local until you save. While you have unsaved changes:

  • Agent tabs with pending edits are marked, so you can see which agents you have touched.

  • Added and changed rows are highlighted, reordered lists show a badge, and rows you removed appear as struck-through ghost rows against the live configuration.

  • Discard changes appears in the header and reverts everything to the last saved state.

The header status line reads Live · by <user> · <time>, showing who last saved the configuration and when. It is empty until the configuration is first saved — that is, while the engine defaults alone are running.

Save behavior

Saving writes the live configuration directly. There is no draft or staging step. The change applies to all agents of that type across the cluster and takes effect within approximately 30 seconds.

The editor saves the configuration for every agent at once, not just the tab you are viewing. Changes affect data ingested after the save; already-ingested logs are not reprocessed.

Saving succeeds even if the remap engine is disabled for your deployment (global.logs.remap.enabled: false) — the change has no effect on ingestion in that case, and the page gives no indication of it. See Enabling the remap engine.

Best practices

Confirm against a real sample before saving

Always load a live sample and check the Output pane. A path that looks right can silently resolve to nothing, and the engine’s built-in extraction can mask the mistake by filling the field anyway — until you query data the defaults do not cover.

Prefer reordering over adding

If the value you want is already extracted by a default row, promoting that row is safer than adding a duplicate custom path.

Keep paths specific

An overly broad path may match different structures across events from the same agent. Anchor paths to the level you actually mean.

Watch cardinality on custom labels

Every custom label multiplies the label combinations Kloudfuse stores. Promote dimensions you group by, not identifiers you search for — a value you only ever look up is better left in the message.

Change one thing at a time

Because the save is global and immediate, make one mapping change, verify it in the Logs explorer, and then make the next.

Next steps