Fields Page

Click the Fields tab for a closer look at the fields within the indexed data for an object group. The Fields list shows each field in the indexed data, its name and data type. From this pane you can also change a field to enable or disable field masking.

If you change a field's settings, the Apply button is activated. When you finish changing settings, click Apply to save the changes.

👍

Enabled only with Groups tab.

The Fields page is not available unless the Groups tab option is enabled for the cluster.

Masking Settings

Masking a field in an object group hides the content of the field in the search results of any views that use the object group's indexed data intervals. The field is present in the indexed data schema, but the field and its contents will not be displayed in the Search Analytics or SQL Analytics query results nor will it be available for search filters.

To set the masking setting for a field:

1. For the field that you want to update, go to the Masked column and click the slider bar to enable masking, or click the slider to stop masking a field.
2. Click Apply to place the changes into effect.

For Search Analytics, a masked field and its values will not appear as Search Analytics filtering columns or as part of the results. For SQL Analytics, the field will be visible as a column in the search results, but the data for the masked column appears as NULL for numbers or as an empty string. You can also mask and unmask fields in an object group using the ChaosSearch object group API endpoints.

A sample Discover for an orders-view follows. In this example, the object group used by the view does not mask any columns. Note the visible filter columns and values for o_orderpriority and o_shippriority.

In a view that uses an identical object group for the same log and event files, but the object group masks the o_orderpriority and o_shippriority fields, the filter columns and results in the records are not visible to the view user.

In Superset for the same view of the masked group, the columns are visible in the UI, but the row values for masked columns are null or empty in the result set:

Masking an object group field masks the content for any views that use the daily interval data for that object group. As an alternative, you could mask columns in a view to control column visibility on a role-by-role basis; that is, users who have access to a view in which all of the columns are unmasked can see all of the data, while users for a different view with masked columns can see only the content for the unmasked fields. You can mask view columns using the ChaosSearch view API endpoints.

Note that the mask applies to all rows previously ingested and indexed for the object group's intervals, as well as to any future ingested data while the masking is enabled. Disabling a mask for an object group field or a view column makes the row data immediately visible to views that query against the data.