Is there a definitive rule on props.conf order of operation and syntax?

[paras]

Hello,

I wanted to know if there is a definitive rule on how to structure a props.conf. 

I read the docs and it does not say anything about a preference of where to call what operation. I understand the search time operation order form Extract -> Report -> Eval -> FieldAlias -> Lookup.

My question is within a stanz does all the extract have to happen at the top, then the Reports, then the Eval

Ex:

FIELDALIAS-src_ip = srcip ASNEW src_ip

FIELDALIAS-dest_ip = dstip ASNEW dest_ip

FIELDALIAS-src_port = sport ASNEW src_port

FIELDALIAS-dest_port = dport ASNEW dest_port

FIELDALIAS-authentication_protocol = protocol ASNEW authentication_protocol

FIELDALIAS-src_ip = srcip ASNEW src_ip

FIELDALIAS-dest_ip = dstip ASNEW dest_ip

FIELDALIAS-src_port = sport ASNEW src_port

FIELDALIAS-dest_port = dport ASNEW dest_port

[gcusello]

Hi @paras,

as @richgalloway said, there's no order in props.conf options because props.conf is a conf file and not a workflow, the only relevant order is that an option is always related to the stanza where it's located.

Why are you seeing datamodels' fields definition?

Datamodels' field definition is managed by GUi and you don't need to manually modify.

Ciao.

Giuseppe

[richgalloway · Accepted solution]

The order of settings within a stanza doesn't matter.