Download as PDF
The test.keep tag is used to test on the event sending.
Unlike the test.drop tag, the test.keep events are stored and can be opened using the Finder.
There are two types of this tag:
- It treats all the event content as a single text file.
- The message field is not subject of any kind of parsing, but you can run searches over it using the available character string operations.
- It maintains the syslog priority as well as two separate fields: facility and level.
- It is used to send arbitrary text strings.
- It allows to send different types of data using the type=value nomenclature and the semicolon (;) as separator between elements (e.g. type1=valueA;type2=valueB;type3=valueC...).
- It conserves the syslog priority as well as two separate fields: facility and level.
Some of the data types supported by this table:
- int4: 4 bytes integer
- int8: 8 bytes integer
- hex4: 4 bytes hexadecimal number
- hex8: 8 bytes hexadecimal number
- float8: 8 bytes floating point number
- ip4: Pv4 address
- str: Text string between quotation marks
- date: UTC date format (yyyy-MM-dd hh:mm:ss.SSS)
- millis: date in milliseconds
- epoch.millis: date format in epoch.milliseconds
Example of valid messages
- When consulting the test.keep.types table, the events would be displayed as below: