HyperSec HyperCollector 2
  • HyperCollector 2 Setup
    • Hardware Requirements
    • Manual Installation
    • Virtual Machine
    • Physical Machine
  • Configuration
    • Preparation
    • Console Interface
      • System Options
        • Org ID
        • Site ID
        • Hostname
      • Interface Options
        • Management Interface
        • Event Interface
      • Advanced Options
        • DNS Settings
        • NTP Settings
      • About
    • Web Interface
      • Login
      • Dashboard
      • Settings
        • Sources
          • NXLog
          • Beats
          • HyperSec
          • Syslog
          • Netflow
        • Sinks
          • HTTP
          • Kafka
          • AWS S3
          • Vector
          • Splunk HEC Logs
        • System
          • Network Settings
          • System Settings
          • Advanced Settings
          • VPN Client Settings
      • Event Monitor
      • Certificates
      • Backup and Restore
      • Logout
    • MFA
      • Secure Shell
      • Web UI
  • Management
    • Accounts
    • Updates
    • Backup
    • Restore
  • Reference
    • API
    • Custom VRL Scripts
    • Sink Batch Settings
    • HyperCollector Configuration CLI
Powered by GitBook
On this page
  1. Reference

Custom VRL Scripts

Custom VRL scripts per source can be enabled for advanced customization and filtering options.

PreviousAPINextSink Batch Settings

Last updated 1 month ago

Enable custom VRL in the advanced options by setting source.custom_vrl to True.

This will provide the following files on the collector which can have custom VRL added to them. These files are not removed or overwritten if source.custom_vrl is disabled or re-enabled:

  • /etc/collector/vrl/event_beats.vrl

  • /etc/collector/vrl/event_hypersec.vrl

  • /etc/collector/vrl/event_netflow.vrl

  • /etc/collector/vrl/event_nxlog.vrl

  • /etc/collector/vrl/event_syslog.vrl

The VRL is required to be valid, and if incorrect VRL is inserted the vector instance may fail. The Administrator adding the VRL must ensure it is valid and correct.

Once edited, the Administrator must restart vector to effect the changes in the custom scripts:

systemctl restart vector