New Custom Entity Type RMP Kiosk Entity #1891
Draft
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Relevant information
This is built off Log data representing various events related to custom device types. In this initial commit we are only focusing on the CSO or "Kiosk" device type.
Example ID: "USAS00001CSO33"
Where:
country = "USA"
store.number = "00001"
device.type = "CSO"
device.number = "33"
In general these are 1:1 related with a host but we do not define the relationship yet. The golden singles are some log counts with various facets.
Checklist
identifier
will be unique and valid.About the Source Data
The source data for this entity will come from
Log
. Each candidate will contain the necessary components as defined in the synthesis rule. This simple count query facets by all necessary elements:FROM Log SELECT count(*) where device.type = 'CSO' facet country, store.number, device.type, device.number
The follwoing raw sample data can be used to validate the synthesis rules. This is a "fake store" at the geographical cetner of the USA:
Note that there is an implicit 1:1 relationship with a host. For this reason we'll use the
hostname
attribute as the ID. That will allow us make queries from SystemSample and other host related events (from NR infrastructure agent) and infer insights about the specificKiosk
thatlives
on that host.For example:
In subsequent revisions we will explore creating a more formal relationship between the
Kiosk
device and it's related host.