Configuration JSON
On this page, you will find information about configuration formatting. All configurations must be stored and updated in JSON format.
A JSON configuration contains required fields, as well as a field that serves as the configuration identifier. If a configuration includes required fields, they must be present when saving, even if arbitrary fields are otherwise allowed. If the identifier field differs from _id, it will automatically be duplicated in the configuration. In this case, the configuration will be saved with a specific ID and the specified identifier field set to the value of that ID. When performing an update request, the value of this field must match the {config_id}
parameter. The table below outlines in which index the configuration is stored, whether arbitrary fields not listed in required or optional ones are allowed, and whether tags are associated with the configurations.
Configuration Characteristics Table
Name | Index | Identifier Field | Required Fields | Optional Fields | Arbitrary Fields Allowed | With Tags |
---|---|---|---|---|---|---|
lookups | .sm_sme_lookups | name | idx , fields | condition , sourcetype , limit , wildcards , case_sensitive , cidrmatch | - | + |
db | .sm_sme_db | connection_name | connection_string , driver_class , driver_file | - | + | + |
db_queries | .sm_sme_db_queries | name | query | - | - | + |
dashboards | .sm_dashboards | _id | yaml | - | + | + |
scripts | .sm_sme_scripts | _id | argumentsCount , script , description , type | alias | - | - |
tags | .sm_sme_tags | _id | - | - | + | - |
search_favorites | .sm_search_favorite | _id | query , historyQueryId , user | - | - | - |
search_histories | .sm_search_history | _id | query , timestamp , user | - | - | - |
search_anywhere_sources | .sm_sme_search_anywhere_sources | _id | source_type | server , port , user , path_to_trust_store , trust_store_password , password , connection_string , connection_url | - | + |
persons | .sm_persons | _id | - | - | + | - |
Additional Features
The fields
, wildcards
, case_sensitive
, and cidrmatch
fields in lookups are passed as arrays of strings.
The type
field in scripts
can only be one of the following values: internal
, external
, or system
.
If a configuration contains a password
field, it will be stored and displayed in encrypted form.