Skip to main content
After creating, monitoring, and adjusting budgets for your log data, you can use tools in Palo Alto Networks Cortex XCOR to transform, reshape, retain, or exclude data. Managing the data you persist can reduce your overall consumption, provide predictability in generated log data, and result in more performant queries when searching through logs. After sending data to Cortex XCOR, apply logic to parse, normalize, control, and format your logs before persisting the data to the database. Parsing logic and field normalization are applied before any optimization rules run.
  • Parse: To create structured logs from plaintext logs, and parse individual fields to extract meaningful data without changing your instrumentation, use parsing.
  • Normalize: To apply custom field mappings to normalize log data, use field normalization.
  • Optimize: To drop entire logs, drop individual fields, or sample a percentage of your log data, create optimization rules.
  • Format: To add context and enrich logging queries with static values, use lookup tables.