How to use the Search Field Wizard

The Search Field Wizard creates or extends a Search Field straight from a logged message. You start from a real Log Event, so the wizard already knows its Message Type and uses its body and context as test data. Six steps take you from "I need to search on this value" to a saved, re-indexed Search Field.

• ✅ Start from the message you're looking at in a Log View
• ✅ Test the expression on that real message before you save
• ✅ Read the sample in the right encoding, preset from the Log Event, Endpoint, or Message Type
• ✅ Re-index so messages already logged get the value too

Wizard or editor? Use the wizard when you find a value you need to search on while analyzing logs. Use Add or manage Search Field for setup across many Message Types, for Global expressions, and for Search Field Links.

Understanding the Search Field Wizard

The wizard always works on one Message Type: the Message Type of the Log Event you start from, shown at the top of the wizard. What you add or change is a Search Field Expression for that Message Type.

Diagram: the six wizard steps. Blue steps choose what to change, yellow steps are the test loop, and green steps save and apply the Search Field.

Wizard vs the Search Field Editor

Prerequisites

• Access to a Log View that shows the messages you want to extract values from
• Permission to create or edit Search Fields (see Roles and Permissions)
• A Log Event with a message body or context to use as sample data

Step 1: Select Event

1. Open a Log View in the Web Client and search for the messages you want to extract data from.
2. Open View message body on one of the Log Events.
3. Click the Search Field Wizard button.

The Search Field Wizard button, available when you view a message body.

You can also open the wizard from Administration > Search Fields > edit a Search Field > Wizard. Then use the Select event step to pick the Log Event whose message the wizard uses as sample data.

Step 2: Select Operation

Choose what to do for the Message Type shown at the top of the wizard, then click Next.

The Select Operation step for the Hello.World.File/1.0 Message Type, with New Search Field selected.

Step 3: Search Field Details

For a New Search Field:

1. Enter a unique, business-friendly Name, such as "Order Number" or "Customer ID". Users search with this name.
2. Select the Data Type that matches the values: Text, Integer, Long Integer, Real number with 2 decimals, GUID, Double, Date time with offset, or Bitwise Integer. See Data Type Options.
3. Optionally add a Description.

For Edit or Add to, select the existing Search Field; the wizard loads its configuration.

⚠️ Choose the Data Type carefully. "Text" for numbers prevents range queries (>, <), and "Integer" for GUIDs causes extraction failures. Changing the Data Type after the Search Field is used in Log Views may cause errors when those Log Views load.

Step 4: Test the Expression

On the Test step, write the expression and test it against the message you started from.

Testing the JSON Path expression orderid against a JSON message: the Result shows one unique match, 123.

1. Select the plugin in Type. Not sure which one? See Choose a plugin.
2. Enter the Expression.
3. Click Test next to the expression under Resolvable Expressions.
4. Check the Result: the Number of unique matches and each extracted value, or an error.
5. Adjust and test again until the result is what users should search for, then click Next.

The sample is shown on the Message Body, Message Context, and Field Values tabs, so you can see what a body or context expression reads.

Choose the Encoding of the Sample Message

The Encoding dropdown below the message body tells the wizard how to read the sample. ^{New 7.11} It starts on the message's resolved encoding: the ExtendedProperties/1.0#Encoding context property, else an encoding named in the XML declaration of the body, else the Endpoint Character encoding, else the Message Type Character encoding. The Logging Service uses the same encoding to extract values, so your test result matches what gets indexed.

If characters such as Å or é show as garbage, pick another encoding and click Reload message body. If another encoding fixes it, update the encoding on the Message Type or the Endpoint, as described in Character Encoding.

The Encoding dropdown on the Test step, preset to UTF-8 (without BOM) from the Message Type. Click Reload message body after you change it.

Example: An Order Number from XML

Input

<Order>
  <OrderID>ORD-2024-12345</OrderID>
  <Customer>Contoso Corp</Customer>
</Order>

Expression

• Type: XPath
• Expression: /Order/OrderID

Result

ORD-2024-12345

Example: A Customer ID from JSON

Input

{ "order": { "orderId": "ORD-2024-12345", "customerId": "CUST-789" } }

Expression

• Type: JSON Path
• Expression: $.order.customerId

Result

CUST-789

Example: A Booking Number from Plain Text

Input

Shipment confirmed. Booking: TRN-2024-67890. Carrier: FedEx.

Expression

• Type: RegEx
• Expression: TRN-\d{4}-\d+

Result

TRN-2024-67890

RegEx returns the whole match. To return only part of a match, such as the value after Booking:, use RegEx with capturing groups.

Step 5: Summary

Review the Search Field and its expression for the Message Type, and save. From now on, the Logging Service extracts the value from new Log Events of this Message Type, and users can search on it in Log Views.

Step 6: Reindex

Log Events logged before you saved don't have the value yet. Use the Reindex step to apply the Search Field to them.

^{New 7.10.11} The wizard waits for the save to finish before it starts the re-index, so the re-index always uses the saved Search Field. A re-index runs in batches, does not block logging, and can be run again if it stops. When it finishes, the result is written to the Log Audits. See 'How a Re-Index Runs'.

Tip

Re-indexing uses database resources. On large Log Databases, test the expression first and re-index outside peak hours.

Verify the Result

1. Open a Log View that shows messages of the Message Type.
2. Filter on your new Search Field with a value you saw in the test, and search.
3. Open a Log Event and check that the Search Field has the expected value.

While a re-index is running, events still to be processed have the Processing State Reindexing.

Troubleshooting

The Search Field Wizard Button Is Missing

• Your account may lack permission to create or edit Search Fields; ask your administrator (see Roles and Permissions).
• Open View message body on a Log Event; the button is on that view.

The Test Shows No Value

• Check the expression syntax for the selected plugin (XPath and Allowed XPath expressions, JSON Path, RegEx).
• Simplify the expression to find the failing part, for example /Order before /Order/Details/Item[1]/Price.
• Check the Encoding: a sample read in the wrong encoding, or a leading byte order mark (BOM), can break the match.
• For a value in a context property, use a context plugin such as Message Context Key; body plugins don't read the context.

The Value Is Blank in Log Views After Re-Indexing

• The re-index may still be running: search for Log Events with the Processing State Reindexing, and read the result in the Log Audits.
• The expression may not match every message of the Message Type; test it with another Log Event.

Next Steps

• Add or manage Search Field - Global expressions, several Message Types, and Search Field Links
• Search Field Expressions - How expressions run and which plugin to choose
• Log Views - Search and filter on your new Search Field
• Character Encoding - How the encoding of a sample message is decided

Related Topics

• What is a Search Field?
• Search Fields Overview
• XPath
• JSON Path
• RegEx
• Flat File CSV
• Flat File Fixed Width
• Message Context Key
• Formula
• Message Types
• Log Databases
• Roles and Permissions
• Log Audit Search
• Find an order by Order Id - How business users search on a Search Field