Logo

A powerful, easily deployable network traffic analysis tool suite

Quick Start

Documentation

Components

Supported Protocols

Configuring

Arkime

Dashboards

Hedgehog Linux

Contribution Guide

Adding new log fields

As several of the sections in this document will reference adding new data source fields, we’ll cover that here at the beginning.

Although OpenSearch is a NoSQL database and as-such is “unstructured” and “schemaless,” in order to add a new data source field you’ll need to define that field in a few places in order for it to show up and be usable throughout Malcolm. Minimally, you’ll probably want to do it in these three files

When possible, I recommend you to use (or at least take inspiration from) the Elastic Common Schema (ECS) Reference when deciding how to define new field names.