TCP Server

The TCP Server origin listens at the specified port numbers, establishes TCP sessions with clients that initiate TCP connections, and then processes the incoming data. The origin can process data from tables with simple numeric primary keys. The origin cannot process data from tables with compound or non-numeric primary keys. For information about supported versions, see Supported Systems and Versions in the Data Collector documentation.

The origin can operate in different modes. The modes determine the messages that it can process. It can process NetFlow messages or syslog messages. It can also process supported Data Collector data formats passed as data separated by specified characters, passed as character-based data with length prefixes, or passed in Flume events as Avro messages.

The TCP Server can process data from multiple clients simultaneously, creating separate batches for each client, and sending acknowledgements to the originating client after parsing each record or committing each batch. You can configure the origin to use multiple threads to improve performance when processing of large volumes of data. And on 64-bit Linux systems, you can enable native Epoll transports to further improve performance.

When a pipeline stops, the TCP Server origin notes where it stops reading. When the pipeline starts again, the origin continues processing from where it stopped by default. You can reset the origin to process all requested data.

When you configure the TCP Server origin, you specify the ports to use and the TCP mode that indicates the type of data the origin will receive. Then you configure mode-related properties, such as the characters that separate records.

You can optionally configure the acknowledgements that you want to send and the amount of time that the origin waits to receive data before closing the connection. You can also configure SSL/TLS properties, including default transport protocols and cipher suites.

Multithreaded Processing

The TCP Server origin performs parallel processing and enables the creation of a multithreaded pipeline.

When you enable multithreaded processing, the TCP Server origin uses multiple concurrent threads based on the Number of Receiver Threads property. When you start the pipeline, the origin creates the number of threads specified in the property.

As clients initiate TCP connections, the origin establishes TCP sessions and waits for data. Upon filling a batch, the origin passes the batch to an available pipeline runner.

A pipeline runner is a sourceless pipeline instance - an instance of the pipeline that includes all of the processors, executors, and destinations in the pipeline and handles all pipeline processing after the origin. Each pipeline runner processes one batch at a time, just like a pipeline that runs on a single thread. When the flow of data slows, the pipeline runners wait idly until they are needed, generating an empty batch at regular intervals. You can configure the Runner Idle Time pipeline property to specify the interval or to opt out of empty batch generation.

Multithreaded pipelines preserve the order of records within each batch, just like a single-threaded pipeline. But since batches are processed by different pipeline runners, the order that batches are written to destinations is not ensured.

For example, say you enable multithreaded processing and set the Number of Receiver Threads property to 5. When you start the pipeline, the origin creates five threads, and Data Collector creates a matching number of pipeline runners. Upon receiving data, the origin passes a batch to each of the pipeline runners for processing.

Each pipeline runner performs the processing associated with the rest of the pipeline. After a batch is written to pipeline destinations, the pipeline runner becomes available for another batch of data. Each batch is processed and written as quickly as possible, independent from other batches processed by other pipeline runners, so batches may be written differently from the read order.

At any given moment, the five pipeline runners can each process a batch, so this multithreaded pipeline processes up to five batches at a time. When incoming data slows, the pipeline runners sit idle, available for use as soon as the data flow increases.

For more information about multithreaded pipelines, see Multithreaded Pipeline Overview.

Closing Connections for Invalid Data

When the TCP Server origin receives invalid data, it closes the connection to the TCP client that sent the data. It also passes the data to the pipeline for error handling.

For example, when you configure the origin, you specify the maximum record size. When a TCP client sends a message that translates to larger than the maximum record size, the origin disconnects from the client and passes the message to the pipeline for error handling.

Similarly, say the TCP Server origin is configured to process XML data. If the origin receives an invalid XML document, it disconnects from the sending client and passes the data to the pipeline for error handling.

Sending Acknowledgements

You can configure the TCP Server origin to send acknowlegements, a.k.a. acks., to the originating client. The acknowledgement message can be a simple text message, such as "Ack". Or, you can use the expression language to include additional information in the message.

The origin can send two types of acknowledgements:

record processed acknowledgement: When you configure a record processed acknowledgement, the origin sends acks after it receives and processes each record. It sends the ack after parsing a record from the incoming data.
batch completed acknowledgement: When you configure a batch completed acknowledgement, the origin sends acks after the pipeline completes processing the batch. It sends the ack after the batch is committed to all destinations.

Using Expressions in Messages

You can use the Data Collector expression language to create custom acknowledgement messages. You might use expressions to include information about Data Collector, the pipeline, record, or batch in the message.

For example, if you have multiple Data Collectors processing data from the same client, you might use the following record processed message to include the Data Collector host name and the pipeline title in the message, along with a record identifier:

${record:value('/id')} was processed by Data Collector: ${sdc:hostname()}, 
pipeline: ${pipeline:title()}.

You can set the time zone to use for datetime values returned by expressions. By default, the origin uses UTC.

Note: In a batch completion message, record functions return information from the last record in the batch.

You can use the batchSize variable to return the number of records included in the batch. The batchSize variable can be used only with the TCP Server origin and must be typed into the message. The batchSize variable does not appear in the expression completion list.

For example, the following message includes the number of records in the batch, the transaction ID of the last record in the batch, and the pipeline that performed the processing:

Pipeline: ${pipeline:title()} committed a batch whose last record was 
${record:value('/transactionID')} and included ${batchSize} messages.

TCP Modes

The TCP Server origin processes data differently depending on the mode that you select. The origin provides the following modes:

NetFlow messages

The TCP Server origin can process NetFlow 5 and NetFlow 9 messages. When processing NetFlow messages, the stage generates different records based on the NetFlow version. When processing NetFlow 9, the records are generated based on the NetFlow 9 configuration properties. For more information, see NetFlow Data Processing.

To process NetFlow messages, set the TCP Mode property to NetFlow. Then, for NetFlow 9 data, configure the properties on the NetFlow 9 tab. NetFlow 5 data does not require additional configuration.

syslog messages

The TCP Server origin processes syslog messages in accordance with RFC 6587, except the origin does not support method changes.

The TCP Server origin can process the following types of syslog messages:

RFC 5424
RFC 3164
Non-standard common messages, such as RFC 3339 dates with no version digit

To process syslog messages, set the TCP Mode property to "syslog" and configure the transfer framing mode.

Important: All TCP clients must use the same transfer framing mode to transmit data.

Use one of the following transfer framing modes:

Octet counting - The frame indicates the length of the syslog message and includes the entire contents of the message.
Non-transparent framing - The frame includes the syslog message and a user-defined trailing separator characters. The origin uses the separator characters to create records.
Use the following Java Unicode syntax to specify a separator character:
```
\u<Unicode character code>
```
To define multiple characters, simply list them as a group as appropriate, such as:
```
\u<Unicode character code>\u<Unicode character code>\u<Unicode character code>
```
For example, the default separator character is line feed, whose Unicode character code is 000A. To specify this as the separator character, enter \u000A.

Separated records

The TCP Server origin can process the supported Data Collector data formats when the data is separated by the specified record separator characters.

To process supported data formats, set the TCP Mode property to Separated Records and specify the record separator characters. Then, specify the data format of the data and configure any related properties.

Important: All TCP clients must use the same record separator characters.

Character data with length prefix

The TCP Server origin can process the supported Data Collector data formats when passed as character-based data with a length prefix.

To process supported data formats, set the TCP Mode property to Character Data with Length Prefix and specify the character set of the data. Then, specify the data format of the data and configure any related properties.

A length prefix consists of the digits that indicate the length of the data, and a space character. The data to be converted to a record should immediately follow the space character.

Note: The length prefix must be in a single-byte encoding, such as UTF-8. The data can be in any valid character set, which you specify in the origin.

For example, say a TCP client sends the following UTF-8 data:

11 hello world

The length prefix is "11 ", which indicates that the data to be converted is 11 bytes long. The origin then converts the following 11 bytes, "hello world" to a record.

You can use this TCP mode to capture raw syslog messages that are framed with octet counting into a string field.

Flume Avro IPC Server

The TCP Server origin can process the supported Data Collector data formats when passed in Flume events as Avro messages from a Flume Avro sink. Use the TCP Server origin instead of the HTTP Server origin to more efficiently process Flume events.

To process supported data formats, set the TCP Mode property to Flume Avro IPC Server and configure the additional Bind Address property. Then, specify the data format of the data and configure any related properties.

Data Formats

In Separated Record or Character Data with Length Prefix TCP mode, the TCP Server origin processes data differently based on the data format.

The origin can also process the following types of data when separated by the appropriate record separator:

Avro

Generates a record for every message. Includes a precision and scale field attribute for each Decimal field.

The stage includes the Avro schema in an avroSchema record header attribute. You can use one of the following methods to specify the location of the Avro schema definition:

Message/Data Includes Schema - Use the schema in the message.
In Pipeline Configuration - Use the schema that you provide in the stage configuration.
Confluent Schema Registry - Retrieve the schema from Confluent Schema Registry. Confluent Schema Registry is a distributed storage layer for Avro schemas. You can configure the stage to look up the schema in Confluent Schema Registry by the schema ID embedded in the message or by the schema ID or subject specified in the stage configuration.

Using a schema in the stage configuration or retrieving a schema from Confluent Schema Registry overrides any schema that might be included in the message and can improve performance.

Binary

Generates a record with a single byte array field at the root of the record.

When the data exceeds the user-defined maximum data size, the origin cannot process the data. Because the record is not created, the origin cannot pass the record to the pipeline to be written as an error record. Instead, the origin generates a stage error.

Delimited

Generates a record for each delimited line.

The CSV parser that you choose determines the delimiter properties that you configure and how the stage handles parsing errors. You can specify if the data includes a header line and whether to use it. You can define the number of lines to skip before reading, the character set of the data, and the root field type to use for the generated record.

You can also configure the stage to replace a string constant with null values and to ignore control characters.

For more information about reading delimited data, see Reading Delimited Data.

JSON

Generates a record for each JSON object. You can process JSON files that include multiple JSON objects or a single JSON array.

When an object exceeds the maximum object length defined for the origin, the origin processes the object based on the error handling configured for the stage.

Log

Generates a record for every log line.

When a line exceeds the user-defined maximum line length, the origin truncates longer lines.

You can include the processed log line as a field in the record. If the log line is truncated, and you request the log line in the record, the origin includes the truncated line.

You can define the log format or type to be read.

Protobuf

Generates a record for every protobuf message. By default, the origin assumes messages contain multiple protobuf messages.

Protobuf messages must match the specified message type and be described in the descriptor file.

When the data for a record exceeds 1 MB, the origin cannot continue processing data in the message. The origin handles the message based on the stage error handling property and continues reading the next message.

For information about generating the descriptor file, see Protobuf Data Format Prerequisites.

SDC Record

Generates a record for every record. Use to process records generated by a Data Collector pipeline using the SDC Record data format.

For error records, the origin provides the original record as read from the origin in the original pipeline, as well as error information that you can use to correct the record.

When processing error records, the origin expects the error file names and contents as generated by the original pipeline.

Text

Generates a record for each line of text or for each section of text based on a custom delimiter.

When a line or section exceeds the maximum line length defined for the origin, the origin truncates it. The origin adds a boolean field named Truncated to indicate if the line was truncated.

For more information about processing text with a custom delimiter, see Text Data Format with Custom Delimiters.

XML

Generates records based on a user-defined delimiter element. Use an XML element directly under the root element or define a simplified XPath expression. If you do not define a delimiter element, the origin treats the XML file as a single record.

Generated records include XML attributes and namespace declarations as fields in the record by default. You can configure the stage to include them in the record as field attributes.

You can include XPath information for each parsed XML element and XML attribute in field attributes. This also places each namespace in an xmlns record header attribute.

When a record exceeds the user-defined maximum record length, the origin skips the record and continues processing with the next record. It sends the skipped record to the pipeline for error handling.

Use the XML data format to process valid XML documents. For more information about XML processing, see Reading and Processing XML Data.

Tip: If you want to process invalid XML documents, you can try using the text data format with custom delimiters. For more information, see Processing XML Data with Custom Delimiters.

Configuring a TCP Server Origin

Configure a TCP Server origin to process data provided through TCP/IP connections.

In the Properties panel, on the General tab, configure the following properties:


General Property	Description
Name	Stage name.
Description	Optional description.
On Record Error	Error record handling for the stage: Discard - Discards the record. Send to Error - Sends the record to the pipeline for error handling. Stop Pipeline - Stops the pipeline.

On the TCP tab, configure the following properties:


TCP Property	Description
Port	Port number to listen to for data. You can specify multiple port numbers. Note: No other pipelines or processes can already be bound to the listening port. The listening port can be used only by a single pipeline.
Bind Address	Bind address. Use the default, 0.0.0.0, to bind to all IPv4 addresses on the Data Collector machine. Used only with the Flume Avro IPC Server TCP mode.
TCP Mode	TCP mode to use. Select one of the following options: NetFlow syslog Separated records - Use to process supported Data Collector data formats that are separated by separator characters. Character data with length prefix - Use to process supported Data Collector data formats passed as character data with a length prefix. The length prefix must be in a single-byte encoding, such as UTF-8. For more information, see TCP Modes. Flume Avro IPC Server - Use to process supported Data Collector data formats passed in Flume events as Avro messages.
Record Separator	One or more characters used by TCP clients to separate records. Specify one or more characters using the Java Unicode syntax, as follows: `\u<Unicode character code>`. To specify multiple characters, repeat the syntax for each character, as follows: `\u<Unicode character code>\u<Unicode character code>\u<Unicode character code>`.
Ack Time Zone	Time zone to use for acknowledgement messages. Any dates returned by functions are adjusted to the specified time zone.
Record Processed Ack Message	Acknowledgement message to send after processing a record. When configured, the origin sends a message after processing each record. You can use expressions to include additional information in the message. For more information, see Using Expressions in Messages. By default, no acknowledgement is sent.
Batch Completed Ack Message	Acknowledgement message to send after processing a batch. When configured, the origin sends a message after each batch of data is committed to all destinations. You can use expressions to include additional information in the message. Record functions return information from the last record in the batch. For more information, see Using Expressions in Messages. By default, no acknowledgement is sent.
Enable Native Transports (Epoll)	On 64-bit Linux machines, enables the use of native Epoll transports. Use to improve pipeline performance.
Number of Receiver Threads	Number of receiver threads to use for each port. For example, if you configure two threads per port and configure the origin to use three ports, the origin uses a total of six threads. This property determines how many threads the origin generates and uses for multithreaded processing. For more information, see Multithreaded Processing. Minimum number of threads is 1.
Max Batch Size (messages)	Maximum number of messages to include in a batch and pass through the pipeline at one time. Honors values up to the Data Collector maximum batch size. Default is 1000. The Data Collector default is 1000.
Max Batch Wait Time (ms)	Number of milliseconds to wait before sending a partial or empty batch.
Max Message Size (bytes)	Maximum message size in bytes to be converted into a record. When a message is larger than the maximum message size, the origin disconnects from the originating client and passes the record to the pipeline for error handling.
Charset	Character set of the data to be processed. Used only with the Character-Data with Length Prefix TCP mode.
Read Timeout (seconds)	Amount of time that a connection can be open without reading any data. After this amount of idle time, Data Collector closes the connection. Specify in seconds. Minimum value is 1, and maximum value is 3,600. Default is 300.

When processing data in Syslog TCP mode, on the Syslog tab, configure the following properties:


Syslog Property	Description
Syslog Message Transfer Framing Mode	The framing mode that the TCP clients use to pass the data. Use one of the following options: Octet Counting - The message is entirely enclosed in the frame. Non-transparent-framing - The message includes trailing separator characters to indicate the end of the message.
Non-transparent-framing Separator	One or more separator characters used to separate records. Specify one or more characters using the Java Unicode syntax, as follows: `\u<Unicode character code>`. To specify multiple characters, repeat the syntax for each character, as follows: `\u<Unicode character code>\u<Unicode character code>\u<Unicode character code>`. Used with the non-transparent framing mode only.
Charset	Character encoding of the data to be processed.

When processing data in Separated Record, Character Data with Length Prefix, or Flume Avro IPC Server TCP mode, click the Data Formats tab and configure the Data Format of the data.

For Avro data, on the Data Format tab, configure the following properties:


Avro Property	Description
Avro Schema Location	Location of the Avro schema definition to use when processing data: Message/Data Includes Schema - Use the schema in the message. In Pipeline Configuration - Use the schema provided in the stage configuration. Confluent Schema Registry - Retrieve the schema from Confluent Schema Registry. Using a schema in the stage configuration or in Confluent Schema Registry can improve performance.
Avro Schema	Avro schema definition used to process the data. Overrides any existing schema definitions associated with the data. You can optionally use the `runtime:loadResource` function to load a schema definition stored in a runtime resource file.
Schema Registry URLs	Confluent Schema Registry URLs used to look up the schema. To add a URL, click Add and then enter the URL in the following format: `http://<host name>:<port number>`
Basic Auth User Info	User information needed to connect to Confluent Schema Registry when using basic authentication. Enter the key and secret from the `schema.registry.basic.auth.user.info` setting in Schema Registry using the following format: `<key>:<secret>` Tip: To secure sensitive information such as user names and passwords, you can use runtime resources or credential stores. For more information about credential stores, see Credential Stores in the Data Collector documentation.
Lookup Schema By	Method used to look up the schema in Confluent Schema Registry: Subject - Look up the specified Avro schema subject. Schema ID - Look up the specified Avro schema ID. Embedded Schema ID - Look up the Avro schema ID embedded in each message. Overrides any existing schema definitions associated with the message.
Schema Subject	Avro schema subject to look up in Confluent Schema Registry. If the specified subject has multiple schema versions, the stage uses the latest schema version for that subject. To use an older version, find the corresponding schema ID, and then set the Look Up Schema By property to Schema ID.
Schema ID	Avro schema ID to look up in Confluent Schema Registry.

For binary data, on the Data Format tab, configure the following properties:


Binary Property	Description
Compression Format	The compression format of the files: None - Processes only uncompressed files. Compressed File - Processes files compressed by the supported compression formats. Archive - Processes files archived by the supported archive formats. Compressed Archive - Processes files archived and compressed by the supported archive and compression formats.
File Name Pattern within Compressed Directory	For archive and compressed archive files, file name pattern that represents the files to process within the compressed directory. You can use UNIX-style wildcards, such as an asterisk or question mark. For example, .json. Default is , which processes all files.
Max Data Size (bytes)	Maximum number of bytes in the message. Larger messages cannot be processed or written to error.

For delimited data, on the Data Format tab, configure the following properties:


Delimited Property	Description
Header Line	Indicates whether a file contains a header line, and whether to use the header line.
Delimiter Format Type	Delimiter format type. Use one of the following options: Default CSV - File that includes comma-separated values. Ignores empty lines in the file. RFC4180 CSV - Comma-separated file that strictly follows RFC4180 guidelines. MS Excel CSV - Microsoft Excel comma-separated file. MySQL CSV - MySQL comma-separated file. Tab-Separated Values - File that includes tab-separated values. PostgreSQL CSV - PostgreSQL comma-separated file. PostgreSQL Text - PostgreSQL text file. Custom - File that uses user-defined delimiter, escape, and quote characters. Multi Character Delimited - File that uses multiple user-defined characters to delimit fields and lines, and single user-defined escape and quote characters. Available when using the Apache Commons parser type.
Multi Character Field Delimiter	Characters that delimit fields. Default is two pipe characters (\|\|). Available when using the Apache Commons parser with the multi-character delimiter format.
Multi Character Line Delimiter	Characters that delimit lines or records. Default is the newline character (\n). Available when using the Apache Commons parser with the multi-character delimiter format.
Delimiter Character	Delimiter character. Select one of the available options or use Other to enter a custom character. You can enter a Unicode control character using the format `\uNNNN`, where N is a hexadecimal digit from the numbers 0-9 or the letters A-F. For example, enter `\u0000` to use the null character as the delimiter or `\u2028` to use a line separator as the delimiter. Default is the pipe character ( \| ). Available when using the Apache Commons parser with a custom delimiter format.
Field Separator	One or more characters to use as delimiter characters between columns. Available when using the Univocity parser.
Escape Character	Escape character. Available when using the Apache Commons parser with the custom or multi-character delimiter format. Also available when using the Univocity parser.
Quote Character	Quote character. Available when using the Apache Commons parser with the custom or multi-character delimiter format. Also available when using the Univocity parser.
Line Separator	Line separator. Available when using the Univocity parser.
Allow Comments	Allows commented data to be ignored for custom delimiter format. Available when using the Univocity parser.
Comment Character	Character that marks a comment when comments are enabled for custom delimiter format. Available when using the Univocity parser.
Enable Comments	Allows commented data to be ignored for custom delimiter format. Available when using the Apache Commons parser.
Comment Marker	Character that marks a comment when comments are enabled for custom delimiter format. Available when using the Apache Commons parser.
Lines to Skip	Number of lines to skip before reading data.
Compression Format	The compression format of the files: None - Processes only uncompressed files. Compressed File - Processes files compressed by the supported compression formats. Archive - Processes files archived by the supported archive formats. Compressed Archive - Processes files archived and compressed by the supported archive and compression formats.
File Name Pattern within Compressed Directory	For archive and compressed archive files, file name pattern that represents the files to process within the compressed directory. You can use UNIX-style wildcards, such as an asterisk or question mark. For example, .json. Default is , which processes all files.
CSV Parser	Parser to use to process delimited data: Apache Commons - Provides robust parsing and a wide range of delimited format types. Univocity - Can provide faster processing for wide delimited files, such as those with over 200 columns. Default is Apache Commons.
Max Columns	Maximum number of columns to process per record. Available when using the Univocity parser.
Max Character per Column	Maximum number of characters to process in each column. Available when using the Univocity parser.
Skip Empty Lines	Allows skipping empty lines. Available when using the Univocity parser.
Allow Extra Columns	Allows processing records with more columns than exist in the header line. Available when using the Apache Commons parser to process data with a header line.
Extra Column Prefix	Prefix to use for any additional columns. Extra columns are named using the prefix and sequential increasing integers as follows: `<prefix><integer>`. For example, `_extra_1`. Default is `_extra_`. Available when using the Apache Commons parser to process data with a header line while allowing extra columns.
Max Record Length (chars)	Maximum length of a record in characters. Longer records are not read. This property can be limited by the Data Collector parser buffer size. For more information, see Maximum Record Size. Available when using the Apache Commons parser.
Ignore Empty Lines	Allows empty lines to be ignored. Available when using the Apache Commons parser with the custom delimiter format.
Root Field Type	Root field type to use: List-Map - Generates an indexed list of data. Enables you to use standard functions to process data. Use for new pipelines. List - Generates a record with an indexed list with a map for header and value. Requires the use of delimited data functions to process data. Use only to maintain pipelines created before 1.1.0.
Parse NULLs	Replaces the specified string constant with null values.
NULL Constant	String constant to replace with null values.
Charset	Character encoding of the files to be processed.
Ignore Control Characters	Removes all ASCII control characters except for the tab, line feed, and carriage return characters.

For JSON data, on the Data Format tab, configure the following properties:


JSON Property	Description
JSON Content	Type of JSON content. Use one of the following options: JSON array of objects Multiple JSON objects
Compression Format	The compression format of the files: None - Processes only uncompressed files. Compressed File - Processes files compressed by the supported compression formats. Archive - Processes files archived by the supported archive formats. Compressed Archive - Processes files archived and compressed by the supported archive and compression formats.
File Name Pattern within Compressed Directory	For archive and compressed archive files, file name pattern that represents the files to process within the compressed directory. You can use UNIX-style wildcards, such as an asterisk or question mark. For example, .json. Default is , which processes all files.
Max Object Length (chars)	Maximum number of characters in a JSON object. Longer objects are diverted to the pipeline for error handling. This property can be limited by the Data Collector parser buffer size. For more information, see Maximum Record Size.
Charset	Character encoding of the files to be processed.
Ignore Control Characters	Removes all ASCII control characters except for the tab, line feed, and carriage return characters.

For log data, on the Data Format tab, configure the following properties:


Log Property	Description
Log Format	Format of the log files. Use one of the following options: Common Log Format Combined Log Format Apache Error Log Format Apache Access Log Custom Format Regular Expression Grok Pattern Log4j Common Event Format (CEF) Log Event Extended Format (LEEF)
Compression Format	The compression format of the files: None - Processes only uncompressed files. Compressed File - Processes files compressed by the supported compression formats. Archive - Processes files archived by the supported archive formats. Compressed Archive - Processes files archived and compressed by the supported archive and compression formats.
File Name Pattern within Compressed Directory	For archive and compressed archive files, file name pattern that represents the files to process within the compressed directory. You can use UNIX-style wildcards, such as an asterisk or question mark. For example, .json. Default is , which processes all files.
Max Line Length	Maximum length of a log line. The origin truncates longer lines. This property can be limited by the Data Collector parser buffer size. For more information, see Maximum Record Size.
Retain Original Line	Determines how to treat the original log line. Select to include the original log line as a field in the resulting record. By default, the original line is discarded.
Charset	Character encoding of the files to be processed.
Ignore Control Characters	Removes all ASCII control characters except for the tab, line feed, and carriage return characters.

When you select Apache Access Log Custom Format, use Apache log format strings to define the Custom Log Format.
When you select Regular Expression, enter the regular expression that describes the log format, and then map the fields that you want to include to each regular expression group.
When you select Grok Pattern, you can use the Grok Pattern Definition field to define custom grok patterns. You can define a pattern on each line.
In the Grok Pattern field, enter the pattern to use to parse the log. You can use a predefined grok patterns or create a custom grok pattern using patterns defined in Grok Pattern Definition.
For more information about defining grok patterns and supported grok patterns, see Defining Grok Patterns.

When you select Log4j, define the following properties:


Log4j Property	Description
On Parse Error	Determines how to handle information that cannot be parsed: Skip and Log Error - Skips reading the line and logs a stage error. Skip, No Error - Skips reading the line and does not log an error. Include as Stack Trace - Includes information that cannot be parsed as a stack trace to the previously-read log line. The information is added to the message field for the last valid log line.
Use Custom Log Format	Allows you to define a custom log format.
Custom Log4J Format	Use log4j variables to define a custom log format.

For protobuf data, on the Data Format tab, configure the following properties:


Protobuf Property	Description
Protobuf Descriptor File	Descriptor file (.desc) to use. The descriptor file must be in the Data Collector resources directory, `$SDC_RESOURCES`. For more information about environment variables, see Data Collector Environment Configuration in the Data Collector documentation. For information about generating the descriptor file, see Protobuf Data Format Prerequisites.
Message Type	The fully-qualified name for the message type to use when reading data. Use the following format: `<package name>.<message type>`. Use a message type defined in the descriptor file.
Delimited Messages	Indicates if a file might include more than one protobuf message.
Compression Format	The compression format of the files: None - Processes only uncompressed files. Compressed File - Processes files compressed by the supported compression formats. Archive - Processes files archived by the supported archive formats. Compressed Archive - Processes files archived and compressed by the supported archive and compression formats.
File Name Pattern within Compressed Directory	For archive and compressed archive files, file name pattern that represents the files to process within the compressed directory. You can use UNIX-style wildcards, such as an asterisk or question mark. For example, .json. Default is , which processes all files.

For SDC Record data, on the Data Format tab, configure the following properties:


SDC Record Property	Description
Compression Format	The compression format of the files: None - Processes only uncompressed files. Compressed File - Processes files compressed by the supported compression formats. Archive - Processes files archived by the supported archive formats. Compressed Archive - Processes files archived and compressed by the supported archive and compression formats.
File Name Pattern within Compressed Directory	For archive and compressed archive files, file name pattern that represents the files to process within the compressed directory. You can use UNIX-style wildcards, such as an asterisk or question mark. For example, .json. Default is , which processes all files.

For text data, on the Data Format tab, configure the following properties:


Text Property	Description
Compression Format	The compression format of the files: None - Processes only uncompressed files. Compressed File - Processes files compressed by the supported compression formats. Archive - Processes files archived by the supported archive formats. Compressed Archive - Processes files archived and compressed by the supported archive and compression formats.
File Name Pattern within Compressed Directory	For archive and compressed archive files, file name pattern that represents the files to process within the compressed directory. You can use UNIX-style wildcards, such as an asterisk or question mark. For example, .json. Default is , which processes all files.
Max Line Length	Maximum number of characters allowed for a line. Longer lines are truncated. Adds a boolean field to the record to indicate if it was truncated. The field name is Truncated. This property can be limited by the Data Collector parser buffer size. For more information, see Maximum Record Size.
Use Custom Delimiter	Uses custom delimiters to define records instead of line breaks.
Custom Delimiter	One or more characters to use to define records.
Include Custom Delimiter	Includes delimiter characters in the record.
Charset	Character encoding of the files to be processed.
Ignore Control Characters	Removes all ASCII control characters except for the tab, line feed, and carriage return characters.

For XML data, on the Data Format tab, configure the following properties:


XML Property	Description
Delimiter Element	Delimiter to use to generate records. Omit a delimiter to treat the entire XML document as one record. Use one of the following: An XML element directly under the root element. Use the XML element name without surrounding angle brackets ( < > ) . For example, msg instead of <msg>. A simplified XPath expression that specifies the data to use. Use a simplified XPath expression to access data deeper in the XML document or data that requires a more complex access method. For more information about valid syntax, see Simplified XPath Syntax.
Compression Format	The compression format of the files: None - Processes only uncompressed files. Compressed File - Processes files compressed by the supported compression formats. Archive - Processes files archived by the supported archive formats. Compressed Archive - Processes files archived and compressed by the supported archive and compression formats.
File Name Pattern within Compressed Directory	For archive and compressed archive files, file name pattern that represents the files to process within the compressed directory. You can use UNIX-style wildcards, such as an asterisk or question mark. For example, .json. Default is , which processes all files.
Preserve Root Element	Includes the root element in the generated records. When omitting a delimiter to generate a single record, the root element is the root element of the XML document. When specifying a delimiter to generate multiple records, the root element is the XML element specified as the delimiter element or is the last XML element in the simplified XPath expression specified as the delimiter element.
Include Field XPaths	Includes the XPath to each parsed XML element and XML attribute in field attributes. Also includes each namespace in an xmlns record header attribute. When not selected, this information is not included in the record. By default, the property is not selected.
Namespaces	Namespace prefix and URI to use when parsing the XML document. Define namespaces when the XML element being used includes a namespace prefix or when the XPath expression includes namespaces. For information about using namespaces with an XML element, see Using XML Elements with Namespaces. For information about using namespaces with XPath expressions, see Using XPath Expressions with Namespaces. Using simple or bulk edit mode, click the Add icon to add additional namespaces.
Output Field Attributes	Includes XML attributes and namespace declarations in the record as field attributes. When not selected, XML attributes and namespace declarations are included in the record as fields. By default, the property is not selected.
Max Record Length (chars)	The maximum number of characters in a record. Longer records are diverted to the pipeline for error handling. This property can be limited by the Data Collector parser buffer size. For more information, see Maximum Record Size.
Charset	Character encoding of the files to be processed.
Ignore Control Characters	Removes all ASCII control characters except for the tab, line feed, and carriage return characters.

To use SSL/TLS, click the TLS tab and configure the following properties:


TLS Property	Description
Use TLS	Enables the use of TLS.
Use Remote Keystore	Enables loading the contents of the keystore from a remote credential store or from values entered in the stage properties. For more information, see Remote Keystore and Truststore.
Private Key	Private key used in the remote keystore. Enter a credential function that returns the key or enter the contents of the key.
Certificate Chain	Each PEM certificate used in the remote keystore. Enter a credential function that returns the certificate or enter the contents of the certificate. Using simple or bulk edit mode, click the Add icon to add additional certificates.
Keystore File	Path to the local keystore file. Enter an absolute path to the file or enter the following expression to define the file stored in the Data Collector resources directory: `${runtime:resourcesDirPath()}/keystore.jks` By default, no keystore is used.
Keystore Type	Type of keystore to use. Use one of the following types: Java Keystore File (JKS) PKCS #12 (p12 file) Default is Java Keystore File (JKS).
Keystore Password	Password to the keystore file. A password is optional, but recommended. Tip: To secure sensitive information such as passwords, you can use runtime resources or credential stores. For more information about credential stores, see Credential Stores in the Data Collector documentation.
Keystore Key Algorithm	Algorithm to manage the keystore. Default is SunX509.
Use Default Protocols	Uses the default TLSv1.2 transport layer security (TLS) protocol. To use a different protocol, clear this option.
Transport Protocols	TLS protocols to use. To use a protocol other than the default TLSv1.2, click the Add icon and enter the protocol name. You can use simple or bulk edit mode to add protocols. Note: Older protocols are not as secure as TLSv1.2.
Use Default Cipher Suites	Uses a default cipher suite for the SSL/TLS handshake. To use a different cipher suite, clear this option.
Cipher Suites	Cipher suites to use. To use a cipher suite that is not a part of the default set, click the Add icon and enter the name of the cipher suite. You can use simple or bulk edit mode to add cipher suites. Enter the Java Secure Socket Extension (JSSE) name for the additional cipher suites that you want to use.

For NetFlow 9 data, on the NetFlow 9 tab, configure the following properties:

When processing earlier versions of NetFlow data, these properties are ignored.


Netflow 9 Property	Description
Record Generation Mode	Determines the type of values to include in the record. Select one of the following options: Raw Only Interpreted Only Both Raw and Interpreted
Max Templates in Cache	The maximum number of templates to store in the template cache. For more information about templates, see Caching NetFlow 9 Templates. Default is -1 for an unlimited cache size.
Template Cache Timeout (ms)	The maximum number of milliseconds to cache an idle template. Templates unused for more than the specified time are evicted from the cache. For more information about templates, see Caching NetFlow 9 Templates. Default is -1 for caching templates indefinitely.