Feedback:

cluster

Use the cluster operator to generate clusters of data based on similarity.

Syntax

|cluster [threshold=<float> | match=<string> | delim=<string> | countfield=<string> | labelfield=<string> | field=<string>]

threshold=<float>

Optional. Specify a numeric value between 0 and 1 to define the sensitivity of the clustering.

If this value is closer to 1, then it will group only more similar data. Otherwise, it will group less similar data getting fewer clusters.
match=<string>

Optional. Specify the match type to be used for the clustering. Possible options:

  • termlist: Uses the delimiters option to compare the list of terms by position.

  • termset: Uses the delimiters option to compare all the distinct terms ignoring the order of them.

  • jaccard: Uses the Jaccard comparison to find the similarity among the data.

  • jaro: Uses the Jaro comparison to find the similarity among the data.

Default: termlist
delim=<string>

Optional. Specify the delimiters to be used for termlist and termset match types.

Default: ^A-Za-z0-9_
countfield=<string>

Optional. Specify the name of the output field for the number of events in the cluster.

Default: cluster_count
labelfield=<string>

Optional. Specify the name of the output field for the cluster name.

Default: cluster_label
field=<string>

Optional. Specify the name of the field from which the data will be compared.

Default: message

Usage

You can use the cluster operator for data onboarding.

Examples

Example 1: Cluster data using default similarity matching.

Copy 
test_cluster_table |cluster

Example 2: Cluster with custom matching algorithm and threshold settings.

Copy 
test_cluster_table |cluster countfield=counts labelfield=label_field threshold=0.6 field=message match=jaccard delim=',-:'

Example 3: Generate clusters using term-set comparison method.

Copy 
test_cluster_table |cluster match=termset

Example 4: Clusters the first 500 OCSF events by metadata.product.name at 60% similarity, storing cluster labels in nb_cluster and the count of events per cluster in test_count.

Copy 
ocsf | limit 500 | cluster labelfield=nb_cluster countfield=test_count threshold=0.6 field=metadata.product.name