Format Journal Entry Data - ironstream_for_splunk - ironstream_for_elastic - ironstream_for_kafka - Ironstream_Hub - 1.3

If a specific *FILE object is being monitored, then a set of File Field Descriptions may be attached to each journal monitor to annotate which fields of the journal entry should be forwarded.

1. From the Configuration Tool, select the File Field Descriptions tab and define a new configuration group to hold the file field descriptions.
2. To create a list of file field descriptions from a known *FILE object, click the Create button, or click the Generate button to send a query to the Ironstream Agent for IBM i, and the fields of the *FILE object specified will be automatically populated.
3. For each field, enter a label name, the field type, the column number of the record where the field starts, and the length of the field. (If monitoring the fields of a *FILE object, these values can be pulled from the output of a DSPFFD command).
   Figure 1. Configure Field Descriptions

   
4. Click the Save button to save the Fields Description group.
5. Select the Journal Monitors tab to select which monitor to apply these fields descriptors to.
6. After the journal monitors of a group have been defined, assigned to systems and saved, click the Distribute button to distribute the monitors to the Ironstream Agent for IBM i for the Assigned Systems. The new monitors will be used by the running subsystem immediately after the distribution is completed.
   Note: All journal monitor groups that are assigned to a system will be distributed to the Ironstream Agent for IBM i on that system. Each monitor group will be stored as a separate member of the configuration file in the EVIEW library and a separate journal monitor job will be started for each journal monitor group.
7. On the Systems tab, restart each System that is in the Assigned systems list of the newly created Journal Monitor Group.