This document provides and overview of the various ways you can use the Ingest Wizard to ingest data, and includes the following topics:
- Accessing the Ingest Wizard
- Use case #1: ingest one file
- Use case #2: transform your data
- Use case #3: add a Lookup table
- Use case #4: run a batch job
- Use case #5: ingest from multiple data sources into one table
For information on how to ingest data through the Interana CLI, see the CLI ingest Quick Start.
Accessing the Ingest Wizard
You must have Interana admin role permissions to be able to configure ingest on your Interana cluster.
To bring up the Ingest Wizard, do the following:
- Open a browser window.
- Navigate to https://<cluster_location>/?import.
- Log in with your admin credentials, or the Interana default login credentials:
- Username: root@localhost
- Password: root
Use case #1: ingest one file
Ingesting one file using the Ingest Wizard follows this basic process:
- Name your event table and choose a sample file.
- Configure the table and manage transformations, as necessary.
- Ingest the sample file.
Use case #2: transform your data
It's not unusual to look at the preview of your data and realize that it isn't making it into Interana quite the way you would like. That could be because your data needs cleansing, or your logging format needs some transformation before it can be read naturally by Interana. In either case, you can use the Interana Transformer Library to do lightweight transformation and cleansing of your data.
Use case #3: add a Lookup table
Once you have your event data looking good in Interana, you can ingest one or more lookup tables related to your event table. Lookup tables are not event data; they don't have a timestamp, and instead represent static contextual information that is attached to a particular column of your event data.
See the Intro to Lookup tables for more information about lookup tables and how they are used within Interana.
Use case #4: run a batch job
Once you have proven out that your data is structured the way you expect and ingests cleanly into Interana, you'll typically want to set up a batch ingest job. This can be a continuous job, scanning for new data as it is generated, or a one-time job, to backfill existing data.
Use case #5: ingest from multiple data sources into one table
Once you have configured your table and set up a batch job to continuously load data into it, you may discover that you have additional data sources that you'd like to load into the same table. To achieve this, you can choose to "add data to an existing table" on the first page of the wizard.
In this scenario, you cannot modify the time and actor columns since they were already configured when you created the table. In fact, you will likely need to apply transformations to your new data source so that its fields (especially time and actor columns) map cleanly into the ones expected by your existing table.