Data types and formats

The agent supports collecting a number of different types of data. These are known as "expect" types.
The currently supported expect types are:
  • Numbers
    • INTEGER: 64bit signed integer
    • DECIMAL: limited to three decimal places
  • Strings
    • KEYWORD: the value is stored *as is* with no analysis. This is perfect for fields that have just a few distinct values (also known as low cardinality), e.g. HIGH, MEDIUM, LOW. Can be used to build histograms.
    • LOG: the value is analysed, individual words or key terms (e.g. email addresses) are indexed and more advanced searches are enabled. Very well suited to free form text or log entries.
  • Other
    • BOOL: will accept any version of "truthy" (1, yes, true, T) as truth. Anything else is false.
    • DATE: required input is ISO 8601 date/time format
    • CSV: This is a fairly detailed topic, and therefore it has it's own article
    • DISCARD: Sometimes you don't have a choice in the format being sent to the agent, however you do have a choice about what is sent to the cloud.
If the agent receives the wrong type of data, then an EXPECT_ERROR is raised.