Configure DataStream in a custom rule

You can create any number of custom rules in your property configuration to associate match criteria with behaviors. You can configure a DataStream behavior in a custom rule to define the hostnames within your property that you want DataStream to collect data for. Also, you can specify match criteria for incoming requests to decide when to apply the DataStream behavior. By combining match criteria with the behavior’s stream selection, DataStream ensures flexibility in collecting data based on specific requests and streams.

For more information, see Rules and matches in Property Manager.

Before you begin

Check if the property is associated with any active data streams and make note of their identifiers or names. You'll need this data when specifying the data streams that you want to collect logs for this property. See Viewing options.
CAUTION: If you associate match criteria with the CP code, Status code or the WAF variable behavior, DataStream may stop collecting and delivering log files. Before adding these behaviors, enable the DataStream behavior in the default rule, setting the Stream ID value to 1. Use your actual Stream ID in your desired match configuration.

How to

  1. On the Property Manager Editor page, click Add Rule in Property Configuration Settings.
  2. If your property is already active, click Edit New Version to introduce your changes.
  3. In Add New Rule, from Available Rules (by Category), select Blank Rule.
  4. Select Blank Rule Template and click Insert Rule.
    A New Rule entry appears in the rules column.
  5. In Criteria, add match criteria and choose one or more property hostnames to apply the DataStream behavior to.
    For a full list of matches, see Available match criteria in Property Manager.
  6. Click Add Behavior, and select DataStream.
    Depending on your configuration, you may only need to take only some of these steps:
  7. Configure the behavior.
    See step 7 in Activate or deactivate log collection for a property.

What you should see

Once the property version is active in the production environment, your data streams take about 15 minutes to adapt to the changes.

Next steps

If you deployed any of the data streams monitoring this property in an inactive state, remember to activate them in the DataStream application. See Activate or deactivate a stream.
Here, you’ve specified only two hostnames from your property configuration that DataStream collects logs for. Also, you’ll receive data sets from three data streams monitoring only the requests with an HTTP 200 response status code.