Field Mappings for External Monitoring Events

Last updated – 28 October, 2026

Mapping fields from external sources enables Edwin AI to transform incoming event data into a compatible format. Field mappings normalize values from external monitoring tools to enable you to process, relate, and use alerts and events across the platform.

Field mappings adjust incoming event payloads before they are validated and stored. This is helpful when an external source sends valid event data, but some values need to be translated, cleaned up, or associated with correct fields. Mapped fields enable you to do the following:

Normalize severity values (for example, critical or warning) or vendor-specific codes.
Convert timestamps into the expected event time format.
Turn tag arrays or label strings into enrichment fields.
Copy or rename fields when the source uses different naming conventions.
Set static values or default values for fields that are missing or blank.
Use conditional logic to derive values from one or more source fields.
Standardize strings by trimming, changing case, or replacing characters.

Field Mapping Logic and Use Cases

When Edwin AI receives an external event, it checks the event source and then applies any configured field mappings for that integration. The updated payload is then validated.

The field mapping workflow proceeds through the following steps:

Edwin AI receives an event.
Edwin reads the event source from the event payload.
It looks for configured field mappings for that integration type.
Edwin maps fields in sequence, applying the updated fields to the payload.
Edwin validates the transformed payload.
If valid, the event continues through ingestion and enrichment processing.

If multiple mappings write to the same target field, the last mapping in the list wins.

Use field mappings when event ingestion functions properly, but the resulting fields are incomplete, inconsistent, or not formatted correctly for Edwin AI. For example, if a tool sends severity as text, but Edwin AI expects a numeric severity value.

Field mappings can also adapt an incoming payload without changing the source integration or forwarder configuration. For example, if Edwin receives tags as arrays or delimited strings, but must be enrichment fields.

Other example uses cases include the following:

A timestamp is present, but not in the format Edwin AI uses.
A required or useful field requires a default value when omitted by the source.
A static enrichment, category, or domain value should be added to every matching event.
Values such as environment, region, or application names need cleanup before use.

Notes:

Field mappings are applied only for supported integration types and only when the incoming event source matches the configured integration type.
If a mapping is misconfigured, the event may ingest with unchanged values or fail validation later. For that reason, it is best to test mappings with a small sample payload first.

Field Mapping Types

External integrations often use the following mapping types:

Mapping type	What it does	Use case example
VALUE	maps one string value to another value	converting severity text such as `critical` to a numeric severity
DATETIME	parses an incoming timestamp and rewrites it in the expected format	normalizing vendor timestamps for event time
JSON_ARRAY	reads an array of strings and turns it into enrichment data	converting tags into enrichment fields
DELIMITED_KV_STRING	parses a delimited key-value string into enrichment fields	handling labels (for example, `env:prod;team:api;`)
COPY	copies a value from one field to another	moving or renaming a field
SET	writes a static value to a target field	adding a fixed domain, tier, or categorization value to matching events
DEFAULT	writes a fallback value when the target field is missing, null, or empty	populating required fields when a source does not always send them
CONDITIONAL	evaluates source values and applies the first matching action	gathering severity or enrichment values from status, message text, or other source fields
STRING_TRANSFORM	cleans up string values	trimming whitespace, changing case, or replacing characters
KEY_ALIAS	renames keys in a group of enrichment fields	standardizing vendor-specific key names

Configuring Field Mappings

In Edwin AI, navigate to Settings > Integrations.
Open the event integration you want to configure.
Locate the fieldMappings setting.
Enter the mapping definition in JSON format.
For example, see the following mapping definition:

[{"sourceField":"entity_tags","sourcePath":"cef.sourceRecord","targetPath":"enrichments","type":"JSON_ARRAY","keyValueSeparator":":"},{"field":"eventSeverity","sourceField":"event.status","sourcePath":"cef.sourceRecord","type":"VALUE","mappings":{"CLOSED":0}}]

Save the integration.
Send a test event and verify the resulting fields.

Field mappings are typically used with external monitoring sources such as Datadog, Dynatrace, SolarWinds, Splunk, Cribl, and Catchpoint.

Field Mapping Properties

Each mapping is a JSON object. The following properties tell Edwin AI where to read from, where to write the result, and which transformation to apply:

Property	Required	Default	Description
`field`	Yes	None	The target field to write to (for example, `eventSeverity`, `eventTime`, or an enrichment key.)
`type`	Yes	None	The transformer to use (for example, `VALUE`, `DATETIME`, `JSON_ARRAY`, or `KEY_ALIAS`.)
`sourceField`	No	Same as `field`	The incoming field to read from. Use this when the source field name differs from the target field name.
`sourcePath`	No	`cef`	The part of the event payload that contains the source value (for example, `cef`, `cef.sourceRecord`, and `enrichments`.)
`targetPath`	No	`cef`	Where Edwin AI writes the result. Use `cef` for standard event fields or `enrichments` for additional metadata.

Note: If a payload does not provide a sourceField value, Edwin AI reads from and writes to the same field. If sourcePath does not provide a value, Edwin AI reads from the top-level cef object.

Field Mapping Transformers

The following transformers match the shape of of incoming values from the external payload:

Transformer	Use case	Key settings
`VALUE`	Use when translating one value into another, such as vendor severity text into Edwin AI severity numbers.	`mappings`—A JSON object maps each source value to the value Edwin AI should use
`DATETIME`	Use when the source sends a timestamp, but not in the format Edwin AI expects.	`inputFormat`—The incoming date/time format in Java `DateTimeFormatter` pattern syntax
`JSON_ARRAY`	Use when the source sends a JSON array, commonly for tags or labels.	`keyValueSeparator` for arrays like `env:prod` `keyNamePrefix` to add a consistent prefix to enrichment keys When joining a simple array, use the enrichment field name.
`DELIMITED_KV_STRING`	Use when the source sends several key-value pairs in one string.	`entrySeparator` to split each pair `keyValueSeparator` to split each key from its value (Optional) `keyNamePrefix`
`COPY`	Use to copy, move, or rename a value from one field or container to another.	`sourceField` `sourcePath` `field` `targetPath` (Optional)`removeSource` Set `removeSource` to `true` to remove the original source field after copying.
`SET`	Use to assign a static value every time the mapping runs.	`field` (Optional)`targetPath` `value` The value can be a string, number, or boolean.
`DEFAULT`	Use as a fallback value only when the target field is missing, null, or an empty string.	`field` (Optional)`targetPath` `value` Existing non-empty values are not overwritten.
`CONDITIONAL`	Use to set or copy values based on a source field, such as message text, status, priority, or whether a field is present.	`sourceField`(Optional)`sourcePath` `operator` `cases` (Optional)`default` Supported operators: `EQUALS`, `CONTAINS`, `EMPTY`, and `PRESENT`. Actions can use `SET`, `COPY`, or another `CONDITIONAL`.
`STRING_TRANSFORM`	Use to clean up a text value before Edwin AI stores or uses it.	operations (for example, `TRIM`, `LOWER`, `UPPER`, or `REPLACE`.) For `REPLACE`, also include `replaceFrom` and `replaceTo`. Edwin replaces values literally. Regex is not supported.
`KEY_ALIAS`	Use to standardize multiple enrichment key names after tags or labels have been added.	`mappings`—a JSON object where each current enrichment key maps to its preferred key name, plus optional removeSource.

14-day access to the full LogicMonitor platform

Culture

Field Mapping Logic and Use Cases

Field Mapping Types

Configuring Field Mappings

Field Mapping Properties

Field Mapping Transformers