Data LakeData Lake Administration Guide

Parser Management

Parsers are individually managed for performance and can be paused by Exabeam Data Lake . Automated Data Lake action is based on the performance thresholds from a holistic standpoint to maintain system operability.

How to Set Parser Policy

You can select the parsing policy that determines whether Exabeam Data Lake . prioritizes parsing of all ingested raw logs, events per second throughput, or a balance of both.

For custom parsers, you can adjust the threshold for pausing parsers based on resource priority:

  1. Navigate to Settings > Parsers Management > Parsers Management.

    parsers management
  2. In the Parser Policy panel, the currently active parser policy is shown at the bottom of the text.

    data lake parser policy

    Click EDIT to expand the configuration options. Select the performance preference that best suites your operation and less likely to trigger the parser to be paused. The categories are defined by the parser's impact to performance.

    parser policy selection

    The thresholds are:

    Optimized for parsing -- The parser has consumed more than 80% of Data Lake performance.

    Balanced -- The parser has consumed more than 50% of Data Lake performance.

    System Focused -- The parser has consumed more than 30% of Data Lake performance.

  3. Click APPLY to implement your preference. The parsing policy takes effect immediately. There is no need to restart services.

How to Re-enable Paused Parsers

Parsers may be paused by based on the performance threshold set by the Parser Policy. Parsers can be manually resumed but be aware they can be re-paused if the performance threshold is breached again.

To resume a paused parser:

  1. Navigate to Settings > Parsers Management > Parsers Management.

    parsers management
  2. Review the list of Paused Parsers. If you have resolved the cause of the slow parser, you may re-enable the paused parser by clicking START or the PARSE NAME checkbox for a batch start.

    data lake paused parsers