Documentation - Exabeam Auto Parser Generator
- Create a Custom Parser Using Auto Parser Generator
- Prerequisites
- 1. Start from scratch or from a default parser
- 2. Import sample logs
- 3. Determine a subset of the sample logs for which to create a Parser
- 4. Add conditions
- 5. Identify the log vendor and product
- 6. Select an event type
- 7. Map event type fields to log values
- 8. Enter general information about the parser
- 9. Review the parser
- 10. Install the parser and event builder
- Duplicate a Custom Parser Using Auto Parser Generator
- Import a Custom Parser Into Auto Parser Generator
- Edit a Custom Parser in Auto Parser Generator
- Delete a Custom Parser In Auto Parser Generator
- What's New in Auto Parser Generator
Edit a Custom Parser in Auto Parser Generator
Edit an existing parser you created or finish an incomplete parser you're working on.
If you leave while creating a parser, the incomplete parser appears in the list of parsers with an In Progress status. Edit the parser to resume your work. When you're creating or editing a parser, Auto Parser Generator saves your progress after each step and after you change anything.
For the parser you're editing, click the More
menu, then select Edit.If you imported a parser, import sample logs that represent the type of information Advanced Analytics typically ingests. These sample logs ensure that you create a parser that properly extracts this information.
To select a log file from your file system, select Add a file, then drag and drop a file or click Select a File. You may upload a
.gzor.tgzfile that is no more than 100 MB.To copy and paste logs, select Copy and paste raw logs, then paste the content into the text box. You may enter up to 100 lines.
Click Find Matching Parsers.
Change the parser's conditions, associated vendor and product, event type, event type fields, name, time format, or associated log management system, then click Next until you reach the last step.
Before the Analytics Engine can use your updated parser, you must install the parser and event builder onto your environment:
To download the parser and event builder, click DOWNLOAD ZIP.
Install the parser and event builder:
If you have Advanced Analytics i54 or later, upload the file to Advanced Analytics settings.
If you have Advanced Analytics i53 or earlier, use Content Installer to install the parser and event builder.
Click Finish.