- Log Stream Overview
- Parser Manager
- Parsers Overview
- View Parser Details
- Create a Custom Parser
- Import Sample Logs
- Define a Subset of the Sample Logs
- Add Conditions
- Add Basic Parser Information
- Extract Event Fields
- Extract Mapped JSON Fields
- Select JSON Fields from a List of Key/Value Pairs
- Select Tokenized JSON Fields from the Values in the Sample Log
- Manually Enter JSON Path Expressions
- Sample JSON Path Expressions for Manual Entry
- Reorder Mapped JSON Fields
- Review the Matching JSON Fields and Values
- Add Logic to JSON Field Extraction
- Expressions for JSON Parser Field Extractions and Enrichment Mapping
- Extract Fields Using Regular Expressions
- Reserved Fields
- Extract Mapped JSON Fields
- Add Event Builder Rules
- Review and Save Parser
- Manage Existing Custom Parsers
- Tokenize Non-Standard Log Files
- Customize a Default Parser
- Duplicate a Parser
- Enable or Disable Parsers
- Parser Updates
- Supported Vendors and Products
- Live Tail
- Enrichments
- Event Filtering
- Log Stream APIs
Log Stream APIs
Certain aspects of Log Stream functionality can be managed programmatically through Exabeam Open APIs. You can use the available APIs to help manage parsers, event builders, and event enrichers. The actions upported by the APIs include creating, editing, generating lists, and deleting.
To access Log Stream API endpoints, you must have an API key with Manage Log Stream permissions. For information about creating API keys, see Create an API Key in the API Get Started Guide.
All of the available Log Stream API endpoints start with the following base URL: /log-stream/v1/...
The tables below list all of the available Log Stream endpoints. For specific information about API request and response parameters, see the Exabeam API Reference Guide and use the left navigation panel to find the Log Stream endpoints.
Parser APIs
Endpoint | Description |
|---|---|
| List all parsers (optional |
| Get parser by ID. |
| Create a parser. |
| Update a parser. |
| Delete a parser by ID. |
| Bulk delete parsers by IDs or vendors. |
| Enable parsers. |
| Disable parsers. |
Event Builder APIs
Endpoint | Description |
|---|---|
| List all event builders. |
| Get event builder by ID. |
| Get event builders by parser ID. |
| Create an event builder. |
| Update an event builder. |
| Delete an event builder. |
Event Enricher APIs
Endpoint | Description |
|---|---|
| List enrichers (optional |
| Create an enricher. |
| Update an enricher. |
| Delete an enricher by ID. |
| Bulk delete enrichers. |
| Enable enrichers. |
| Disable enrichers. |