- Log Stream Overview
- Supported Vendors and Products
- Parser Manager
- Parsers Overview
- View Parser Details
- Create a Custom Parser
- Import Sample Logs
- Define a Subset of the Sample Logs
- Add Conditions
- Add Basic Parser Information
- Extract Event Fields
- Extract Mapped JSON Fields
- Select JSON Fields from a List of Key/Value Pairs
- Select Tokenized JSON Fields from the Values in the Sample Log
- Manually Enter JSON Path Expressions
- Sample JSON Path Expressions for Manual Entry
- Reorder Mapped JSON Fields
- Review the Matching JSON Fields and Values
- Add Logic to JSON Field Extraction
- Expressions for JSON Parser Field Extractions and Enrichment Mapping
- Extract Fields Using Regular Expressions
- Reserved Fields
- Extract Mapped JSON Fields
- Add Event Builder Rules
- Review and Save Parser
- Manage Existing Custom Parsers
- Tokenize Non-Standard Log Files
- Customize a Default Parser
- Duplicate a Parser
- Enable or Disable Parsers
- Parser Updates
- Live Tail
- Enrichments
- Event Filtering
Manually Enter JSON Path Expressions
To enter a JSON path expression manually, follow the procedure described below.
Note
If you are using this procedure to extract values from array objects, the examples of extracted expressions in the table below are based on this full input log.
In the JSON Path Expression table at the top of the screen, click + New JSON Path Expression, if necessary, to add an empty row to the table.
In the JSON Path Expressions column, enter a JSON expression that defines the field you want to extract value from. The following syntax formats are available:
$.field_name– Extracts an explicit value using an absolute JSON path expression. Example:$.activity_type$..field_name– Can be used to extract a substring of a value or to perform a recursive search to extract a repeatable value at any level in the JSON structure. Example:$..activity_typeexa_regex=(Regex expression)– Extracts a value, from any level of the JSON structure, using a regex expression in a hybrid parser. Example:[exa_regex=(({src_ip}((([0-9a-fA-F.]{0,4}):{1,2}){1,7}([0-9a-fA-F]){1,4})|(((25[0-5]|(2[0-4]|1\d|[0-9]|)\d)\.?\b){4}))(:({src_port}\d+))?)]
For some sample expressions using each of the above syntax, see Sample JSON Path Expressions for Manual Entry. The sample expressions also include ways to extract values from more complex array objects.
Tip
Before you begin mapping complex values, consider whether you may need to create custom fields to map them to. To create custom fields, click the + New custom field option at the bottom of the left side panel and follow the steps in Fields Panel.
After entering a manual JSON path expression, use the drop down menu in the Select a Field column to select a CIM field that you want to map the expression to. The options are listed according to whether they are core, detection, or informational fields for the specified activity type. You can also click + New field at the bottom of the list and create a custom field.
Optionally, if you want to apply conditions to the way a field value from the log is extracted for mapping to the selected CIM field, insert a logical condition in the Extraction Condition column.
For more information about implementing this type of logic, see Add Logic to JSON Field Extraction.
Optionally, you can also use the Substring Regex column to define a condition that extracts a specific value from within a string and maps only that value to a CIM field.
For more information about implementing this type of logic, see Add Logic to JSON Field Extraction.
To save the mapping, click the check at the far right side of the row. The field mapping is saved.
Check the Sample Log Lines section at the bottom of the page, to see if the mapped field extracts any value from the sample log. Extracted values appear above the log line and are highlighted in various colors.
Note
For mapped field values extracted from an array object, the extracted values appear listed above the log in various colors but are not highlighted in the sample log line itself.
To map another JSON field, click + New JSON Path Expression. A new row appears in the table.
Repeat the process to manually enter a JSON path expression, map it to a CIM field, and click the check to save the field mapping.
Continue to add JSON path expression rows until you have mapped all of the core fields and any of the detection, informational, or custom fields you think will be useful.
After you have selected all of the necessary fields for extraction, ensure the fields are in the correct order, review the matching event type fields and log values, then continue building your custom parser by configuring event builders.