- Log Stream Overview
- Parser Manager
- Parsers Overview
- View Parser Details
- Create a Custom Parser
- Import Sample Logs
- Define a Subset of the Sample Logs
- Add Conditions
- Add Basic Parser Information
- Extract Event Fields
- Extract Mapped JSON Fields
- Select JSON Fields from a List of Key/Value Pairs
- Select Tokenized JSON Fields from the Values in the Sample Log
- Manually Enter JSON Path Expressions
- Reorder Mapped JSON Fields
- Review the Matching JSON Fields and Values
- Add Logic to JSON Field Extraction
- Expressions for Extraction Conditions
- Array Log Sample
- Extract Fields Using Regular Expressions
- Extract Mapped JSON Fields
- Add Event Builder Rules
- Review and Save Parser
- Manage Existing Custom Parsers
- Tokenize Non-Standard Log Files
- Customize a Default Parser
- Duplicate a Parser
- Enable or Disable Parsers
- Live Tail
Select Tokenized JSON Fields from the Values in the Sample Log
To select fields from the already tokenized values in the sample log:
In the Sample Log Lines section at the bottom of the screen, click on one of the tokenized values highlighted in grey. A Map Token to Event Field dialog box opens.
In the dialog box, use the drop down menu to select the CIM field you want to map the tokenized value to. The options are listed according to whether they are core, detection, or informational fields for the specified activity type. You can also click + New field at the bottom of the list and create a custom field.
Click Map Extraction to save the mapping.
Check on the following after you save the mapping:
In the table of mapped JSON fields at the top of the screen, ensure that a new row has been added. It should include the tokenized value you selected, the CIM field you mapped it to, and the JSON path expression that defines it.
In the Sample Log Lines section at the bottom of the screen, ensure that the mapped field extracts the appropriate value from the sample log. Mapped values appear highlighted in various colors.
Optionally, if you want to apply conditions to the way a field value from the log is extracted for mapping to the selected CIM field, insert a logical condition in the Extraction Condition column.
For more information about implementing this type of logic, see Add Logic to JSON Field Extraction.
Optionally, you can also use the Substring Regex column to define a condition that extracts a specific value from within a string and maps only that value to a CIM field.
For more information about implementing this type of logic, see Add Logic to JSON Field Extraction.
Repeat the process to select another tokenized value from the sample log, select a CIM field, and click Map Extraction to save the field mapping.
Continue to select and map tokenized values until you have mapped all of the core fields and any of the detection, informational, or custom fields you think will be useful.
After you have selected all of the necessary fields for extraction, ensure the fields are in the correct order, review the matching event type fields and log values, then continue building your custom parser by configuring event builders.