- Log Stream Overview
- Parser Manager
- Parsers Overview
- View Parser Details
- Create a Custom Parser
- Import Sample Logs
- Define a Subset of the Sample Logs
- Add Conditions
- Add Basic Parser Information
- Extract Event Fields
- Extract Mapped JSON Fields
- Select JSON Fields from a List of Key/Value Pairs
- Select Tokenized JSON Fields from the Values in the Sample Log
- Manually Enter JSON Path Expressions
- Sample JSON Path Expressions for Manual Entry
- Reorder Mapped JSON Fields
- Review the Matching JSON Fields and Values
- Add Logic to JSON Field Extraction
- Expressions for JSON Parser Field Extractions and Enrichment Mapping
- Extract Fields Using Regular Expressions
- Reserved Fields
- Extract Mapped JSON Fields
- Add Event Builder Rules
- Review and Save Parser
- Manage Existing Parsers
- Tokenize Non-Standard Log Files
- Duplicate a Parser
- Enable or Disable Parsers
- Parser Updates
- Supported Vendors and Products
- Live Tail
- Enrichments
- Event Filtering
- Log Stream APIs
Edit a Custom Parser
Use these instructions to edit an existing custom parser, or to finish an incomplete parser. You can edit a parser in any status, even one that is enabled and actively parsing logs.
In fact, for parsers in Enabled status, live editing is the recommended method for updating parser definitions. Editing parsers while they are live, without the need to disable or duplicate them, reduces impact to your data parsing flow and minimizes the possibility of missing logs. When you start to edit a live parser, a draft version is stored while the live version remains in affect for data parsing. If you leave the editing workflow without completing the changes, the draft is persisted, even across sessions. The draft remains stored until you either deploy or discard it.
To edit a custom parser:
On the Parsers Overview tab of the Log Stream home page, click the Options
menu on the custom parser you want to edit, and select Edit. If you're editing an
Enabledparser, the Edit Parser page opens on the Add Basic Info step. When editing parsers in other statuses, the Edit Parser page opens at the point in the work flow where the process was stopped.Edit the parser by changing the parser conditions, activity type, time format, associated vendor and product, field mapping, and event builder rules. Click Next at each step, until you reach the last step.
Note
See Create a Custom Parser for detailed information about each step.
Click Finish and Enable.