- Log Stream Overview
- Parser Manager
- Parsers Overview
- View Parser Details
- Create a Custom Parser
- Import Sample Logs
- Define a Subset of the Sample Logs
- Add Conditions
- Add Basic Parser Information
- Extract Event Fields
- Extract Mapped JSON Fields
- Select JSON Fields from a List of Key/Value Pairs
- Select Tokenized JSON Fields from the Values in the Sample Log
- Manually Enter JSON Path Expressions
- Sample JSON Path Expressions for Manual Entry
- Reorder Mapped JSON Fields
- Review the Matching JSON Fields and Values
- Add Logic to JSON Field Extraction
- Expressions for JSON Parser Field Extractions and Enrichment Mapping
- Extract Fields Using Regular Expressions
- Reserved Fields
- Extract Mapped JSON Fields
- Add Event Builder Rules
- Review and Save Parser
- Manage Existing Parsers
- Tokenize Non-Standard Log Files
- Duplicate a Parser
- Enable or Disable Parsers
- Parser Updates
- Supported Vendors and Products
- Live Tail
- Enrichments
- Event Filtering
- Log Stream APIs
Open a Search Query Based on a Parser
Use the Open in Search option to quickly search for logs parsed by a specific parser. With this option, you can select a specific enabled parser in Log Stream and automatically configure a query in the Search application to look for related logs.
To open a search query based on a parser:
On the Parsers Overview tab of the Log Stream home page, click the options menu (
) for a specific enabled parser and select the Open in Search option.Note
The Open in Search option is also available from the top toolbar in the Parser Details page for a specific parser.
The Search application opens in a new window with a query defined. The query searches for the parser name (
msg_type) within the past 24 hour time window.
In the Search application, run the query to return results.