- Log Stream Overview
- Parser Manager
- Parsers Overview
- View Parser Details
- Create a Custom Parser
- Import Sample Logs
- Define a Subset of the Sample Logs
- Add Conditions
- Add Basic Parser Information
- Extract Event Fields
- Extract Mapped JSON Fields
- Select JSON Fields from a List of Key/Value Pairs
- Select Tokenized JSON Fields from the Values in the Sample Log
- Manually Enter JSON Path Expressions
- Reorder Mapped JSON Fields
- Review the Matching JSON Fields and Values
- Add Logic to JSON Field Extraction
- Expressions for Parser Field Extractions and Enrichment Mapping
- Array Log Sample
- Extract Fields Using Regular Expressions
- Reserved Fields
- Extract Mapped JSON Fields
- Add Event Builder Rules
- Review and Save Parser
- Manage Existing Custom Parsers
- Tokenize Non-Standard Log Files
- Customize a Default Parser
- Duplicate a Parser
- Enable or Disable Parsers
- Parser Updates
- Live Tail
- Enrichments
- Event Filtering
Parser List
All parsers currently configured in the pipeline, including custom, default Exabeam, and customized default parsers, are listed in the bottom section of the Parsers Overview tab on the Log Stream home page.
 |
Note
The total number of parsers in the list are shown next to the gear icon. This number changes as you filter the parsers.
You can interact with the parser list using the options described in the sections below.
Options in the Menu Bar
Click the gear icon (
), to group the parsers by vendor.
Enter a simple text search in the search bar to find specific parsers.
Click Reorder to to open a Reorder custom parsers dialog box where you can change the order in which the custom parsers will be applied to the data. The parsers displayed in the list at the bottom of the page will also appear reordered.
Click Import to import a parser.
Click Export to export all parsers and events builders.
Click +New Parser to create a new custom parser.
Click to select multiple parsers in the parser list to perform bulk operations. When multiple parsers are selected, the following bulk actions are added to the header options: Disable, Enable, Export.
Options in the Parser List
To sort the parser list, hover over any column heading and click the ascending or descending arrow (
). Click again to resort in the other direction. To filter the parser list, click the filter icon (
) on the following column headings: TYPE, VENDOR, PRODUCT, EVENT, EXTRACTION TYPE, PARSER CALIBRATION TIER, STATUS, and HEALTH.Use the Coverage column to investigate the quality and completeness of specific parsers configured in your environment. The column indicates how many fields are missing parsing regex definitions. In some cases, these definitions are required by the matching detection rules for the event builder a parser is assigned to. Click the column value to view a popup Detection Field Coverage message with information about field coverage issues. In the popup, click the View details link to open a graph with specific information about each missing field and the detection rules that depend on it. For move information, see Parser Coverage.
Note
License Requirement
Currently, the Coverage column is available only if you have the New-Scale Analytics license.
Use the menu (
) at the end of each row to View Details, Edit, Duplicate, Disable, Enable, Delete, or Export a particular parser. Depending on the parser status and type, some or all of these options are available.Note
For custom parsers, Disable and Enable will only show on the menu of completed parsers.