Log StreamLog Stream Guide

Click the Settings icon (), to group the parsers by vendor.

Enter a simple text search in the search bar to find specific parsers.

Click Reorder to open a Reorder custom parsers dialog box where you can change the order in which the custom parsers will be applied to the data. The parsers displayed in the list at the bottom of the page will be displayed in the new order.

Click the Import icon () to import a parser.

Click the Export icon () to export all parsers and events builders.

Click Columns to open a column selection dialog box where you can hide columns from the parser list or change the display order of the columns visible in the list.

The first three column (Order, Type, Parser Name) cannot be hidden or moved. For other columns, use the check box to move columns between the Selected Columns and All Columns lists, or use the arrows to move individual columns into a different dispaly order. Only columns in the Selected Column list are visible in the parser list. Click Apply to save any changes.

Click +New Parser to create a new custom parser.

Click to select multiple parsers in the parser list to perform bulk operations. When multiple parsers are selected, the following bulk actions are added to the header options: Disable, Enable, Export.

To sort the parser list, hover over any column heading and click the ascending or descending arrow ( ). Click again to resort in the other direction.

To filter the parser list, click the filter icon () on the following column headings: TYPE, VENDOR, PRODUCT, EVENT, EXTRACTION TYPE, PARSER CALIBRATION TIER, STATUS, and HEALTH.

Use the Coverage column to investigate the quality and completeness of specific parsers configured in your environment. The column indicates how many fields are missing parsing regex definitions. In some cases, these definitions are required by the matching detection rules for the event builder a parser is assigned to. Click the column value to view a popup Detection Field Coverage message with information about field coverage issues. In the popup, click the View details link to open a graph with specific information about each missing field and the detection rules that depend on it. For move information, see Parser Coverage.

Use the menu () at the end of each row to View Details, Edit or Customize, Duplicate, Disable or Enable, Delete, or Export a specific parser. The exact options available for each parser depend on the parser status and type. For parsers that are in Enabled status, additional Open in Search, and View log in Live Tail options are also available.