Create or Edit a Parser

Create or Edit a Parser

  1. In the Storage section of the main toolbar, click Parsers Parsers.

  2. Click Create New, or select a parser and click Duplicate or Edit…​

  3. Enter the Parser name and click Add Section for each parsing step (see Message Sections).

  4. Paste a message into Syslog message example (optional, for testing); Parse results: shows the fields the parser finds.

  5. Click Create (new parser) or Apply (existing parser).

  6. Select the parser in the Parser property of the originators that send this format.

Syslog parser window: a message example at the top
Syslog parser window
General Properties

Parser name (required, unique) and Description.
Data Fields (Optional)

Extra fields taken from the message body after the message sections run. See Field Extraction.
Message Sections

The parsing steps, in order.

Message Sections

Click Add Section for each step. Sections run from top to bottom; each one takes its part from the start of the remaining text. The text that remains is {MESSAGE}.

Most sections take the part they recognize and leave the rest to the next section. Field: Extract Until and Skip: Until Delimiter stop parsing when the delimiter is not found; the fields found so far are kept.

Section Effect

Header: IETF/BSD-syslog (RFC5424/RFC3164)

Parses a standard syslog header: TIMESTAMP, HOSTNAME, APPNAME, PROCID, and, for RFC 5424, MSGID and structured data. For RFC 3164, the tag gives APPNAME and the [pid] gives PROCID.

Header: RFC5424:STRUCTURED-DATA

Parses RFC 5424 structured data at the current position. Each parameter becomes a field named SDID:param, for example {origin:ip}. Use it only when the header is parsed by other sections; the IETF/BSD header section already parses structured data.

Field: Legacy Timestamp (RFC3164)

Parses an RFC 3164 timestamp, such as Aug 29 06:30:11, into TIMESTAMP. A year and milliseconds are included when present, for example Aug 29 06:30:11.123 2026.

Field: Extract Until

Saves the text up to Extract until (delimiter) in the field named in Field name (for example HOSTNAME or MSGID). Maximum length limits how far to search for the delimiter (0 = no limit); a delimiter beyond it counts as not found, so parsing stops.

Skip: Spaces

Skips spaces at the start of the remaining text.

Skip: Symbols

With one character in Symbols to skip, skips every repetition of that character. With several characters, skips that exact text once, if the remaining text starts with it.

Skip: Until Delimiter

Skips text up to and including Skip until (delimiter).

Body: Common Event Format (CEF)

Parses a CEF:0| or CEF:1| body: deviceVendor, deviceProduct, deviceVersion, deviceEventClassId, name, agentSeverity, and every extension key (for example src, dst).

Body: Name=value pairs

Parses name=value and name="quoted value" pairs; each name becomes a field.

Body: Comma-Separated Values (CSV)

Splits the body into values named 001, 002, 003, … Use a field collection of the CSV Field Names type to give them names.

Related Topics