Custom Log Parser
Network administrators are always in need of more information and insights from their log data. There are times when an IT administrator would identify some log information which is useful and would like to have it indexed automatically as a new field. Having more fields being indexed makes your log data more useful while conducting log forensics analysis and creating network security reports.
EventLog Analyzer allows administrators to create custom (new) fields or extract fields from raw logs by using the interactive Field Extraction UI to create regular expression (RegEx) patterns to help EventLog Analyzer to identify, parse and index these custom fields from new logs it receives from network systems and applications.
How to extract additional fields using EventLog Analyzer?
Specifying custom field values
There are two methods by which custom fields can be specified viz.
- Regex method
- Delimiter method
Regex method
- Provide a rule name.
- Select and click the word(s) in the message, to be extracted as a field.
- You can use the Auto Identify option to identify the fields automatically.
- Provide a name for this field. Optionally, specify the prefix and suffix to the field value.
- Click on Create Pattern to generate a parser rule pattern.
Adding prefix and suffix
Validating the pattern
A parser rule pattern is created using the field definition. You can edit the generated pattern manually, if you are familiar with regular expressions.
Validate link is used to test the generated pattern against the previous search results. You can manually check the suitability of the pattern by analyzing the 'Matched Log Messages' and 'Unmatched Log Messages' displayed.
- Click on Choose another pattern to choose a pattern from the list of patterns generated by the application.
- You can define any existing field matching criteria to apply the pattern for this specific log type.
- Save the pattern to extract the field(s) from the upcoming logs.
Delimiter method
- Provide a rule name.
- You can use the Delimiter to extract fields using delimiters such as Space, Comma, Tab, or Pipe.
- To save the created rule, click Save rule.