On This Page

Home / Edge/ Knowledge Libraries/Parsers Library

Parsers Library

What Are Parsers
​

Parsers are definitions and configurations for the Parser Function. The purpose of the Parsers Library is to provide an interface for creating and editing Parsers. The library is searchable, and each parser can be tagged as necessary.

To find the library, select Fleets from the sidebar, and choose a Fleet. Then, on the Fleets submenu, select More, then Knowledge, then Parsers.

Parsers Library
Parsers Library

Parsers can be used to extract or reserialize events. See Parser Function page for examples.

Supported Parser Types:
​

  • CSV: Comma-separated values.
  • Extended Log File Format: Extended Log File Format.
  • Common Log Format: Common Log Format.
  • Key=Value Pairs: A set of data that represents two associated groups through a key and a value.
  • JSON Object: JavaScript Object Notation (JSON) is a standard text-based format for representing structured data based on JavaScript object syntax.
  • Delimited values: A character identifies the beginning or the end of a character string.
  • Regular Expression: A sequence of characters that specifies a match pattern in text.
  • Grok: A string of special characters and regular expressions (pattern) that match data.

Creating a Parser
​

To create a parser, follow these steps:

  1. In the sidebar, select Worker Groups (Cribl Stream) or Fleets (Cribl Edge) from the sidebar, and choose a Worker Group or Fleet.
  2. On the Worker Groups/Fleets submenu, select Processing (Cribl Stream) or More (Cribl Edge), then Knowledge, then Parsers.
  3. Select Add Parser.
  4. Enter a unique ID.
  5. Optionally, enter a Description.
  6. Select a Type (see the supported types above).
  7. Enter the List of fields expected to be extracted, in order. Select this field’s Maximize icon (far right) if you’d like to open a modal where you can work with sample data and iterate on results.
  8. Optionally, enter any desired Tags.
Adding a new parser
Adding a new parser