Create JSON Type Parser
-
In the Parser field, enter the parser name. For example, enter
Database Audit Log Entries
.Provide suitable description to the parser for easy identification.
-
In the Example Log Content field, paste the contents from a log file that you want to parse, such as the following:
Based on the example log content, the fields are picked and displayed in the Fields tab, as in the following example:
- In the Fields tab, for the specific JSON path,
select the field name.
The default root path selected is
$
. If you want to change the JSON root path, expand the Advanced Setting section, and select the Log Entry JSON Path from the menu. - After the fields are selected, go to Parser Test tab to view the match status, and the fields picked from the example log content.
- Click Save to save the new parser that you just created.
To abort creating a JSON type parser and to switch to creating a parser of regex type, under Type, select Regex.