Create JSON Type Parser

1. In the Parser field, enter the parser name. For example, enter Database Audit Log Entries.

   Provide suitable description to the parser for easy identification.

2. In the Example Log Content field, paste the contents from a log file that you want to parse, such as the following:

   
   
   
   Description of the illustration parser_json_type.png
   
   

   Based on the example log content, the fields are picked and displayed in the Fields tab, as in the following example:

   
   
   
   Description of the illustration parser_fields_json_type.png
   
   
3. In the Fields tab, for the specific JSON path, select the field name.

   The default root path selected is $. If you want to change the JSON root path, expand the Advanced Setting section, and select the Log Entry JSON Path from the menu.

4. After the fields are selected, go to Parser Test tab to view the match status, and the fields picked from the example log content.
5. Click Save to save the new parser that you just created.

To abort creating a JSON type parser and to switch to creating a parser of regex type, under Type, select Regex.