What kinds of logs can I paste?

Start with the original text, not a format selection. Parser Studio attempts to recognize structures as you use Auto Parser → Add Logs → Analyze Logs. You do not need to know these names to follow the basic workflow. They help only when you have a vendor field document or need to investigate a warning.

What the source looks like	Usually called	What you should inspect after Analyze Logs
`{"action":"deny","src_ip":"192.0.2.10"}`	JSON	Are the field values and nested paths complete?
`action=deny src=192.0.2.10`	Key/value	Are quoted values and spaces preserved?
`CEF:0	Vendor	…	src=…`	CEF	Are headers and event-specific values separate?
`LEEF:1.0	Vendor	…`	LEEF	Are the actual extension separators interpreted correctly?
`<134>Oct 18 12:00:00 host ...`	Syslog-like envelope	Does the header remain distinct from the message body?
`allow,192.0.2.10,443`	Positional/CSV	Are all positions present? What does each column mean?
Several differently shaped lines	Mixed event families	Were all events accounted for, and is the combination supported?
An exception plus indented stack frames	Multiline	Do you know exactly where one complete event ends?

Three levels of checking

Recognized: Parser Studio identifies a possible structure.
Extracted correctly: You compare the original source with the output, including all event boundaries and important values.
Ready to generate: The sample, mapping and current compiler checks pass in Create Parser.

Do not treat the first check as proof of the third.

What if my source contains multiple formats?

Paste representative examples together. If every event is recognized, review field values across each event type and attempt a single combined draft using the normal stages. If some shapes are unsupported, follow the on-screen grouping suggestion and create separate reviewed drafts as needed. Follow the mixed-log walkthrough.

What if my log contains a missing timestamp detail?

A header can omit a timezone or other information. Parser Studio should not invent that information. Follow the What needs attention and Recommended fix prompts to preserve accuracy.

Still unfamiliar?

If you cannot identify the structure, that is fine. Start with Quickstart or ask ChatGPT through the supported manual workflow.

Last modified on October 18, 2026