> ## Documentation Index
> Fetch the complete documentation index at: https://parser.xdr.ooo/llms.txt
> Use this file to discover all available pages before exploring further.

# What kinds of logs can I paste?

> Recognize common log structures without requiring the user to choose a format before analyzing.

# What kinds of logs can I paste?

**Start with the original text, not a format selection.** Parser Studio attempts to recognize structures as you use **Auto Parser → Add Logs → Analyze Logs**.

You do **not** need to know these names to follow the basic workflow. They help only when you have a vendor field document or need to investigate a warning.

| What the source looks like | Usually called | What you should inspect after Analyze Logs | | | |
| - | - | - | - | - | - |
| `{"action":"deny","src_ip":"192.0.2.10"}` | JSON | Are the field values and nested paths complete? | | | |
| `action=deny src=192.0.2.10` | Key/value | Are quoted values and spaces preserved? | | | |
| \`CEF:0 | Vendor | ... | src=...\` | CEF | Are headers and event-specific values separate? |
| \`LEEF:1.0 | Vendor | ...\` | LEEF | Are the actual extension separators interpreted correctly? | |
| `<134>Oct 18 12:00:00 host ...` | Syslog-like envelope | Does the header remain distinct from the message body? | | | |
| `allow,192.0.2.10,443` | Positional/CSV | Are all positions present? What does each column mean? | | | |
| Several differently shaped lines | Mixed event families | Were **all** events accounted for, and is the combination supported? | | | |
| An exception plus indented stack frames | Multiline | Do you know exactly where one complete event ends? | | | |

## Three levels of checking

1. **Recognized:** Parser Studio identifies a possible structure.
2. **Extracted correctly:** You compare the original source with the output, including all event boundaries and important values.
3. **Ready to generate:** The sample, mapping and current compiler checks pass in **Create Parser**.

Do not treat the first check as proof of the third.

## What if my source contains multiple formats?

Paste representative examples together. If every event is recognized, review field values across each event type and attempt a **single combined draft** using the normal stages. If some shapes are unsupported, follow the on-screen grouping suggestion and create separate reviewed drafts as needed.

[Follow the mixed-log walkthrough](/scenarios/mixed-events).

## What if my log contains a missing timestamp detail?

A header can omit a timezone or other information. Parser Studio should not invent that information. Follow the **What needs attention** and **Recommended fix** prompts to preserve accuracy.

## Still unfamiliar?

If you cannot identify the structure, that is fine. Start with [Quickstart](/quickstart) or [ask ChatGPT through the supported manual workflow](/workflows/chatgpt-assisted).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.