> ## Documentation Index
> Fetch the complete documentation index at: https://parser.xdr.ooo/llms.txt
> Use this file to discover all available pages before exploring further.

# Auto Parser: all logs were recognized

> From a successful analysis to checked field mappings and downloadable parser files.

# My firewall logs were recognized. What next?

**Situation:** You copied firewall events from a device, pasted them into Parser Studio and clicked **Analyze Logs**. The result says all events were parsed completely. You do not need to identify their format.

## Practice sample

```json theme={null}
{"time":"2026-10-18T04:10:11Z","type":"traffic","action":"allow","source":{"ip":"192.0.2.11"},"destination":{"ip":"198.51.100.15","port":443},"policy":"web-access"}
{"time":"2026-10-18T04:11:12Z","type":"traffic","action":"block","source":{"ip":"192.0.2.12"},"destination":{"ip":"203.0.113.6","port":22},"policy":"deny-ssh"}
```

## Walkthrough

1. Select **Auto Parser**, paste both lines in **Add Logs**, and press **Analyze Logs**.
2. Check the event count. If it reports **2 of 2 log events parsed completely**, click **Review Fields**.
3. Under **Choose a source event**, pick Event 1 and Event 2. Check that source address, destination address, port, action and policy match the original values.
4. Click **Map Fields**. Review the destination name and value type of each important field. Do not confuse nested source and destination addresses.
5. Check **Must fix before continuing**. If it is **0**, click **Create Parser**.
6. Choose **Run Final Test & Create Files**. Download the file pair when the final check succeeds.

<img src="https://mintcdn.com/xdr-parser/DkeLTskQMJz9hCfD/images/03-review-fields.png?fit=max&auto=format&n=DkeLTskQMJz9hCfD&q=85&s=f284ee5ca0e8ba32933bafef1f0ae890" alt="Review Fields with original and extracted values" width="1440" height="1758" data-path="images/03-review-fields.png" />

*The important task is confirming the correct values, not recognizing a technical log format.*

## Expected review outcome

Both events remain accounted for, and fields retain the same values as the source. A successful final generation produces a reviewed parser logic file and companion configuration.

## Recovery path

If a nested address appears to be missing, return to **Review Fields** and inspect the original source path. If the problem is only the output destination, correct it in **Map Fields**. If the issue is an unparsed section, use [the partial-event guide](/scenarios/partial-event).

**Next:** [Start-to-finish Quickstart](/quickstart).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.