Skip to main content

​
My firewall logs were recognized. What next?

Situation: You copied firewall events from a device, pasted them into Parser Studio and clicked Analyze Logs. The result says all events were parsed completely. You do not need to identify their format.

​
Practice sample

​
Walkthrough

  1. Select Auto Parser, paste both lines in Add Logs, and press Analyze Logs.
  2. Check the event count. If it reports 2 of 2 log events parsed completely, click Review Fields.
  3. Under Choose a source event, pick Event 1 and Event 2. Check that source address, destination address, port, action and policy match the original values.
  4. Click Map Fields. Review the destination name and value type of each important field. Do not confuse nested source and destination addresses.
  5. Check Must fix before continuing. If it is 0, click Create Parser.
  6. Choose Run Final Test & Create Files. Download the file pair when the final check succeeds.
Review Fields with original and extracted values The important task is confirming the correct values, not recognizing a technical log format.

​
Expected review outcome

Both events remain accounted for, and fields retain the same values as the source. A successful final generation produces a reviewed parser logic file and companion configuration.

​
Recovery path

If a nested address appears to be missing, return to Review Fields and inspect the original source path. If the problem is only the output destination, correct it in Map Fields. If the issue is an unparsed section, use the partial-event guide. Next: Start-to-finish Quickstart.
Last modified on October 18, 2026