> ## Documentation Index
> Fetch the complete documentation index at: https://parser.xdr.ooo/llms.txt
> Use this file to discover all available pages before exploring further.

# Scenario Playbooks: choose what happened

> Find the next step based on what Auto Parser or ChatGPT showed, not the input format.

# Choose what happened after analyzing your logs

**New: [RFC3164 relay-forwarded logs](https://parser.xdr.ooo/scenarios/relay-forwarder.md)** — compare pre-relay and forwarded text, declare `relay01`, verify the 2/2 extraction result and test a separate holdout.

**Everyone starts in Auto Parser:** paste a few complete source events and click **Analyze Logs**. You do not have to identify a log format.

## Video tutorials using original security-log examples

> [card] [Complete parsing: Juniper SRX](https://parser.xdr.ooo/videos/complete.md)
>
> Watch the entire source-to-parser workflow.

> [card] [Partially parsed: Sophos XG](https://parser.xdr.ooo/videos/partial.md)
>
> Inspect the unresolved source region while preserving extracted fields.

> [card] [ChatGPT recovery: Snort 3](https://parser.xdr.ooo/videos/unknown.md)
>
> Review and independently test a proposed additional parsing rule.

> [card] [Multiple types: FortiGate](https://parser.xdr.ooo/videos/multiple-types.md)
>
> Test traffic, web-filter and IPS samples in one parser project.

## Auto Parser: solve it inside the guided workflow

> [card] [All logs were recognized](https://parser.xdr.ooo/scenarios/auto-success.md)
>
> Continue to Review Fields, confirm suggested mappings, then create and download the files.

> [card] [Part of an event is missing](https://parser.xdr.ooo/scenarios/partial-event.md)
>
> Select Problem to review, inspect the highlighted region, and try the recommended fix.

> [card] [My product sends several event types](https://parser.xdr.ooo/scenarios/mixed-events.md)
>
> Paste examples together, review every type, and create one combined draft only when supported.

> [card] [Values have no reliable field names](https://parser.xdr.ooo/scenarios/unnamed-values.md)
>
> Keep all values with temporary names or enter trusted names and confirm the column order.

> [card] [A field has the wrong output name](https://parser.xdr.ooo/scenarios/normalization.md)
>
> Correct its destination and type under Map Fields instead of rewriting extraction.

> [card] [One event spans several lines](https://parser.xdr.ooo/scenarios/long-events.md)
>
> Review the message boundary, then continue only with a supported framing rule.

> [card] [I want to save parser versions](https://parser.xdr.ooo/scenarios/revisions.md)
>
> Compare experiments and restore a browser-local draft.

> [card] [I need changing sample logs](https://parser.xdr.ooo/scenarios/test-sender.md)
>
> Download and use the standalone Python test sender.

## ChatGPT Assisted Parser: recover or verify a difficult case

Use the left-side **ChatGPT Assisted Parser** menu when the automatic path cannot safely interpret the source or proposes a change that needs independent checking.

> [card] [Nothing in my log was understood](https://parser.xdr.ooo/scenarios/unknown-log.md)
>
> Create a manually reviewed, masked prompt and paste the restricted JSON result back.

> [card] [One missing field needs a new rule](https://parser.xdr.ooo/scenarios/recipe-ai.md)
>
> Preserve correct values and request one narrow change.

> [card] [ChatGPT's answer was rejected](https://parser.xdr.ooo/scenarios/ai-invalid-response.md)
>
> Read the error and ask for a supported structured correction.

> [card] [The suggested fix needs additional proof](https://parser.xdr.ooo/scenarios/ai-test-change.md)
>
> Use other events as independent tests before approving the result.

## A real screenshot of a flagged event

![Parser Studio highlighting unresolved source text and showing the Fix with ChatGPT action](https://mintcdn.com/xdr-parser/DkeLTskQMJz9hCfD/images/07-unknown-analysis.png?fit=max\&auto=format\&n=DkeLTskQMJz9hCfD\&q=85\&s=ca5b0d595da9ea9926950e92b8ca067c)

*If any events need review, the application highlights the source section instead of silently discarding it.*

## Which guide should I read first?

* [Everything parsed correctly → finish the four steps](https://parser.xdr.ooo/quickstart.md)
* [Some text is highlighted → repair only the affected part](https://parser.xdr.ooo/scenarios/partial-event.md)
* [Completely unfamiliar logs → ChatGPT Assisted Parser](https://parser.xdr.ooo/scenarios/unknown-log.md)
* [One product, many event types → review a combined parser](https://parser.xdr.ooo/scenarios/mixed-events.md)

All images were captured from the real Parser Studio interface using fictional data. No extra parser mode is required.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.