Skip to main content

​
My security product produces several kinds of events

Situation: One security product generates traffic, threat, authentication and other events. You want to support all of them rather than create a parser that works with only the first example. Begin in Auto Parser. You do not have to choose a log format or create a separate parser before examining the records.

​
Practice with three event types

Paste these fictional records together into Add Logs:
These represent three distinct security activities from one fictional product.

​
Walkthrough

  1. Open Auto Parser → Add Logs. Paste all three events without deleting or rearranging any of them.
  2. Press Analyze Logs. Check that all 3 of 3 log events are accounted for.
  3. Click Review Fields. Select each source event and check the values particular to that event type: destination and port for traffic, detection and severity for threat, username for authentication.
  4. Click Map Fields. Do not assume a field missing from one type must be missing from all types. Check each mapping against the events that actually contain it.
  5. Look at Must fix before continuing and Check all sample logs. The example screenshot shows a warning: severity contains the text high but the proposed match expects an integer. Use Value type and the destination catalog to correct the meaning and type, or retain the value as an appropriately named vendor-specific field.
  6. Resolve every blocking mapping finding. Do not hide warnings by deleting events.
  7. If the sample and mapping checks pass, continue to Create Parser and press Run Final Test & Create Files. One combined draft is available only if that complete reviewed source and the current generator support it.
Three different event types parsed successfully after one Analyze Logs action Actual Parser Studio screen with three fictional events. A single analysis accounts for traffic, threat and authentication records together. Mapping screen displaying optional fields and a value-type warning across event types Actual mapping review. The red issue counter is a request to review field semantics and data types—not evidence that the analysis discarded events.

​
What if some event types are not recognized?

If Different log shapes were found appears, follow the offered Analyze group 1 · N similar events action for each group.
  1. Review the first selected group and, if supported, create a draft for that group.
  2. Use Return to all N logs to restore the complete original input.
  3. Review the other groups. Do not claim a single combined parser unless the final generation stage verifies that exact combination.
For a small unresolved fragment, use the partial-event guide. If the structure remains completely unfamiliar, follow ChatGPT Assisted Parser.

​
Expected review outcome

Every event from the submitted sample is accounted for. The review preserves event-specific fields without assigning the wrong type or meaning. A single combined draft is reported only when its validation succeeds.

​
Recovery path

If the next-step button remains unavailable, check Must fix before continuing and read the field-level findings. Correct the failing destination or type. If different source shapes cannot be safely combined, review separate source groups without dropping original events. Related: Field mapping · Additional test logs.
Last modified on October 18, 2026