> ## Documentation Index
> Fetch the complete documentation index at: https://parser.xdr.ooo/llms.txt
> Use this file to discover all available pages before exploring further.
# Auto Parser: one product sends several event types
> Analyze traffic, threat and user events together, review optional fields and correct mappings before creating one combined draft.
# My security product produces several kinds of events
**Situation:** One security product generates traffic, threat, authentication and other events. You want to support all of them rather than create a parser that works with only the first example.
Begin in **Auto Parser**. You do not have to choose a log format or create a separate parser before examining the records.
## Practice with three event types
Paste these **fictional** records together into **Add Logs**:
```text theme={null}
{"event_type":"traffic","timestamp":"2026-10-18T00:00:00Z","action":"allow","src_ip":"192.0.2.10","dst_ip":"198.51.100.20","dst_port":443}
{"event_type":"threat","timestamp":"2026-10-18T00:00:01Z","action":"block","src_ip":"192.0.2.11","threat_name":"Example signature","severity":"high"}
{"event_type":"authentication","timestamp":"2026-10-18T00:00:02Z","action":"login_failed","user":"demo-user","src_ip":"192.0.2.12"}
```
These represent three distinct security activities from one fictional product.
## Walkthrough
1. Open **Auto Parser → Add Logs**. Paste all three events without deleting or rearranging any of them.
2. Press **Analyze Logs**. Check that all **3 of 3 log events** are accounted for.
3. Click **Review Fields**. Select each source event and check the values particular to that event type: destination and port for traffic, detection and severity for threat, username for authentication.
4. Click **Map Fields**. Do not assume a field missing from one type must be missing from all types. Check each mapping against the events that actually contain it.
5. Look at **Must fix before continuing** and **Check all sample logs**. The example screenshot shows a warning: `severity` contains the text `high` but the proposed match expects an integer. Use **Value type** and the destination catalog to correct the meaning and type, or retain the value as an appropriately named vendor-specific field.
6. Resolve every **blocking** mapping finding. Do not hide warnings by deleting events.
7. If the sample and mapping checks pass, continue to **Create Parser** and press **Run Final Test & Create Files**. One combined draft is available only if that complete reviewed source and the current generator support it.
*Actual Parser Studio screen with three fictional events. A single analysis accounts for traffic, threat and authentication records together.*
*Actual mapping review. The red issue counter is a request to review field semantics and data types—not evidence that the analysis discarded events.*
## What if some event types are not recognized?
If **Different log shapes were found** appears, follow the offered **Analyze group 1 · N similar events** action for each group.
1. Review the first selected group and, if supported, create a draft for that group.
2. Use **Return to all N logs** to restore the complete original input.
3. Review the other groups. **Do not claim a single combined parser** unless the final generation stage verifies that exact combination.
For a small unresolved fragment, use [the partial-event guide](/scenarios/partial-event). If the structure remains completely unfamiliar, follow [ChatGPT Assisted Parser](/scenarios/unknown-log).
## Expected review outcome
Every event from the submitted sample is accounted for. The review preserves event-specific fields without assigning the wrong type or meaning. A single combined draft is reported only when its validation succeeds.
## Recovery path
If the next-step button remains unavailable, check **Must fix before continuing** and read the field-level findings. Correct the failing destination or type. If different source shapes cannot be safely combined, review separate source groups without dropping original events.
**Related:** [Field mapping](/workflows/map-fields) · [Additional test logs](/workflows/holdout-validation).
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.