Skip to main content

​
Parser Studio found the values, but mapped one incorrectly

Situation: Analyze Logs succeeded. Review Fields shows the right source IP, user, action or port, but the field’s final destination is incorrect.

​
Fictional example

​
Walkthrough

  1. In Auto Parser, paste the logs and select Analyze Logs.
  2. If analysis is complete, choose Review Fields. Confirm that the correct source values were extracted.
  3. Choose Map Fields.
  4. Under Review field matches, identify the source field whose destination is wrong.
  5. Use Choose Stellar field to review a suitable supported destination, and Value type to choose the matching type.
  6. For unclear vendor-only information such as device_build, keep a custom/vendor field rather than inventing an official meaning.
  7. Open Check all sample logs and See what will change to inspect the corrected result.
  8. If Must fix before continuing = 0, click Create Parser.
Map Fields UI with matched destinations, value types and sample checks This is the normal place to correct a destination or type. The original log text remains unchanged.

​
Expected review outcome

The output destination matches the actual meaning of the source value on all tested events. Corrected mappings do not erase the original extracted data.

​
Recovery path

If a mapping reports two fields use the same destination, value type mismatch or reserved field, follow the on-screen finding. If you cannot determine the meaning, keep the source under a neutral vendor field until verified. Next: Mapping explanation.
Last modified on October 18, 2026