Skip to main content

​
ChatGPT Assisted Parser: what do I click?

Use this when Auto Parser has highlighted a problem you cannot resolve, or when it says that the source structure is not supported. You do not need to know CEF, LEEF, Ruby or regular expressions. ChatGPT Assisted Parser screen with Prepare examples, Redacted example and Prepare ChatGPT Prompt This is a separate menu in the left sidebar. The original log stays in the local analysis area.

​
1. Open the assistant and prepare an example

  1. Click ChatGPT Assisted Parser in the left menu (or Fix with ChatGPT from a flagged Auto Parser event).
  2. In Original local logs, paste the source logs if they are not already present.
  3. In What do you want Parser Studio to find?, describe the desired result in everyday language, for example: “Find the event time, action, source and destination addresses, port, user and reason.”
  4. Look at Redacted example to copy to ChatGPT. Parser Studio supplies a fictional example, but you must review it and change it if it does not resemble the structure you need to explain.
  5. Replace any real usernames, addresses, customer identifiers, secrets and sensitive values before copying anything outside the browser.
There is no separate masking approval checkbox in this screen. Reviewing the visible example and choosing to copy the prompt are your decisions.

​
2. Prepare the prompt and ask ChatGPT

  1. Click Prepare ChatGPT Prompt.
  2. In 2. Copy to ChatGPT, inspect the generated prompt, then click Copy Prompt.
  3. Open ChatGPT manually, paste the prompt and request a ParserRecipe v0.2 JSON answer that follows the prompt constraints.
  4. Do not ask for arbitrary executable Python, Ruby or an unrestricted regular expression as the final imported response.
Parser Studio does not send the prompt to ChatGPT automatically.

​
3. Bring the answer back

  1. Copy the JSON response from ChatGPT.
  2. Return to Parser Studio → 3. Paste the ChatGPT result.
  3. Paste the JSON into the response box.
  4. Click Check ChatGPT Result.
If the schema, source fingerprint or requested operations are unsupported, the result is rejected. That is a reason to revise the proposal, not to override the validation.

​
4. Test before accepting

If Parser Studio says the proposal changed a field or rule, paste new examples into Additional ChatGPT test logs. Check Confirm test examples are different, run the offered comparison and read the result. Only approve a changed rule when the original and independent examples pass without regression. What are independent test logs?

​
5. Finish

After a supported change is checked and explicitly approved, use the offered generation action. If you need to return to automatic analysis, click Return to Auto Parser.
Only the deliberately reviewed, masked example should be copied outside the browser. If an inline repair prompt is generated from the original event, read and redact its entire text before using Copy Prompt.
Still unsure? Follow the unrecognized log scenario or a worked ChatGPT repair.
Last modified on October 18, 2026