Creating and Editing a Parser

Scenario

SecMaster provides some preconfigured parsers for quick use. You can use the parsers you need.

This topic describes how to add and edit a log parser. With a log parser, you can convert the log format in a codeless manner. In SecMaster, you can configure log parsers in two ways:

• Using a template: SecMaster provides some log parser (rule) templates. You can use them to configure parsers quickly.
• Creating custom parsers: If the log parser (rule) templates SecMaster provides for you cannot meet your log conversion requirements, you can create custom log parsers (rules).

Creating a Parser

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
4. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 1 Workspace management page
   

5. In the navigation pane on the left, choose Settings > Collections. Then, select the Parsers tab.
   Figure 2 Accessing the Parsers tab page
   

6. Customize a parser or create a parser from a template.
   • Customizing a parser
     1. On the Parsers tab page, click Add.
     2. On the Parsers tab page, set parameters.

        Table 2 Parameters for adding a parser

        Parameter		Description
        Basic Information	Parser Name	Set the parser name.
        	Description	Enter the parser description.
        Rules		Set the parsing rule of the parser. Perform the following steps: Click Add and select a rule type. Parsing rule: Select the parsing rule of the parser. For details about the parameters, see Parser Rules. Conditional control: Select the conditions for the parser. You can select If, Else, or Else if. Set parameters based on the selected rule.

     3. After the setting is complete, click OK in the lower right corner of the page to confirm the setting.
   • Creating a parser from a template
     1. On the Parsers tab page, click the Templates tab.
     2. On the displayed page, locate the row that contains the target template, click Created by Template in the Operation column.
     3. On the Parsers tab page, set parameters.

        Table 3 Parameters for adding a parser

        Parameter		Description
        Basic Information	Parser Name	Parser name, which is automatically generated by the system based on the template and can be changed.
        	Description	Parser description, which is automatically generated by the system based on the template and can be modified.
        Rule list		Parsing rule, which is automatically generated by the system based on the template and can be modified. To add a rule, click Add, select a rule type, and set parameters based on the selected rule. Parsing rule: Select the parsing rule of the parser. For details about the parameters, see Parser Rules. Conditional control: Select the conditions for the parser. You can select If, Else, or Else if.

     4. After the setting is complete, click OK in the lower right corner of the page to confirm the setting.

Editing a Parser

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
4. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 3 Workspace management page
   

5. In the navigation pane on the left, choose Settings > Collections. Then, select the Parsers tab.
   Figure 4 Accessing the Parsers tab page
   

6. On the Parsers tab, locate the row containing your desired parser and click Edit in the Operation column.
7. In the Edit Parser dialog box, edit the parser information.

   Table 4 Editing a parser

   Parameter		Description
   Basic Information	Parser Name	Set the parser name.
   	Description	Enter the parser description.
   Rule list		Set the parsing rule of the parser. Perform the following steps: Click Add and select a rule type. Parsing rule: Select the parsing rule of the parser. For details about the parameters, see Parser Rules. Conditional control: Select the conditional control principle of the parser.

8. After the setting is complete, click OK in the lower right corner of the page to confirm the setting.

Related Operations

You can view parsers, as well as import, export, and delete a parser. For details, see Managing Parsers.