Skip to main content

ingest logs that are not supported

  • November 4, 2024
  • 4 replies
  • 13 views

Forum|alt.badge.img+3

Hi Experts,

Are we able to ingest logs that are not indicated in the log type?

https://cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsers

 

4 replies

dnehoda
Staff
Forum|alt.badge.img+16
  • Staff
  • November 4, 2024

No you cannot - misspoke on my last post 


Forum|alt.badge.img+3
  • Author
  • Bronze 1
  • November 4, 2024

No you cannot - misspoke on my last post 


Base on the screenshot, which log type selection should I select?


jstoner
Staff
Forum|alt.badge.img+22
  • Staff
  • November 4, 2024

Every log source needs to be assigned to a log type. By default that log type is then associated with a default parser. That parser can be overridden either through a parser extension or a bespoke parser that a customer/parter crafts. 

if you need a log type that is not listed you can open a ticket and request a new log type to be created. 

Hope this helps!


Forum|alt.badge.img+6
  • Bronze 2
  • November 6, 2024

Ingest- yes you can. Use any log_type which you think can match at some extent. This is not advisable approach but you can adopt it if you don't have the time to wait to get the appropriate log_type created from Support, then integrate, and then start creating the custom parser.