Parser extension for syslog header

Question

Hello,below is my scenario:for the logs that are sent to google secops, there is already a pre-built parser available, but it does not parse the logs.when i check, grok pattern to match the syslog header of logs is not available in the parser code.i have created the grok pattern and i can see that all the other fields are parsed to udm field correctly. now, my question: is it possible to create a parser extension to match only the syslog header and leave everything else as optional ?if the above is possible, i tried no-code option → i put my grok pattern in syslog box and target field, it is validated sucessfully. but when i tried to preview udm, it does not give me the output, the logs are still droped due to the pattern that are available in pre-built parser. can you please help me with this ? Thanks,

Eoved · Answer

Yes, you can create a parser extension to handle the header, you will need to use the code-based approach.
But I guess that if this is the scenario, it means the data wasn’t ingested using the supported method.
Depending on the log type, it might be easier and more beneficial in the long term to switch to the supported ingestion method.
If you can share some information about the logs here.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded