Parser Node

Quick Reference

• Target Field: The name of the field in your input record that contains the data you want to parse.
• Remove Target Field: If enabled, the original raw string field will be deleted from the record after parsing.
• Extraction Type: Select a type to show its settings; no type means no subtype fields.
• Syslog Components: Syslog: Priority, Version, Timestamp, Device, Application, Process ID, Message ID, Structured Data.
• Components Order: Syslog, when components have been selected; reorder the same list.
• Timestamp Pattern (Optional): Syslog, only when Timestamp is selected.
• Message Body Delimiter (Optional): Syslog.
• Pair Separator: Key-Value Pairs.
• Key-Value Separator: Key-Value Pairs.
• Grok Pattern: Grok Pattern.
• Output Field Name (Optional): JSON; parsed data is added under this field without moving unrelated existing top-level fields.
• Delimiter: Delimited Text.
• Column Names: Delimited Text; + Add Column adds a row.
• Timestamp Location: Windows Multiline: No Timestamp, First Line, From Field.

Common Event Format (CEF) adds no subtype fields. Windows Multiline has only Timestamp Location: selecting From Field does not reveal a separate timestamp-field input. Separator controls support presets and custom values without introducing another saved configuration key.

Workflow Builder fields

Configuration keys below are relative to the node configuration. Use the field name in the panel when following instructions in the builder; required markers such as an asterisk are not part of the name.

Field in the panel	Configuration key	Where to edit / when shown
Target Field	targetField	Node panel — The name of the field in your input record that contains the data you want to parse. Required: Yes. Placeholder: e.g., __raw__, message, content.
Remove Target Field	removeTargetField	Node panel — If enabled, the original raw string field will be deleted from the record after parsing. Required: No.
Extraction Type	extractionConfig.type	Select a type to show its settings; no type means no subtype fields — The specific method used to interpret the data. The available types are detailed below. Required: Yes.
Syslog Components	extractionConfig.componentList[]	Syslog: Priority, Version, Timestamp, Device, Application, Process ID, Message ID, Structured Data
Components Order	extractionConfig.componentList[]	Syslog, when components have been selected; reorder the same list
Timestamp Pattern (Optional)	extractionConfig.timestampPattern	Syslog, only when Timestamp is selected
Message Body Delimiter (Optional)	extractionConfig.messageBodyDelimiter	Syslog
Pair Separator	extractionConfig.pairSeparator	Key-Value Pairs
Key-Value Separator	extractionConfig.kvSeparator	Key-Value Pairs
Grok Pattern	extractionConfig.grokExpression	Grok Pattern
Output Field Name (Optional)	extractionConfig.outputFieldName	JSON; selecting JSON initializes parsed_json. An empty string creates an empty-key wrapper; it does not flatten parsed fields into the top-level record or move unrelated existing top-level fields.
Delimiter	extractionConfig.delimiter	Delimited Text
Column Names	extractionConfig.columns[]	Delimited Text; + Add Column adds a row
Timestamp Location	extractionConfig.timestampLocationType	Windows Multiline: No Timestamp, First Line, From Field

Common Event Format (CEF) adds no subtype fields. Windows Multiline has only Timestamp Location: selecting From Field does not reveal a separate timestamp-field input. Separator controls support presets and custom values without introducing another saved configuration key.

Overview

The Parser Node is used to transform raw text data (strings) into structured data (JSON objects). This is an essential step in log processing, allowing you to extract specific fields like IP addresses, timestamps, and error messages so they can be filtered, aggregated, or routed in downstream nodes.

General Configuration

Regardless of the specific parsing method chosen, all Parser Nodes share the following base settings:

Field	Description	Required	Placeholder
Target Field	The name of the field in your input record that contains the data you want to parse.	Yes	e.g., __raw__, message, content
Remove Target Field	If enabled, the original raw string field will be deleted from the record after parsing.	No	–
Extraction Type	The specific method used to interpret the data. The available types are detailed below.	Yes	–

Extraction Types

JSON

Use this when your logs are already formatted as JSON strings.

• Output Field Name (Optional): Selecting JSON initializes this field to parsed_json. The parsed JSON is nested under that field. If you explicitly clear the value to an empty string, the parsed JSON is nested under the empty key ""; it is not merged into the top-level record.
• Behavior: It interprets the target string as a JSON object and converts it into a structured Fleak map.

The parser adds the extraction result to a copy of the input record. Existing fields are preserved unless an extracted top-level key overwrites them; Remove Target Field removes the configured target field after the merge. With JSON, the extracted top-level key is the configured Output Field Name (Optional), so unrelated input fields are not relocated into the parsed object.

For example, with Target Field = message, Remove Target Field enabled, and input:

{"message":"{\"severity\":\"high\",\"user\":\"alice\"}"}

Output Field Name (Optional) = parsed_json produces:

{"parsed_json":{"severity":"high","user":"alice"}}

An explicitly empty Output Field Name (Optional) produces:

{"":{"severity":"high","user":"alice"}}

Use $.parsed_json.severity to read the severity extracted from message. An existing top-level severity field remains accessible as $.severity; do not change an expression that intentionally reads that original field solely because the output field is parsed_json. Disabling Remove Target Field also retains the original message string. A blank output field is not a request to flatten the parsed object.

For example, an existing top-level field and a same-named parsed field can coexist. With Target Field = message, Remove Target Field enabled, and Output Field Name (Optional) = parsed_json:

{"status":"received","message":"{\"status\":\"processed\"}"}

produces:

{"status":"received","parsed_json":{"status":"processed"}}

Here $.status reads received, while $.parsed_json.status reads processed. Choose the path for the value you intend to use, based on the actual input and parsed output.

Key-Value Pairs

Use this for logs formatted as a list of pairs, such as key1=value1, key2="value 2".

• Pair Separator (Required): The string that separates distinct pairs. Can be a single character (e.g., , or space) or multiple characters (e.g., " | " or ", "). Supports escape sequences like \t for tab and \n for newline.
• Key-Value Separator (Required): The string that separates a key from its value. Can be a single character (e.g., =, :) or multiple characters (e.g., =>, ::). Supports escape sequences.
• Features: The pair separator and key-value separator must be different. This parser handles quoted values intelligently. If a value is enclosed in quotes (e.g., msg="error, check logs"), separators inside the quotes are ignored. When the same key appears multiple times, values are aggregated into an array (e.g., key1=v1,key1=v2 produces {"key1": ["v1", "v2"]}).

Delimited Text

Use this for comma-separated values (CSV) or other character-delimited logs.

• Delimiter: The character used to separate columns (e.g., ,, |, or \t). Pre-filled with ,.
• Column Names: You must define the names of the columns in order. You can click + Add Column to map the split values to specific field names. The number of columns must be at least as many as the values in your data. Extra columns with no corresponding values are omitted from the output.
• Features: This uses a robust CSV parser that correctly handles quoted fields containing the delimiter.

Grok Pattern

Use this for unstructured text logs where you need to match specific patterns (like Apache or Nginx logs).

• Grok Pattern: Enter the Grok expression to define the log structure.
  • Example: %{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:message}
• Features: Supports standard Grok patterns. It captures named groups from the expression and outputs them as fields. If the pattern does not match the input, the record will produce an error.

Syslog

Use this for logs following the RFC 5424 Syslog standard.

• Syslog Components: Select the components present in your syslog header. Options include:
  • Priority, Version, Timestamp, Device, Application, Process ID, Message ID, Structured Data.
• Timestamp Pattern (Optional): When the Timestamp component is selected, you must specify a timestamp pattern (e.g., MMM d HH:mm:ss for BSD format, yyyy-MM-dd'T'HH:mm:ss.SSSXXX for RFC 5424).
• Message Body Delimiter (Optional): Specify a character that separates the header from the message body (e.g., :). If omitted, the remaining text after the last header component (after whitespace) is treated as the message body.
• Behavior:

  • It extracts standard headers into the following fields:

    Component	Output Field
    Priority	priority
    Version	version
    Timestamp	timestamp
    Device	deviceId
    Application	appName
    Process ID	procId
    Message ID	msgId
    Structured Data	structuredData

  • It parses Structured Data (content inside [id key="value"]) into nested maps.

  • The remaining text is placed in a content field.

info

Standard syslog format: <PRI>VERSION TIMESTAMP HOSTNAME APP-NAME PROCID MSGID STRUCTURED-DATA MSG

Common Event Format (CEF)

Use this for logs generated by security devices using ArcSight CEF.

• Configuration: No additional configuration is required.
• Behavior:
  • Automatically validates the CEF: prefix.
  • Extracts standard header fields: deviceVendor, deviceProduct, deviceVersion, deviceEventClassId, name, severity, and version.
  • Automatically parses the "Extension" part of the log into key-value pairs. Extension keys ending with Label (e.g., cs1Label=portalURL) create additional fields using the label as the field name.

Windows Multiline

Use this for processing exported Windows Record Viewer logs or similar structured multiline formats.

• Timestamp Location:
  • No Timestamp: Ignore timestamp extraction.
  • First Line: Assumes the timestamp is the first line of the raw data.
  • From Field: Select timestamp extraction from a parsed field. The current panel does not expose a separate field-name input.
• Behavior: It parses key-value pairs from the log. Indented continuation lines (3+ leading spaces) are appended to the previous value. Description blocks capture unstructured text, and Event Xml blocks capture embedded XML content.