how to develop the parser

[muniraja]

Hi All,I am very much looking forward to learning more about parsers, but we do not understand how to develop the parser.Could you please guide us for the parser fundamentals of how to write a parser in Chronicle and how to make the UAT setup?

[adanmontoya · Accepted solution]

This is a a couple of good resources:

• https://cloud.google.com/chronicle/docs/event-processing/parsing-overview
• https://cloud.google.com/chronicle/docs/reference/parser-syntax

[Mustache]

Another good bit of information to know is that the parsers leverage Logstash so if the Google documentation runs into a dead-end, you can try to search for "Logstash <my problem>" and it should get you going a bit further. There are the Logstash forums which also have some information, but I would recommend posting questions here as well.