This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Why we are getting the output in the below format when we validate the
sample log with parser using cbn-tool/chronicle_cli? Is there any other
purpose behind this output format. It will be easier if the output is
like below formatmetadata.event_times...
I have logs in JSON format. Single log line has multiple single json
objects delimited by new line. here each json object is one log. This is
for AWS_ROUTE_53 parser.{"field1" : "value","filed2" : [ { "field3":
"value" } ]}{"field1" : "value","filed2...
It is not about the specific log or log type. cbn-tool/chronicle_cli
ouput is same for all types of log types. I am talking about the format
of output. Why can't the output be in json format or udm field = value?
I have already made this change to the parser. It is able to parse all
the fields but only for one random event out of multiple events present
in the log line. Remaining events are not converting to udm events. I
have compiled it with cbn tool and ou...
Is there a way we get the parser output in JSON format instead of the
above one? and it would be better if the output is like as
belowmetadata.event_type = "GENERIC_EVENTsecurity_result.action =
"ALLOW"
