Skip to main content
BahaaAli
BahaaAli
Visitor III
June 3, 2025
Question

Customer Parser keep failed in Log test

  • June 3, 2025
  • 1 reply
  • 594 views

HI,

I am tring to test the the following custome parser (new) against the logs: but it keeps failed with no error

----------------

NAT44 SDEL 2025 Jun 02 13:56:05:31 ABCD 6 10 10.62.131.207 49360 6 185.44.76.92 1024 8.8.8.8 53 8.8.8.8 policy1 -

----------------

<parser>
<patternDefinitions>
<pattern name="gInt"><![CDATA[\d+]]></pattern>
<pattern name="gIPv4"><![CDATA[\d{1,3}(?:\.\d{1,3}){3}]]></pattern>
<pattern name="gWord"><![CDATA[\S+]]></pattern>
<pattern name="gTimeStamp"><![CDATA[\d{4} \w{3} \d{2} \d{2}:\d{2}:\d{2}:\d{2}]]></pattern>
</patternDefinitions>
<eventFormatRecognizer>
<![CDATA[LSN44 SDEL]]>
</eventFormatRecognizer>
<parsingInstructions>
<collectFieldsByRegex src="$_rawmsg">
<regex>
<![CDATA[ <NATIndicator:gWord>\s+SDEL\s+<eventTime:gTimeStamp>\s+ <country:gWord>\s+ <protoFam1:gInt>\s+ <proto1:gInt>\s+ <srcIP:gIPv4>\s+ <srcPort:gInt>\s+ <natProtoFam:gInt>\s+ <natIP:gIPv4>\s+ <natPort:gInt>\s+ <dstIP:gIPv4>\s+ <dstPort:gInt>\s+ <realDstIP:gIPv4>\s+ <natPolicy:gWord>\s+- ]]>
</regex>
</collectFieldsByRegex>
</parsingInstructions>
</parser>

 

 

    1 reply

    Secusaurus
    Secusaurus
    Contributor III
    June 4, 2025

    Hi @BahaaAli,

     

    Please compare your format recognizer and the event itself. If this is a 1:1 copy of your information, then the parser looks for the string "LSN44 SDEL", which is not present in the log. Probably you like to look for "LSN44" OR "SDEL"? If this is the case, you might need to use the correct regex-pattern.

     

    Also, I often get fooled by that as well. The test does rarely fail with "no error". You may need to scroll to the right or click on the line to see the error. In your case, I assume it will tell you that no parser or another parser than the one you test would be used for this log line.

     

    I hope that helps.

    Best,

    Christian

    NSE8 | Fortinet Advanced MSSP Partner
      BahaaAli
      BahaaAliAuthor
      Visitor III
      June 17, 2025

      Thanks for the useful comments, now my parser passed validation and log testing but no data extracted only static data, my log line is: LSN44 SDEL 2025 Jun 14 17:08:45:29 IRAQ 17 10 10.62.223.218 57952 10 83.171.206.123 32988 184.72.255.160 9930 184.72.255.160 nat-policy-1 b23.f14.f70     , and the barser is: 

      "<parser name="Nokia_LSN44_SDEL_Minimal">
      <eventFormatRecognizer><![CDATA[LSN44 SDEL]]></eventFormatRecognizer>
      <parsingInstructions>
      <collectFieldsByRegex src="$_rawmsg">
      <regex><![CDATA[ LSN44 SDEL\s+(\d{4} \w{3} \d{2} \d{2}:\d{2}:\d{2}:\d{2})\s+(\S+)\s+(\d+)\s+(\d+)\s+(\d{1,3}(?:\.\d{1,3}){3})\s+(\d+)\s+(\d+)\s+(\d{1,3}(?:\.\d{1,3}){3})\s+(\d+)\s+(\d{1,3}(?:\.\d{1,3}){3})\s+(\d+)\s+(\d{1,3}(?:\.\d{1,3}){3})\s+(\S+)\s+(\S+) ]]></regex>
      <setAttrFromMatch attr="eventTime" index="1"/>
      <setAttrFromMatch attr="hostGeoCountry" index="2"/>
      <setAttrFromMatch attr="protoFam1" index="3"/>
      <setAttrFromMatch attr="ipProto" index="4"/>
      <setAttrFromMatch attr="srcIpAddr" index="5"/>
      <setAttrFromMatch attr="srcIpPort" index="6"/>
      <setAttrFromMatch attr="natProtoFam" index="7"/>
      <setAttrFromMatch attr="postNATSrcIpAddr" index="8"/>
      <setAttrFromMatch attr="postNATSrcIpPort" index="9"/>
      <setAttrFromMatch attr="destIpAddr" index="10"/>
      <setAttrFromMatch attr="destIpPort" index="11"/>
      <setAttrFromMatch attr="realDstIP" index="12"/>
      <setAttrFromMatch attr="policyId" index="13"/>
      <setAttrFromMatch attr="bgpInfo" index="14"/>
      </collectFieldsByRegex>
      <setEventAttribute attr="eventType">Nokia_LSN44_SDEL</setEventAttribute>
      </parsingInstructions>
      </parser>"
      Terms & ConditionsAccessibility statement