Customer Parser keep failed in Log test

[BahaaAli]

HI,

I am tring to test the the following custome parser (new) against the logs: but it keeps failed with no error

----------------

NAT44 SDEL 2025 Jun 02 13:56:05:31 ABCD 6 10 10.62.131.207 49360 6 185.44.76.92 1024 8.8.8.8 53 8.8.8.8 policy1 -

----------------

<parser>
<patternDefinitions>
<pattern name="gInt"><![CDATA[\d+]]></pattern>
<pattern name="gIPv4"><![CDATA[\d{1,3}(?:\.\d{1,3}){3}]]></pattern>
<pattern name="gWord"><![CDATA[\S+]]></pattern>
<pattern name="gTimeStamp"><![CDATA[\d{4} \w{3} \d{2} \d{2}:\d{2}:\d{2}:\d{2}]]></pattern>
</patternDefinitions>
<eventFormatRecognizer>
<![CDATA[LSN44 SDEL]]>
</eventFormatRecognizer>
<parsingInstructions>
<collectFieldsByRegex src="$_rawmsg">
<regex>
<![CDATA[ <NATIndicator:gWord>\s+SDEL\s+<eventTime:gTimeStamp>\s+ <country:gWord>\s+ <protoFam1:gInt>\s+ <proto1:gInt>\s+ <srcIP:gIPv4>\s+ <srcPort:gInt>\s+ <natProtoFam:gInt>\s+ <natIP:gIPv4>\s+ <natPort:gInt>\s+ <dstIP:gIPv4>\s+ <dstPort:gInt>\s+ <realDstIP:gIPv4>\s+ <natPolicy:gWord>\s+- ]]>
</regex>
</collectFieldsByRegex>
</parsingInstructions>
</parser>

[Secusaurus]

Hi @BahaaAli,

Please compare your format recognizer and the event itself. If this is a 1:1 copy of your information, then the parser looks for the string "LSN44 SDEL", which is not present in the log. Probably you like to look for "LSN44" OR "SDEL"? If this is the case, you might need to use the correct regex-pattern.

Also, I often get fooled by that as well. The test does rarely fail with "no error". You may need to scroll to the right or click on the line to see the error. In your case, I assume it will tell you that no parser or another parser than the one you test would be used for this log line.

I hope that helps.

Best,

Christian

[BahaaAli]

Thanks for the useful comments, now my parser passed validation and log testing but no data extracted only static data, my log line is: LSN44 SDEL 2025 Jun 14 17:08:45:29 IRAQ 17 10 10.62.223.218 57952 10 83.171.206.123 32988 184.72.255.160 9930 184.72.255.160 nat-policy-1 b23.f14.f70     , and the barser is: 

"<parser name="Nokia_LSN44_SDEL_Minimal">
<eventFormatRecognizer><![CDATA[LSN44 SDEL]]></eventFormatRecognizer>
<parsingInstructions>
<collectFieldsByRegex src="$_rawmsg">
<regex><![CDATA[
LSN44 SDEL\s+(\d{4} \w{3} \d{2} \d{2}:\d{2}:\d{2}:\d{2})\s+(\S+)\s+(\d+)\s+(\d+)\s+(\d{1,3}(?:\.\d{1,3}){3})\s+(\d+)\s+(\d+)\s+(\d{1,3}(?:\.\d{1,3}){3})\s+(\d+)\s+(\d{1,3}(?:\.\d{1,3}){3})\s+(\d+)\s+(\d{1,3}(?:\.\d{1,3}){3})\s+(\S+)\s+(\S+)
]]></regex>
<setAttrFromMatch attr="eventTime" index="1"/>
<setAttrFromMatch attr="hostGeoCountry" index="2"/>
<setAttrFromMatch attr="protoFam1" index="3"/>
<setAttrFromMatch attr="ipProto" index="4"/>
<setAttrFromMatch attr="srcIpAddr" index="5"/>
<setAttrFromMatch attr="srcIpPort" index="6"/>
<setAttrFromMatch attr="natProtoFam" index="7"/>
<setAttrFromMatch attr="postNATSrcIpAddr" index="8"/>
<setAttrFromMatch attr="postNATSrcIpPort" index="9"/>
<setAttrFromMatch attr="destIpAddr" index="10"/>
<setAttrFromMatch attr="destIpPort" index="11"/>
<setAttrFromMatch attr="realDstIP" index="12"/>
<setAttrFromMatch attr="policyId" index="13"/>
<setAttrFromMatch attr="bgpInfo" index="14"/>
</collectFieldsByRegex>
<setEventAttribute attr="eventType">Nokia_LSN44_SDEL</setEventAttribute>
</parsingInstructions>
</parser>"