Skip navigation
All Places > Products > RSA NetWitness Platform > RSA NetWitness Platform Online Documentation > Documents
Log in to create and rate content, and to follow, bookmark, and share content with other members.

Log Parser Customize: JSON Mappings (Beta)

Document created by RSA Information Design and Development Employee on Sep 8, 2020
Version 1Show Document
  • View in full screen mode

For NetWitness Platform 11.5, RSA has added a beta version of JSON mappings.

JSON Mappings screen, Beta

View JSON Mappings

  1. In the NetWitness Platform UI, go to (Configure) > Log Parser Rules.

  2. From the Log Parsers pane, select a parser, then click JSON Mappings.

    The JSON Mappings and Mapping Details are shown for the parser you selected.

    The image above shows the details for the mapping from a portion of a JSON log that contains time data, to the event.time.str meta key in NetWitness Platform.

The Mapping Details pane displays the following information.

display name

This name corresponds to the name displayed in the JSON Mappings pane.


The path to where the values for this portion of the log are stored.


Select a meta key to which this value from the log is mapped. Select a value from the drop-down menu.

Optional if you choose a Value Format.

value format

Choose a value format parser onto which to pass this JSON value.

Optional if you choose a Meta.


Optionally, you can enter a text description for this mapping.

Note: You need to select a meta or enter a Value Format, but you do not need to fill in values for both settings.

Add a JSON Mapping

After you add a parser, as described in Add a Log Parser, you can then add JSON mappings.

  1. Follow the procedure to add a parser.
  2. Select the JSON Mappings entry for the newly-added parser.

    The following screen shows an example where an Accurev parser has been added:

    JSON Mappings example, Accurev

  3. Click Add New to begin adding a mapping.
  4. Enter values for display name, path, meta or value format (or both), and (optionally) a description.
  5. Click Save to save your new mapping.

For example, the following screen shows a mapping, emailSource, has been added:

Example of JSON Mapping that has been added

Deploy JSON Parser

You need to deploy a JSON parser so that logs coming in to any decoder are parsed appropriately and meta is generated and stored correctly.

To deploy a parser, select it from the list and click Deploy. The parser, its dynamic rules, and its mappings are sent to all Log Decoders.

Note: A JSON parser must have at least one rule or mapping to enable deployment.

You are here
Table of Contents > JSON Mappings (Beta)