Decoder: Services Config View - Parser Mappings Tab (Beta)

Document created by RSA Information Design and Development on Apr 21, 2016
Version 1Show Document
  • View in full screen mode

This topic provides a description of the configurable options for a Log Decoder in the Parsers Mappings tab.

In the Parsers Mappings tab, Administrators can configure log parser mappings for Log Decoder services. This feature is intended to track a subset of of Event Sources that is parsing against the wrong parser. The Parser Mappings tab must be enabled before you can see it in the Services Config view.

Procedures associated with the Parser Mappings tab are provided in Enable Event Source Mapping.

To access this tab:

  1. In the Security Analytics menu, select Administration > Services.
  2. Select a service and Actions menu cropped >View > Config.
    The Config view for the selected service is displayed.
  3. Click the Parsers Mapping (Beta) tab.

This is an example of the tab.


The Parser Grid lists all parsers that are currently mapped on the Log Decoder. The Parser Tab Toolbar has options to work with parser mappings in the grid.

Parser Mappings Toolbar

The Parser Mappings Toolbar has options to work with parser mappings in the grid.

Icon-Add.png Add a parser mapping.
ic-delete.png Delete the selected parser mapping.
ic-edit.png Edit a parser mapping.
ic-refresh.png Refresh the list of parser mappings.
Display the Actions menu.
  • Import - Import a parser mapping to a file.
  • Export - Save a parser mapping to a file.
ApplyApply any changes.

Parser Mappings Grid

The Parser Mappings grid lists all parsers that are currently mapped on the Log Decoder.

Host Displays the IP address of the host.
Event Source

Displays the Event Sources that are parsing incorrectly.

Apply Applies any changes.
You are here: References > Services Config View - Parser Mappings Tab (Beta)