Decoder: Configure a Log Decoder to Accept Protobuf

Document created by RSA Information Design and Development on Sep 13, 2017Last modified by RSA Information Design and Development on Mar 27, 2018
Version 8Show Document
  • View in full screen mode

There are occasions when you want to analyze log files that are in protobuf (Protocol Buffer) format. You can configure a Log Decoder to accept logs in protobuf (Protocol Buffer) format.

To import a log file to a Log Decoder:

  1. Go to ADMIN > Services.
  2. Select a Log Decoder in the Service list, and select  Actions menu  > View > Explore.
    The Explorer view for the Log Decoder is displayed.
    This is the Explore view of a Log Decoder.
  3. Navigate to event-processors/logdecoder/destinations/logdecoder/consumer/processors/

    Your screen should look similar to the following.
    This is an example of the Explore view.
  4. For the send-protobuf field, select false, and change the value to true.
  5. Navigate to event-processors/logdecoder/destinations/logdecoder/consumer/processors/tcpconnector/
    and change the port value to 50202.
  6. Navigate to event-processors/logdecoder/destinations/logdecoder/consumer/processors/tcpconnector/
    and change the following parameters:
    • Clear the delimiter field
    • Change format to %text%
You are here
Table of Contents > Decoder and Log Decoder Additional Procedures > Configure a Log Decoder to Accept Protobuf