AnsweredAssumed Answered

Custom CEF Parser - Own Directory

Question asked by Stewart Gray on Jun 17, 2020
Latest reply on Jun 17, 2020 by Dave Glover

Like • Show 0 Likes0
Comment • 3

Hello,

I've built a custom parser for an event source which sends logs in CEF format. To make it a bit more portable, I'd prefer not to require modifying cef-custom.xml (as per the guide - Custom CEF Parser). Is it possible to copy the logic from the cef.xml file and create new directory? This way it can be packaged and not require users to work around any existing modifications they may have already made to this file.

I can see my event source is using header.id 0002 from the cef file - could I just copy this logic? How would I then get the event source to match this one rather than the default CEF parser?

Cheers

No one else has this question

Outcomes

Dave Glover

Jun 17, 2020 8:20 PM

If you do not want to be reliant on the CEF parser, you need to build a whole new stand alone parser. Once you do that you would need to map it in the log decoder parser mappings. It’s not very difficult to do, and I just did this with another device that I wanted to change around

Actions

Stewart Gray @ Dave Glover on Jun 17, 2020 9:23 PM

Cool, so in theory I can just copy the relevant sections from cef.xml into a new folder, and manually map the source to the new parser?

Additionally, if I'm copying content from the CEF parser there is a risk all the existing CEF event sources will start matching my parser not the default one right?

Actions

Dave Glover

@ Stewart Gray on Jun 17, 2020 9:36 PM

Actually that’s not how it works with the CEF parser. The CEF parsing engine works very differently than the regular parsers.

A regular xml parser will need to be written.

Reach out to me directly if you need assistance

Thanks

Actions

3 Replies

Dave Glover Jun 17, 2020 8:20 PM
Mark Correct
Correct Answer
If you do not want to be reliant on the CEF parser, you need to build a whole new stand alone parser. Once you do that you would need to map it in the log decoder parser mappings. It’s not very difficult to do, and I just did this with another device that I wanted to change around
Like • Show 0 Likes0
Actions
- Stewart Gray @ Dave Glover on Jun 17, 2020 9:23 PM
  Mark Correct
  Correct Answer
  Cool, so in theory I can just copy the relevant sections from cef.xml into a new folder, and manually map the source to the new parser?
  
  Additionally, if I'm copying content from the CEF parser there is a risk all the existing CEF event sources will start matching my parser not the default one right?
  Like • Show 0 Likes0
  Actions
  - Dave Glover @ Stewart Gray on Jun 17, 2020 9:36 PM
    Mark Correct
    Correct Answer
    Actually that’s not how it works with the CEF parser. The CEF parsing engine works very differently than the regular parsers.
    
    A regular xml parser will need to be written.
    
    Reach out to me directly if you need assistance
    
    Thanks
    Like • Show 0 Likes0
    Actions

Custom CEF Parser - Own Directory

Outcomes

Related Content

Recommended Content