Administration Guide › Mapping and Parsing › How to Create a Message Parsing File

How to Create a Message Parsing File

You can use the parsing file wizard to create, edit, or analyze a Message Parsing (XMP) file. Parsing files read incoming raw event data and create name-value pairs, allowing you to establish mappings even before the data mapping process. This improves overall mapping efficiency.

Note: The Common Event Grammar (CEG) names are not enforced for event parsing, allowing additional flexibility in creating name/value pairs. The CEG fields are available for selection, but the field names and values are not limited to CEG values.

Creating or editing an XMP file has the following steps:

1. Opening the parsing file wizard.
2. Providing file details, including file name, logname, and support information.
3. Locating sample events for file testing and construction.
4. Setting global values that will apply to all events parsed by the file.
5. Creating or editing prematch strings to begin event parsing
6. Selecting prematch filters for parsing filter attachment
7. Creating or editing parsing filters to complete event parsing.
8. Analyzing and saving the new or edited XMP file.

More information:

Define File Details

Load Sample Events

Add Global Fields

Create a Prematch Filter

Analyze the XMP File