Two Interfaces for Authoring Parsers

Log Parsing Editor

Video Explanation: https://youtu.be/uNOiu8CVnJU?t=161 

When configuring DataSet parsers, most users choose the “editor” version of our parsing tester. The "editor" (named because of its "Edit Parser" heading) is normally accessed by selecting a log line in the Search UI, clicking “Inspect Fields”, and clicking “Edit Parser.” It can also be displayed visiting the user menu, clicking “Parser”, and choosing the parser to “Create” or “Edit”. The “editor” is very useful because it’s automatically populated with data from the relevant log(s) and tracks how regular expressions are utilized for a particular log event:

Consequently, you can quickly evaluate whether the order-of-operations and regular expressions you employed are working as expected. However, this interface can only be applied to log data that has already been ingested, and you can't edit the sample data.

Log Parsing Tester

Video Explanation: https://youtu.be/uNOiu8CVnJU?t=72 

However, there's also the Log Parsing Tester (which can be found here: https://app.scalyr.com/logParseTester (requires log-in)). Although nearly identical in appearance to the “editor”, the "tester" enables log lines to be pasted in the “Test data” field and modified on the fly. When users submit parsing requests to DataSet Support, this is the editor that we commonly use. It’s very handy when testing parsers against events which occur infrequently, data that hasn’t been ingested, and specific cases; however, you won't see an evaluation of how your data was processed by the regular expression.