Troubleshooting Parsing rules errors ↗
Prerequisite
Parsing Rules requires View/Edit RBAC permissions for Data Management (under Configurations → Data Management), which are the same permissions required for Dataset Management, Data Model Rules, and Event Forwarding.
To help you easily identify and resolve parsing errors in Cortex XSIAM, all parsing errors are saved to a separate dataset called parsing_rules_errors. This dataset displays important information about each error, including the RAW_LOG, log metadata, Parsing Rule metadata, and error description, which you need to effectively troubleshoot the problem. In addition, a Parsing Rules Error notification is sent to the Notification Center whenever a new parsing error is added to the dataset.
Types of Parsing Errors
There are different types of parsing errors:
- Compilation Errors: Unable to compile a rule for different reasons including invalid function parameters, such as invalid regex.
- Data Format Errors: A mismatch between the expected data type, such as CEF, LEEF, or JSON with the actual data, such as TEXT or CSV.
- Runtime Errors: Unable to apply a rule to the data, such as an attempt to add a String to a Number.
Parsing Errors Dataset
All parsing errors and Cortex Data Model (XDM) errors are saved to a dataset called parsing_rules_errors. The following table describes the fields that are available when running a query in XQL Search for the parsing_rules_errors dataset in alphabetical order.
Some errors can only be found after the applicable logs are collected in Cortex XSIAM.
Read more...
| Field | Description | Source |
|---|---|---|
| _BROKER_DEVICE_ID | Displays the ID of the Broker VM associated to the log that triggered this error. | Log Metadata |
| _BROKER_IP_ADDRESS | Displays the IP address of the Broker VM associated to the log that triggered this error. | Log Metadata |
| _BROKER_DEVICE_NAME | Displays the device name of the Broker VM associated to the log that triggered this error. | Log Metadata |
| _COLLECTOR_HOSTNAME | Displays the host name of the data collector associated to the log that triggered this error. | Log Metadata |
| _COLLECTOR_ID | Displays the ID of the data collector associated to the log that triggered this error. | Log Metadata |
| _COLLECTOR_IP_ADDRESS | Displays the IP address of the data collector associated to the log that triggered this error. | Log Metadata |
| _COLLECTOR_NAME | Displays the name of the data collector associated to the log that triggered this error. | Log Metadata |
| _COLLECTOR_TYPE | Displays the type of data collector associated to the log that triggered this error. | Log Metadata |
| CONTENT_ID | Displays the package_id of a content pack containing the default Parsing Rule for which this error was generated. |
Parsing Rule |
| CREATED_AT | Displays a timestamp for when the rule, which generated the error, was created. | Parsing Rule |
| END_LINE | Displays the last line of the particular rule associated to this error. | Parsing Rule |
| ERROR_CATEGORY | <p>Displays the category of the error, which can be one of the following:</p><ul><li>Compile: Compilation error, such as syntax error, missing argument, and invalid regex.</li><li>Data format: Errors relating to the data format, such as received LEEF when expected CEF.</li><li>Runtime: Error at run time, such as an attempt to add a String to a Number.</li></ul> | N/A |
| ERROR_MESSAGE | Displays the error message. | N/A |
| _FINAL_REPORTING_DEVICE_IP | Displays the IP address of the device that the log was collected from that triggered this error. | Log Metadata |
| _FINAL_REPORTING_DEVICE_NAME | Displays the name of the device that the log was collected from that triggered this error. | Log Metadata |
| _ID | Displays the Rule ID that triggered this error. | Parsing Rule |
| INGEST_NULL | Displays a boolean value of either TRUE or FALSE to indicate whether null value fields are configured to be ingested or not. By default, null fields are ingested. | Parsing Rule |
| NO_HIT | Displays the no-match strategy configured for the rule group that generated the parsing error. | Parsing Rule |
| _PRODUCT | Displays the defined PRODUCT associated to the log (for data format errors) or rule (for compilation and runtime errors) that triggered this error. | Log Metadata or Parsing Rule |
| RAW_LOG | Displays the raw log for the Parsing Rule error or parsed log for the Data Model Rule error. | Raw log |
| _REPORTING_DEVICE_IP | Displays the IP address of the device that the log originated from that triggered this error. | Log Metadata |
| _REPORTING_DEVICE_NAME | Displays the name of the device that the log originated from that triggered this error. | Log Metadata |
| RULE_TYPE | Displays the type of rule that triggered this error. | Parsing Rule |
| START_LINE | Displays the first line of the particular rule associated to this error. | Parsing Rule |
| TARGET_DATASET | Displays the Target dataset associated to the rule that triggered this error. | Parsing Rule |
| _TIME | Displays the timestamp when the error was generated. | Raw log |
| _VENDOR | Displays the defined VENDOR associated to the log (for data format errors) or rule (for compilation and runtime errors) that triggered this error. | Raw log or Parsing Rule |
| XDRC_ID | Displays the ID of the XDR Collector associated to the log that triggered this error. | Log Metadata |
| XDRC_IP | Displays the IP address of the XDR Collector associated to the log that triggered this error. | Log Metadata |
| XDRC_NAME | Displays the name of the XDR Collector associated to the log that triggered this error. | Log Metadata |
| XQL_TEXT | Displays the specific section of the rule related to the error generated. | Parsing Rule |