How to view raw logs that have failed to parse?

[jonahbf]

We developed a custom parser for our log source, and validated it with various samples in the parser IDE. However, once we put in production, the ingestion metrics dashboards indicate that 1-5% of logs fail to parse, and drop with one of the drop tags we specify in our parser.  Is there any easy way we can view logs that we know have dropped so we can identify any issues with the validation/parser? Or alternatively, is there an API or SDK we can use to test sample logs against the parser in bulk? I've tried to use Raw Logs queries to find unparsed logs, but they max out at 10k results and it always shows all of them parsed. The Search API doesn't appear to support searching raw logs

Note that our log source is sending only entities to the parser, no events 

[dlove40]

The chronicle cli has a command to list errors. 

https://cloud.google.com/chronicle/docs/administration/cli-user-guide#list_errors_argument

The old CBN CLI tool does as well.
https://github.com/chronicle/cbn-tool