Looking for Guidance on JSON Log Parser Creation

[skadav]

Hi everyone,

I’m looking for a guide or best practices on creating parsers for JSON logs. If anyone has experience or resources to share, I’d appreciate your insights!

Thanks in advance.

[sudeep_singh]

Hi @skadav ,

Can you share the smaple logs of what kind of Json logs you want to parse ?

[mikewilusz]

You may find one of my Medium posts useful: https://medium.com/@cloudymike/parsing-netflow-data-in-google-secops-2f1b0f58ea49

I walk through building a parser, from scratch, for a JSON log (Netflow in this example).

-mike

[t-martin]

@skadav SecOps just announced a public preview of auto-extraction for JSON logs. You may be able to utilize this feature for what you're trying to accomplish. Check out more details here:

https://cloud.google.com/chronicle/docs/event-processing/auto-extraction