Introduction
This article provides information about the Logsign parser fallback module, which offers you an option to make syslog log sources meaningful.
Parser Fallback
When an integrated log source sends data, the received data is made meaningful by mapping and normalization in the parser service. For this process, plugin selection is provided during the log source addition, and parser services know how to parse the logs. In some cases, logs may arrive in different formats, causing problems during parsing. In such cases, selecting a different plugin can prevent the issues, and this process is called parser fallback.
In the example below, auditd logs are obtained from the 10.10.11.70 log source, and session history logs also arrive from the same IP.
Parser Fallback --> Session history plugin should be added as fallback with Add.
When the process is completed, it should be saved with Save.
Using a high eps plugin source for the Parser Fallback process causes slowness in parser services. Therefore, the fallback process is not recommended for high eps sources, and it should be added as a new source with facility instead.