Introduction
This article provides information about the Logsign parser fallback module, which offers you an option to make syslog log sources meaningful.
Parser Fallback
When an integrated log source sends data, the received data is made meaningful by mapping and normalization in the parser service. For this process, a vendor and product (plugin) is selected when the log source is added, and parser services use it to parse the logs. In some cases, logs may arrive in different formats, causing problems during parsing. In such cases, adding other plugins as fallbacks can prevent the issues, and this process is called parser fallback.
The parser first tries the vendor and product selected for the source. Only if that plugin cannot parse a log line are the fallback plugins tried, one by one, in the order they appear in the Parser Fallback List. Parser fallback is available on syslog log sources.
In the example below, auditd logs are obtained from the 10.10.11.70 log source, and session history logs also arrive from the same IP.
Go to Settings › Integrations › Data Collection and open the syslog source. Next to Parser Fallback, click Add. In the Add Parser Fallback window, select Linux in Vendor List and Session History in Product, then click Save. The plugin is added to the Parser Fallback List. You can change the order of the entries by dragging them, or remove an entry from the list.
When the process is completed, save the source with the Save button at the bottom of the form.
Each fallback plugin is an extra parse attempt for every log line that the primary plugin cannot parse, so using fallback on a high EPS source causes slowness in parser services. Therefore, the fallback process is not recommended for high EPS sources. Instead, add the logs as a new syslog source for the same IP and select the matching value in the Syslog Facility field.