Parsers

Parsers

Parsers turn raw log lines into Event Schema events. The full reference is docs/PARSERS.md.

Parser	Use it for	Notes
auth_log	Linux auth.log / secure	sshd logins and failures, invalid users, disconnects, pam_unix, sudo. Pass --year and --timezone for traditional syslog timestamps
access_log	nginx and Apache access logs	Combined or common format, or a custom regular expression. Query strings go to extra.query
app_json	Application security events (JSON Lines)	time, event.action, source.ip, user, http.route and so on
generic_json	Any other JSON Lines	Needs a YAML mapping file (--mapping)

Choosing a parser

prohori parse detects the format from the first lines. Detection never picks generic_json on its own because that needs a mapping file. In scripts, pass --parser explicitly.

What happens to bad lines

Nothing crashes. Every line is counted as an event, skipped (well-formed but not relevant), blank or an error. The summary shows the counts and the first error examples with line numbers. Lines longer than 16,384 characters are errors and are never fully loaded into memory.

Traditional syslog timestamps

Lines like Oct 24 13:50:12 web01 sshd[1]: ... carry no year or timezone.

• --year is the year of the first line; without it, Prohori uses the file's modification date.
• The year advances automatically at New Year (December to January).
• --timezone (for example Asia/Dhaka) defaults to UTC.

Recent distributions write ISO timestamps with offsets, which need neither option.

Generic JSON mapping example

log_source: payments-api
timestamp: {field: ts, format: "%Y-%m-%d %H:%M:%S", timezone: Asia/Dhaka}
fields:
  event.action: kind
  event.outcome: result
  source.ip: client.addr
  user.name: actor
constants:
  event.category: authentication
values:
  event.outcome: {ok: success, denied: failure}
extra:
  merchant: merchant.id