When data arrives at Humio for ingestion it needs to be parsed before it is stored in a repository.
A parser takes text or JSON data as input and extracts the special
@timestamp field and custom
user fields from the data.
For example, each line from a standard web server log file has status code, method, and URL fields.
You have to specify which parser should be used on the client side. Exactly how
this is done, depends on how you send your logs to Humio.
E.g. if you are using Filebeat you specify the parser by setting the special
@type field in the
We also have an API for managing parsers: Parsers API
Humio comes with a set of built-in parsers for common log formats, like e.g. accesslog.
If the built-in parsers do not support your data type, then you can create your own.
Humio supports two types of custom parsers:
Next Step: Creating a Custom Parser