When data arrives at Humio for ingestion it needs to be parsed before it is stored in a repository. A parser takes text or JSON data as input and extracts the special @timestamp field and custom user fields from the data.

For example, each line from a standard web server log file has status code, method, and URL fields.

You have to specify which parser should be used on the client side. Exactly how this is done, depends on how you send your logs to Humio. E.g. if you are using Filebeat you specify the parser by setting the special @type field in the configuration.

We also have an API for managing parsers: Parsers API

Built-in Parsers

Humio comes with a set of built-in parsers for common log formats, like e.g. accesslog.

Custom Parsers

If the built-in parsers do not support your data type, then you can create your own.

Humio supports two types of custom parsers:

Next Step: Creating a Custom Parser