Skip to content

Parser-combinator (Parsec)

A parser-combinator technique is used for parsing events in plain string format. It is based on SP-Lang Parsec expressions.

For parsing original events, use the following declaration:

parser.yaml
define:
    name: My Parser
    type: parsec/parser

parse:
    !PARSE.KVLIST
    - ...
    - ...
    - ...
subparser.yaml
define:
    name: My Parser
    type: parsec/parser
    field: <custom_field>

parse:
    !PARSE.KVLIST
    - ...
    - ...
    - ...

When field is specified, parsing is applied on that field, otherwise it is applied on the original event. Therefore, it must be present in every sub-parser.

Types of field specification:

  1. field: <custom_field> - regular field pre-parsed by the previous parser.

  2. field: json /key/foo - JSON key /key/foo from pre-parsed JSON object json. Name of the JSON object and JSON key must be separated by space. JSON key always starts with /, and every next level is separated by /.

  3. JSON key with specified type, by default we assume string type. 

    field:
    json: /key/foo
        type: int

  4. field: xml /key/foo/@attribute - XML key /key/foo/@attribute from pre-parsed XML object xml. Name of the XML object and XML key must be separated by space. XML key always starts with /, and every next level is separated by /. The class attribute is denoted by @.