Get Parser

Retrieves information of a specified parser.

Required Permissions

Requires the ADMIN role or higher.

HTTP Request

cURL Example

curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/parsers/fortigate

Request Parameter

Success Response

{
  "parser": {
    "code": "fortigate",
    "name": "Fortigate",
    "description": "Parse Fortigate logs.",
    "factory_name": "fortigate",
    "factory_display_name": "Fortigate",
    "builtin": true,
    "configs": {
      "ver": "2"
    },
    "created": "2022-09-01 00:31:14+0900",
    "updated": "2022-09-01 00:31:14+0900"
  }
}

• parser (Map): Parser information
  • code (String): Parser code, referenced when calling the parser from the parse command.
  • name (String): Display name of the parser
  • description (String): Parser description
  • factory_name (String): Parser factory name
  • factory_display_name (String): Display name of parser type
  • builtin (Boolean): Whether the parser is built-in in the package
  • schema_code (String): Log schema code. (Only for log normalizers)
  • schema_name (String): Display name of the log schema. (Only for log normalizers)
  • configs (Map): List of key/value pairs in the Parser factory information.
  • created (String): Date and time of creation (yyyy-MM-dd HH:mm:ssZ)
  • updated (String): Date and time of last modification (yyyy-MM-dd HH:mm:ssZ)

Error Response

HTTP status code 200

Parser is not found

{
  "parser": null
}