> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/troubleshooting-parsing-rules-errors.md).
# Troubleshooting Parsing rules errors
{% hint style="info" %}
### Note
Parsing Rules requires a Cortex XDR Pro per GB license and a user with Cortex Account Administrator or Instance Administrator permissions.
{% endhint %}
To help you easily identify and resolve parsing errors in Cortex XDR, all parsing errors are saved to a separate dataset called `parsing_rules_errors`. This dataset displays important information about each error, including the **RAW\_LOG**, log metadata, Parsing Rule metadata, and error description, which you need to effectively troubleshoot the problem. In addition, a **Parsing Rules Error** notification is sent to the Notification Center whenever a new parsing error is added to the dataset.
**Types of Parsing Errors**
There are different types of parsing errors:
* Compilation Errors: Unable to compile a rule for different reasons including invalid function parameters, such as invalid regex.
* Data Format Errors: A mismatch between the expected data type, such as CEF, LEEF, or JSON with the actual data, such as TEXT or CSV.
* Runtime Errors: Unable to apply a rule to the data, such as an attempt to add a String to a Number.
**Parsing Errors Dataset**
All parsing errors and Cortex Data Model (XDM) errors are saved to a dataset called `parsing_rules_errors`. The following table describes the fields that are available when running a query in XQL Search for the `parsing_rules_errors` dataset in alphabetical order.
{% hint style="info" %}
### Note
Some errors can only be found after the applicable logs are collected in Cortex XDR.
{% endhint %}
| Field | Description | Source |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------- |
| \_BROKER\_DEVICE\_ID | Displays the ID of the Broker VM associated to the log that triggered this error. | Log Metadata |
| \_BROKER\_DEVICE\_IP | Displays the IP address of the Broker VM associated to the log that triggered this error. | Log Metadata |
| \_BROKER\_DEVICE\_NAME | Displays the device name of the Broker VM associated to the log that triggered this error. | Log Metadata |
| \_COLLECTOR\_HOSTNAME | Displays the host name of the data collector associated to the log that triggered this error. | Log Metadata |
| \_COLLECTOR\_ID | Displays the ID of the data collector associated to the log that triggered this error. | Log Metadata |
| \_COLLECTOR\_IP\_ADDRESS | Displays the IP address of the data collector associated to the log that triggered this error. | Log Metadata |
| \_COLLECTOR\_NAME | Displays the name of the data collector associated to the log that triggered this error. | Log Metadata |
| \_COLLECTOR\_TYPE | Displays the type of data collector associated to the log that triggered this error. | Log Metadata |
| CONTENT\_ID | Displays the `package_id` of a content pack containing the default Parsing Rule for which this error was generated. | Parsing Rule |
| CREATED\_AT | Displays a timestamp for when the rule, which generated the error, was created. | Parsing Rule |
| END\_LINE | Displays the last line of the particular rule associated to this error. | Parsing Rule |
| ERROR\_CATEGORY | Displays the category of the error, which can be one of the following:
- Compile: Compilation error, such as syntax error, missing argument, and invalid regex.
- Data format: Errors relating to the data format, such as received LEEF when expected CEF.
- Runtime: Error at run time, such as an attempt to add a String to a Number.
| N/A |
| ERROR\_MESSAGE | Displays the error message. | N/A |
| \_FINAL\_REPORTING\_DEVICE\_IP | Displays the IP address of the device that the log was collected from that triggered this error. | Log Metadata |
| \_FINAL\_REPORTING\_DEVICE\_NAME | Displays the name of the device that the log was collected from that triggered this error. | Log Metadata |
| \_ID | Displays the Rule ID that triggered this error. | Parsing Rule |
| INGEST\_NULL | Displays a boolean value of either **TRUE** or **FALSE** to indicate whether null value fields are configured to be ingested or not. By default, null fields are ingested. | Parsing Rule |
| NO\_HIT | Displays the no-match strategy configured for the rule group that generated the parsing error. | Parsing Rule |
| \_PRODUCT | Displays the defined **PRODUCT** associated to the log (for data format errors) or rule (for compilation and runtime errors) that triggered this error. | Log Metadata or Parsing Rule |
| RAW\_LOG | Displays the raw log for the Parsing Rule error or parsed log for the Data Model Rule error. | Raw log |
| \_REPORTING\_DEVICE\_IP | Displays the IP address of the device that the log originated from that triggered this error. | Log Metadata |
| \_REPORTING\_DEVICE\_NAME | Displays the name of the device that the log originated from that triggered this error. | Log Metadata |
| RULE\_TYPE | Displays the type of rule that triggered this error. | Parsing Rule |
| START\_LINE | Displays the first line of the particular rule associated to this error. | Parsing Rule |
| TARGET\_DATASET | Displays the Target dataset associated to the rule that triggered this error. | Parsing Rule |
| \_TIME | Displays the timestamp when the error was generated. | Raw log |
| \_VENDOR | Displays the defined **VENDOR** associated to the log (for data format errors) or rule (for compilation and runtime errors) that triggered this error. | Raw log or Parsing Rule |
| XDRC\_ID | Displays the ID of the XDR Collector associated to the log that triggered this error. | Log Metadata |
| XDRC\_IP | Displays the IP address of the XDR Collector associated to the log that triggered this error. | Log Metadata |
| XDRC\_NAME | Displays the name of the XDR Collector associated to the log that triggered this error. | Log Metadata |
| XQL\_TEXT | Displays the specific section of the rule related to the error generated. | Parsing Rule |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/troubleshooting-parsing-rules-errors.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.