Troubleshooting Parsing rules errors

Learn how to easily identify and resolve parsing errors.

Note

Parsing Rules requires a Cortex XDR Pro per GB license and a user with Cortex Account Administrator or Instance Administrator permissions.

To help you easily identify and resolve parsing errors in Cortex XDR, all parsing errors are saved to a separate dataset called parsing_rules_errors. This dataset displays important information about each error, including the RAW_LOG, log metadata, Parsing Rule metadata, and error description, which you need to effectively troubleshoot the problem. In addition, a Parsing Rules Error notification is sent to the Notification Center whenever a new parsing error is added to the dataset.

Types of Parsing Errors

There are different types of parsing errors:

• Compilation Errors: Unable to compile a rule for different reasons including invalid function parameters, such as invalid regex.
• Data Format Errors: A mismatch between the expected data type, such as CEF, LEEF, or JSON with the actual data, such as TEXT or CSV.
• Runtime Errors: Unable to apply a rule to the data, such as an attempt to add a String to a Number.

Parsing Errors Dataset

All parsing errors and Cortex Data Model (XDM) errors are saved to a dataset called parsing_rules_errors. The following table describes the fields that are available when running a query in XQL Search for the parsing_rules_errors dataset in alphabetical order.

Note

Some errors can only be found after the applicable logs are collected in Cortex XDR.

Field	Description	Source
_BROKER_DEVICE_ID	Displays the ID of the Broker VM associated to the log that triggered this error.	Log Metadata
_BROKER_DEVICE_IP	Displays the IP address of the Broker VM associated to the log that triggered this error.	Log Metadata
_BROKER_DEVICE_NAME	Displays the device name of the Broker VM associated to the log that triggered this error.	Log Metadata
_COLLECTOR_HOSTNAME	Displays the host name of the data collector associated to the log that triggered this error.	Log Metadata
_COLLECTOR_ID	Displays the ID of the data collector associated to the log that triggered this error.	Log Metadata
_COLLECTOR_IP_ADDRESS	Displays the IP address of the data collector associated to the log that triggered this error.	Log Metadata
_COLLECTOR_NAME	Displays the name of the data collector associated to the log that triggered this error.	Log Metadata
_COLLECTOR_TYPE	Displays the type of data collector associated to the log that triggered this error.	Log Metadata
CONTENT_ID	Displays the package_id of a content pack containing the default Parsing Rule for which this error was generated.	Parsing Rule
CREATED_AT	Displays a timestamp for when the rule, which generated the error, was created.	Parsing Rule
END_LINE	Displays the last line of the particular rule associated to this error.	Parsing Rule
ERROR_CATEGORY	Displays the category of the error, which can be one of the following: Compile: Compilation error, such as syntax error, missing argument, and invalid regex. Data format: Errors relating to the data format, such as received LEEF when expected CEF. Runtime: Error at run time, such as an attempt to add a String to a Number.	N/A
ERROR_MESSAGE	Displays the error message.	N/A
_FINAL_REPORTING_DEVICE_IP	Displays the IP address of the device that the log was collected from that triggered this error.	Log Metadata
_FINAL_REPORTING_DEVICE_NAME	Displays the name of the device that the log was collected from that triggered this error.	Log Metadata
_ID	Displays the Rule ID that triggered this error.	Parsing Rule
INGEST_NULL	Displays a boolean value of either TRUE or FALSE to indicate whether null value fields are configured to be ingested or not. By default, null fields are ingested.	Parsing Rule
NO_HIT	Displays the no-match strategy configured for the rule group that generated the parsing error.	Parsing Rule
_PRODUCT	Displays the defined PRODUCT associated to the log (for data format errors) or rule (for compilation and runtime errors) that triggered this error.	Log Metadata or Parsing Rule
RAW_LOG	Displays the raw log for the Parsing Rule error or parsed log for the Data Model Rule error.	Raw log
_REPORTING_DEVICE_IP	Displays the IP address of the device that the log originated from that triggered this error.	Log Metadata
_REPORTING_DEVICE_NAME	Displays the name of the device that the log originated from that triggered this error.	Log Metadata
RULE_TYPE	Displays the type of rule that triggered this error.	Parsing Rule
START_LINE	Displays the first line of the particular rule associated to this error.	Parsing Rule
TARGET_DATASET	Displays the Target dataset associated to the rule that triggered this error.	Parsing Rule
_TIME	Displays the timestamp when the error was generated.	Raw log
_VENDOR	Displays the defined VENDOR associated to the log (for data format errors) or rule (for compilation and runtime errors) that triggered this error.	Raw log or Parsing Rule
XDRC_ID	Displays the ID of the XDR Collector associated to the log that triggered this error.	Log Metadata
XDRC_IP	Displays the IP address of the XDR Collector associated to the log that triggered this error.	Log Metadata
XDRC_NAME	Displays the name of the XDR Collector associated to the log that triggered this error.	Log Metadata
XQL_TEXT	Displays the specific section of the rule related to the error generated.	Parsing Rule