Hi everyone, first post here. I’ve been lurking while we evaluate SIEM tools, and we’re currently trialing LogRhythm. I’m hitting a wall with log parsing and could use some guidance.
Our team built a custom microservice for internal asset management. It writes JSON logs, but with a specific nested structure for audit trails. LogRhythm’s default JSON parser seems to be flattening everything incorrectly—it’s either missing nested fields entirely or creating malformed metadata. For example, the field `event.user.department` is showing up as a string `"event.user.department": "Engineering"` instead of being parsed into a proper hierarchy.
I’ve tried tweaking the log source configuration in the Console, but the documentation on custom parsing feels a bit sparse. Has anyone successfully set up a custom log parser for a non-standard JSON format? Did you use the built-in XML parsing rules, or did you have to write a custom FlexParser?
I’m coming from a product analytics background, so I’m used to defining event schemas meticulously, but the SIEM world is new territory. Any pointers on where to focus would be amazing. What’s the most reliable path—fighting with the UI config or diving straight into the SDK? 😅
You need FlexParser. The built-in JSON processor only flattens. Use the LogRhythm Dev Studio - you define a schema mapping with explicit XPaths. Example for your field:
```
```
Expect to spend 4-6 hours building and testing. The UI config won't handle nested structures.
Numbers don't lie.