Hi everyone! I'm trying to set up Panther to monitor logs from a custom internal tool our team built. The logs have a unique format that Panther doesn't recognize out of the box.
I found the documentation on custom parsers, but as a beginner, I'm a bit lost. Could someone walk me through a simple example? Our logs look like this:
```
2025-03-15 [MODULE_A] INFO: User 'john.doe' performed action 'export' on resource_id=45
```
I think I need to create a Python class with a `parse` method? I'd be so grateful for a step-by-step, beginner-friendly explanation of how to turn that log line into a structured event. Thank you in advance to anyone who can help! 😊
You're on the right track with the Python class. The `parse` method needs to return a dict, or `None` if the log line doesn't match your format.
For your log example, I'd use a regex to capture the groups. Here's a minimal parser that would work:
```python
import re
class MyAppParser:
def parse(self, log_line):
pattern = r'(d{4}-d{2}-d{2}) [(w+)] (w+): User '(w+.w+)' performed action '(w+)' on resource_id=(d+)'
match = re.match(pattern, log_line)
if not match:
return None
return {
"timestamp": match.group(1),
"module": match.group(2),
"log_level": match.group(3),
"user": match.group(4),
"action": match.group(5),
"resource_id": int(match.group(6))
}
```
The key is making your regex robust enough to handle variations. Test it with edge cases, like usernames with hyphens or failed actions. Start simple, get it working, then expand.