Skip to main content
This information is for Palo Alto Networks Telemetry Pipeline, which is a standalone product separate from Palo Alto Networks Cortex XCOR.
The parse processing rule uses a regular expression to search for values inside a string and to assign a key to each value, then stores those key-value pairs in a structured object. Additionally, the resulting output always includes the original string.

​
Configuration parameters

Use the parameters in this section to configure the parse processing rule. The Palo Alto Networks Telemetry Pipeline web interface uses the items in the Name column to describe these parameters. Pipeline configuration files use the items in the Key column as YAML keys.

​
GPT generation

Keep in mind that this feature is experimental, and that Cortex XCOR can’t guarantee the accuracy or quality of generated scripts.To enable or disable GPT generation, see Project settings.
The parse processing rule lets you generate regular expressions by using a generative pre-trained transformer (GPT). To use this feature, click Generate Regular Expression With Gpt Experimental. GPT generation uses any logs present in the Input field of the processing rules builder as the basis for its prompt.

​
Example

Using the parse processing rule lets you extract any data from a string and turn that data into parsable key-value pairs. You can then use these key-value pairs in other processing rules or for general storage and analysis. For example, given the following sample website logs:
A processing rule with the Source key value log, the Destination key value parsed, the Regex value ^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>.*)")?$, and the Regex engine value PCRE2 returns the following result:
This rule extracted values from the string stored in the log key, assigned a key to each value, then stored the resulting key-value pairs in a new structured object named parsed. This rule is a modified version of the parsers feature. For a processing rule that performs a similar operation on embedded data already formatted as key-value pairs, see extract keys/values.