Custom Parser

Bronto’s Custom Parser uses LLMs via AWS Bedrock to automatically generate log parsers. Extract structured fields from raw logs across Apache, IIS, HAProxy, Syslog, and custom formats — with real-time testing, dataset management, and performance monitoring.

Overview

Bronto’s Custom Parser feature, powered by LLMs, enables you to automatically create custom log parsers for your specific data formats and requirements. Build, configure, and manage parsers that extract structured data from raw logs, transforming unstructured text into queryable, analyzable log events. Whether you’re working with application logs, system logs, or custom formats, our custom parsing tool provides the flexibility to handle a diverse range of log data.

Key Features

Parser Creation and Configuration

Create custom parsers with intuitive naming and description fields to help your team understand each parser’s purpose and functionality. Define exactly what data you want to extract and how it should be structured.

Real-Time Log Processing

View raw log samples and see immediate parsing results as you configure your parser. Test your parsing logic against actual data before deploying to ensure accuracy and completeness.

Structured Data Extraction

Transform unstructured log data into structured, columnar formats with configurably defined fields.

Multi-Format Support Out of the Box

Built-in parsers for common log formats including:

• Apache HTTP Server logs – Extract client IPs, authentication details, timestamps, HTTP request elements, response codes, and transfer sizes.
• Key-Value Pair logs – Parse structured messages with field names, values, delimiters, and attribute groupings.
• Microsoft IIS logs – Process IIS server logs with timestamps, client/server IPs, request details, and processing times.
• HAProxy logs – Capture extended HAProxy data including client info, request/response details, timing metrics, and cookies.
• Linux Syslog – Extract timestamps, hostnames, process names, PIDs, users, and log messages.

Dataset Management

Organize your parsing rules with dataset management:

• Browse raw datasets and parsed results
• Search and filter by dataset names
• View data volumes and processing statistics
• Track parser assignments and usage

Performance Monitoring

Monitor parser performance with detailed metrics:

• Parse success rates
• Processing volume over time
• Parser efficiency analytics

See our Parser Metrics API endpoint for details.

Technical Details

Bronto uses AWS Bedrock as a managed service to access LLMs such as Claude. The infrastructure automatically selects the most appropriate model for each task and sends a structured prompt — for example, the AI log parser builds a prompt that instructs the model which patterns to avoid and how to handle keys such as timestamps. Model selection and prompt construction are handled automatically, so users can get started immediately without configuration.

AWS Bedrock also provides the following security and compliance benefits relevant to a SaaS environment:

• Content safety – Built-in safeguards to detect and filter harmful content
• Data privacy – It never stores or uses our data to train models
• Network isolation – All data remains within the AWS network
• Native integration – Works seamlessly with Lambda, S3, and other AWS services, allowing AI capabilities to be incorporated without rearchitecting existing systems

Getting Started

1. Navigate to the Parsing section from the main Bronto navigation menu.
2. Select “Dataset List” to view available parsers or create new ones.
3. Choose a dataset from your data sources.
4. Configure your parser with appropriate field mappings.
5. Test with sample data to verify parsing accuracy. Ensure the dataset includes a minimum of 100 events from the last 24 hours.
6. Deploy and monitor your parser’s performance.

If you configure a custom parser, any dashboards, saved views, or monitors that rely on specific key names in the log may stop working if those keys are renamed.