Custom Parser

Generate custom log parsers automatically with LLMs to extract structured fields from Apache, IIS, HAProxy, Syslog, and custom log formats in Bronto.

​

Overview

Bronto’s Custom Parser feature, powered by LLMs, enables you to automatically create custom log parsers for your specific data formats and requirements. Build, configure, and manage parsers that extract structured data from raw logs, transforming unstructured text into queryable, analyzable log events. Whether you’re working with application logs, system logs, or custom formats, our custom parsing tool provides the flexibility to handle a diverse range of log data.

​

Key Features

​

Parser Creation and Configuration

Create custom parsers with intuitive naming and description fields to help your team understand each parser’s purpose and functionality. Define exactly what data you want to extract and how it should be structured.

​

Real-Time Log Processing

View raw log samples and see immediate parsing results as you configure your parser. Test your parsing logic against actual data before deploying to ensure accuracy and completeness.

​

Structured Data Extraction

Transform unstructured log data into structured, columnar formats with configurably defined fields.

​

Multi-Format Support Out of the Box

Built-in parsers for common log formats including:

• Apache HTTP Server logs – Extract client IPs, authentication details, timestamps, HTTP request elements, response codes, and transfer sizes.
• Key-Value Pair logs – Parse structured messages with field names, values, delimiters, and attribute groupings.
• Microsoft IIS logs – Process IIS server logs with timestamps, client/server IPs, request details, and processing times.
• HAProxy logs – Capture extended HAProxy data including client info, request/response details, timing metrics, and cookies.
• Linux Syslog – Extract timestamps, hostnames, process names, PIDs, users, and log messages.

​

Dataset Management

Organize your parsing rules with dataset management:

• Browse raw datasets and parsed results
• Search and filter by dataset names
• View data volumes and processing statistics
• Track parser assignments and usage

​

Performance Monitoring

Monitor parser performance with detailed metrics:

• Parse success rates
• Processing volume over time
• Parser efficiency analytics

See our Parser Metrics API endpoint for details.

​

Technical Details

Bronto uses AWS Bedrock as a managed service to access LLMs such as Claude. The infrastructure automatically selects the most appropriate model for each task and sends a structured prompt — for example, the AI log parser builds a prompt that instructs the model which patterns to avoid and how to handle keys such as timestamps. Model selection and prompt construction are handled automatically, so users can get started immediately without configuration.

AWS Bedrock also provides the following security and compliance benefits relevant to a SaaS environment:

• Content safety – Built-in safeguards to detect and filter harmful content
• Data privacy – It never stores or uses our data to train models
• Network isolation – All data remains within the AWS network
• Native integration – Works seamlessly with Lambda, S3, and other AWS services, allowing AI capabilities to be incorporated without rearchitecting existing systems

​

Getting Started

1. Navigate to the Parsing section from the main Bronto navigation menu.
2. Select “Dataset List” to view available parsers or create new ones.
3. Choose a dataset from your data sources.
4. Configure your parser with appropriate field mappings.
5. Test with sample data to verify parsing accuracy. Ensure the dataset includes a minimum of 100 events from the last 24 hours.
6. Deploy and monitor your parser’s performance.

If you configure a custom parser, any dashboards, saved searches, or monitors that rely on specific key names in the log may stop working if those keys are renamed.