Parsers

A parser is a Hamelin query that extracts typed fields from raw connector events and lands them as a structured table.

A parser lives under an integration and reads from one or more connectors. When you deploy a parser, it derives an ingest table that materializes the parsed rows. That table is the input a mapper reads to normalize the fields into ECS. A parser's id is prefixed PRS_.

Inputs

Field	Type	Required	Description
name	string	Required	Parser name within the integration. Must start with a letter, end with a letter, number, underscore, or closing parenthesis, and contain only letters, numbers, spaces, underscores, hyphens, dots, or parentheses.
query	string	Required	The Hamelin query that reads connectors and produces the parsed rows. Must reference only connector datasets, and at least one, so a JOIN or LOOKUP against a lookup, table, or view is rejected. Output must contain no variant or interval fields. Operators that span rows (AGG, WINDOW, SORT, LIMIT) do not belong in a parser, which runs per file at ingest.
connectorIds	array<string>	Required	The connectors the query reads, each prefixed CON_. At least one is required to commit.
deploy	boolean	Optional	Whether the parser materializes its table. true runs the query and writes the derived ingest table. false leaves it as saved content.

Outputs

Field	Type	Description
deploymentStatus	enum	Materialization state of the derived table: UNDEPLOYED, DEPLOY_PENDING, DEPLOY_IN_PROGRESS, DEPLOYED, UPDATE_PENDING, UPDATE_IN_PROGRESS, REFRESH_IN_PROGRESS, FAILED, ARCHIVED, CLEANUP_PENDING, CLEANUP_IN_PROGRESS.
tableId	string	The derived ingest table, prefixed TBL_. Null before you deploy the parser.
tableName	string	The schema.name of the derived table, events.<integration>_<parser>, e.g. events.okta_system_log. Null before you deploy the parser.

Plus the common resource fields.

Related

• Integrations, the resource a parser lives under.
• Connectors, the source a parser reads.
• Tables, the ingest table a deployed parser derives.
• Mappers, which read a parser's table and normalize it to ECS.
• ECS field reference, the schema a mapper targets.
• Parse custom data, how to write and deploy a parser.