Parsing

---
name: parsing
description: "Guides Logparser log-template extraction, ordinary parser
  selection, output CSV inspection, and template matching workflows."
disable-model-invocation: true
metadata:
  disco-role: operating
license: NOASSERTION
---

# Parsing

Use this sub-skill for the ordinary log-template extraction path.
It covers the parsers that follow the standard `LogParser` pattern and the
`logmatch` template-matching workflow.

## Include here

- Custom log parsing with Drain as the default example.
- Ordinary parser selection: Drain, AEL, IPLoM, LKE, LFA, LogSig, LenMa,
  LogMine, Spell, Logram, Brain, and ULP.
- Output inspection for `EventId`, `EventTemplate`, `Occurrences`, and
  `ParameterList`.
- Matching logs against already extracted templates with `logmatch`.

## Exclude from here

- Benchmark and evaluation flows; use `../benchmarking/SKILL.md`.
- Parsers with special shims, compilers, CUDA/torch, API keys, or non-default
  dependencies; use `../specialized-parsers/SKILL.md`.
- Maintainer-only repository changes.

## Read these references

- `references/workflows.md` for the ordinary parse and template-match recipes.
- `references/api-reference.md` for the inspected constructor summaries.
- `references/troubleshooting.md` for format mismatches, output quirks, and
  template-matching failures.

## Run these scripts

- `scripts/parse_tiny_drain.py` — safe tiny Drain smoke or starter template.
- `scripts/match_templates.py` — match logs against a templates CSV.

## When to route here

Choose this sub-skill when the request says things like:

- "parse my logs"
- "use Drain"
- "extract templates"
- "convert raw logs into structured CSVs"
- "match logs against templates"
- "show the EventId/EventTemplate output"

## Working notes

- Start with `scripts/check_install.py` if the environment has not been
  inspected yet.
- When a parser returns only a structured CSV or a template CSV, follow the
  parser-catalog and troubleshooting references rather than assuming the output
  shape is broken.
- If `logmatch` raises a `bad escape \s` error, prefer `scripts/match_templates.py` because it patches the legacy loader replacement at runtime.
- Keep the original repo checkout out of runtime instructions; use the bundled
  skill scripts and references.