Skip to main content

Getting Regex from ChatGPT

Setting the Prompt​

I will be providing log messages. 

When I provide a prompt with:
Provide Fpl Regex for: "message"
  
Please provide a JSON response with the following format: 

```json
{
    name: "<Log Type Name>",
    pattern: `<regex pattern>`
}
```
Include a short description of the pattern, less than 400 words.

Reply with "I am ready"

Providing the above prompt to ChatGPT will get smaller responses from ChatGPT.

The prompt above pasted into ChatGPT, which replies that it is ready

It is important to recognize that ChatGPT will sometimes stray from a prompt. Just reissue the prompt to get it back on track. Also, ChatGPT can start using other RegEx patters, like double quotes and non-labeled regex. In this case correct the mistake and provide the correct response back to ChatGPT in the prompt.

Providing a Sample​

Using a sample is the best way to make sure the signature is correct. If you used the parser framework, you will tag the data that is not parsed with a label in the format Failed <parser_name> Parse Searching this in Events Search returns a listing of all messages that still need to be parsed.

Searching​

Use Events Search to get a list of unparsed messages.

An Events Search result row tagged Failed Daemon Parse, with the message seelog internal error: invalid argument selected

Unparsed messages will show up with the default and then the message. The Tag will be visible (in this case "Failed Daemon Parse"). You can just Cut&Paste this into the ChatGPT prompt.

Note: the message can also be displayed in JSON format by opening it up and changing the view to JSON.

The same row expanded to the JSON view, showing the @facility, @level and @message fields

Using the prompt​

In this case the prompt is:

Provide Fpl Regex for: "seelog internal error: invalid argument"

And ChatGPT responded with:


The reply from ChatGPT: a json block holding the name and pattern with a Copy code button, followed by a field-by-field explanation

The copy code section is what you want. The rest is there in case you need to understand the variable groupings if you need to debug. Click copy code,

{
    name: "Seelog Internal Error Log",
    pattern: `^seelog internal error: (?P<message>.+)$`
}

Now you can insert this into the code as part of the patterns array. Order matters, place common regex in the front, and uncommon in the of the array. You can adjust this latter by using the facet to see the actual parser distribution amounts.

Testing​

To test you are going to the Code Editor page.

FPL Processor Editor with the Code pane at the top left, Input at the top right, Output at the bottom left and Console at the bottom right

As a reminder (going clockwise from the top left)

  1. Editor: This is the processor code
  2. Input: This is the incoming data to the processor when you are testing. You are going to use this. This input is used when you click the "Run Test" button.
  3. Output: This is the outgoing result of the code when you click the "Run Test" button.
  4. Console: This is the standard out. This data is not part of the pipe, but instead part of the system output.

Place a frame into the Input​

You need to place the message in the manner it appears from the data source. A syslog message when received will have a structure like the following.

{
  "obj": {
    "@facility": "daemon",
    "@level": "info",
    "@message": "Replace this",
    "@parser": "YourParserName",
    "@sender": "ip-sample",
    "@source": "ip-sample",
    "@tags": [],
    "@timestamp": 1719234357000,
    "@type": "event"
  },
  "props": {},
  "size": 0,
  "source": ""
}

Cut and Past this into the Input window.

Test the response from ChatGPT​

You can now use this JSON structure and put the message into the format. Make sure the @faility matches.

The pattern added to the patterns array, the syslog frame in the Input pane, and the Output and Console panes after Run Test

Hit "Run Test", and the Output shows the new Event message, while the Console shows you that the pattern was found.

Refining the Rule​

This is where human intelligence is better. You have the rule but it is for a specific product. This should be a variable. Let's be lazy and tell CatGPT to correct the issue.

The revised reply from ChatGPT after being asked to make Seelog a variable, capturing the log type as a logType group

You can replace the JSON snippet with the previous and rerun the test.

The rerun test: the Output now carries a logType field of seelog and the Console reports parserName Internal Error Log

It worked. The output now shows that log type as a variable.

More​

This was a simple regex that was easy for ChatGPT. But besides not seeing the variable name, ChatGPT sometimes make regex pattern mistakes. That is why you need to test.

Also, it misses when there are variables. You can address this too by asking ChatGPT if there are any other commands and variations. The caveat is you still need a sample to test it, as ChatGPT can often make up variations that do not exist.