先看文檔: Parser | Cribl Docs
Parser
The Parser Function can be used to extract fields out of events or reserialize (rewrite) events with a subset of fields. Reserialization will preserve the format of the events.
For example, if an event contains comma-delimited fields, and fieldA and fieldB are filtered out, those fields’ positions will be set to null but not deleted completely.
The Parser Function can’t remove fields that it didn’t create. A subsequent Eval Function can do this.
