Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fuser-guides%2Fmcp-server%2Ftools%2Fparsing-rules.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fuser-guides%2Fmcp-server%2Ftools%2Fparsing-rules.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.) # Parsing Rules Manage Coralogix [Parsing Rules](https://docs-docusaurus.kinsta.page/user-guides/data-transformation/parsing/log-parsing-rules/.md) directly from your AI agent. The MCP server provides a unified tool to create, retrieve, update, and delete parsing rules—and generate infrastructure-as-code definitions from any rule configuration. Manage log parsing in the same workflow where you analyze logs—no context switching between your AI agent and the Coralogix UI. ## Tool[​](#tool "Direct link to Tool") All parsing rule operations are handled by a single unified tool: `manage_parsing_rules`. | Action | Description | | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `create` | Create a parsing rule for log transformation during ingestion. | | `get` | Retrieve a specific parsing rule by ID. | | `list` | List parsing rules with an optional name filter. | | `update` | Update an existing parsing rule. The agent retrieves the current configuration first, then applies your changes. | | `delete` | Delete a parsing rule by ID. | | `generate_openapi` | Generate the OpenAPI JSON payload for use with the Coralogix REST API. | | `generate_kubernetes` | Generate a Kubernetes Operator YAML manifest for the [Coralogix Operator](https://docs-docusaurus.kinsta.page/external/coralogix-operator). | | `generate_terraform` | Generate Terraform HCL for the [Coralogix Terraform Provider](https://docs-docusaurus.kinsta.page/developer-portal/infrastructure-as-code/terraform-provider/coralogix-terraform-provider/.md). | IaC generation actions work with both existing and newly described rules. To export an existing rule, retrieve it first with `get` or `list`, then pass it to the generation action. You can also describe a rule from scratch and generate IaC without creating it in Coralogix. ## Supported rule types[​](#supported-rule-types "Direct link to Supported rule types") The tool supports all 10 Coralogix parsing rule types: | Rule type | Key | Description | | ----------------- | ------------------ | ---------------------------------------------------------------------- | | Parse | `parse` | Extract fields from log text using a regex and convert matches to JSON | | Block | `block` | Drop logs matching a regex pattern | | Allow | `allow` | Keep only logs matching a regex pattern (inverse of Block) | | JSON Extract | `jsonExtract` | Extract values from JSON-structured logs | | Replace | `replace` | Replace text matching a regex pattern | | Extract Timestamp | `extractTimestamp` | Parse a custom timestamp from log text | | Remove Fields | `removeFields` | Remove specified fields from log entries | | JSON Stringify | `jsonStringify` | Convert a JSON object to a string representation | | Extract | `extract` | Extract values using regex capture groups | | Parse JSON Field | `parseJsonField` | Parse a string field containing JSON into structured data | ## Example prompts[​](#example-prompts "Direct link to Example prompts") ### Create a parsing rule[​](#create-a-parsing-rule "Direct link to Create a parsing rule") ``` Create a parsing rule that extracts the request_id, method, and path from my nginx access logs using regex capture groups. ``` ### List rules by name[​](#list-rules-by-name "Direct link to List rules by name") ``` List all parsing rules with "production" in the name. ``` ### Update a rule[​](#update-a-rule "Direct link to Update a rule") ``` Update my "Extract Request ID" rule to also capture the response time. ``` The agent retrieves the rule first, then applies your changes. ### Generate Terraform for a new rule[​](#generate-terraform-for-a-new-rule "Direct link to Generate Terraform for a new rule") ``` Generate Terraform HCL for a block rule that drops health-check logs from the load balancer. ``` ### Generate Terraform from an existing rule[​](#generate-terraform-from-an-existing-rule "Direct link to Generate Terraform from an existing rule") ``` Generate the Terraform HCL for my "Extract Request ID" parsing rule. ``` The agent retrieves the rule, then renders the Terraform resource definition. ### Generate Kubernetes YAML from an existing rule[​](#generate-kubernetes-yaml-from-an-existing-rule "Direct link to Generate Kubernetes YAML from an existing rule") ``` Generate the Kubernetes Operator YAML for my "Nginx Access Logs" parsing rule. ``` ### Create a rule and export[​](#create-a-rule-and-export "Direct link to Create a rule and export") ``` Create a block rule that drops health-check logs from the load balancer, then generate the Kubernetes Operator YAML for it. ``` ### Bulk export[​](#bulk-export "Direct link to Bulk export") ``` List all parsing rules with "production" in the name and generate Terraform HCL for each one. ``` ## Important behaviors[​](#important-behaviors "Direct link to Important behaviors") * **Update requires retrieval first.** To update a parsing rule, the agent retrieves the current configuration using `get` or `list`, then applies your changes. * **IaC generation requires the full rule definition.** For existing rules, the agent retrieves the rule first. For new rules, describe the configuration and the agent generates IaC without creating the rule in Coralogix. * **Rules apply at ingestion.** Parsing rules transform logs as they enter Coralogix. Changes take effect on newly ingested data. * **Full type coverage.** Every parsing rule type available in the Coralogix platform has a dedicated schema, covering the complete range of log transformation operations. ## Next steps[​](#next-steps "Direct link to Next steps") Review the [Permissions](https://docs-docusaurus.kinsta.page/user-guides/mcp-server/permissions/.md) required to use MCP server tools.