# Parsing Rules

Manage Coralogix [Parsing Rules](https://coralogix.com/docs/user-guides/data-transformation/parsing/log-parsing-rules/index.md) directly from your AI agent. The MCP server provides a unified tool to create, retrieve, update, and delete parsing rules—and generate infrastructure-as-code definitions from any rule configuration.

Manage log parsing in the same workflow where you analyze logs—no context switching between your AI agent and the Coralogix UI.

## Tool

All parsing rule operations are handled by a single unified tool: `manage_parsing_rules`.

| Action                | Description                                                                                                                                                                                 |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `create`              | Create a parsing rule for log transformation during ingestion.                                                                                                                              |
| `get`                 | Retrieve a specific parsing rule by ID.                                                                                                                                                     |
| `list`                | List parsing rules with an optional name filter.                                                                                                                                            |
| `update`              | Update an existing parsing rule. The agent retrieves the current configuration first, then applies your changes.                                                                            |
| `delete`              | Delete a parsing rule by ID.                                                                                                                                                                |
| `generate_openapi`    | Generate the OpenAPI JSON payload for use with the Coralogix REST API.                                                                                                                      |
| `generate_kubernetes` | Generate a Kubernetes Operator YAML manifest for the [Coralogix Operator](https://coralogix.com/docs/developer-portal/infrastructure-as-code/coralogix-operator/index.md).                  |
| `generate_terraform`  | Generate Terraform HCL for the [Coralogix Terraform Provider](https://coralogix.com/docs/developer-portal/infrastructure-as-code/terraform-provider/coralogix-terraform-provider/index.md). |

IaC generation actions work with both existing and newly described rules. To export an existing rule, retrieve it first with `get` or `list`, then pass it to the generation action. You can also describe a rule from scratch and generate IaC without creating it in Coralogix.

## Supported rule types

The tool supports all 10 Coralogix parsing rule types:

| Rule type         | Key                | Description                                                            |
| ----------------- | ------------------ | ---------------------------------------------------------------------- |
| Parse             | `parse`            | Extract fields from log text using a regex and convert matches to JSON |
| Block             | `block`            | Drop logs matching a regex pattern                                     |
| Allow             | `allow`            | Keep only logs matching a regex pattern (inverse of Block)             |
| JSON Extract      | `jsonExtract`      | Extract values from JSON-structured logs                               |
| Replace           | `replace`          | Replace text matching a regex pattern                                  |
| Extract Timestamp | `extractTimestamp` | Parse a custom timestamp from log text                                 |
| Remove Fields     | `removeFields`     | Remove specified fields from log entries                               |
| JSON Stringify    | `jsonStringify`    | Convert a JSON object to a string representation                       |
| Extract           | `extract`          | Extract values using regex capture groups                              |
| Parse JSON Field  | `parseJsonField`   | Parse a string field containing JSON into structured data              |

## Example prompts

### Create a parsing rule

```text
Create a parsing rule that extracts the request_id, method, and path
from my nginx access logs using regex capture groups.
```

### List rules by name

```text
List all parsing rules with "production" in the name.
```

### Update a rule

```text
Update my "Extract Request ID" rule to also capture the response time.
```

The agent retrieves the rule first, then applies your changes.

### Generate Terraform for a new rule

```text
Generate Terraform HCL for a block rule that drops health-check logs
from the load balancer.
```

### Generate Terraform from an existing rule

```text
Generate the Terraform HCL for my "Extract Request ID" parsing rule.
```

The agent retrieves the rule, then renders the Terraform resource definition.

### Generate Kubernetes YAML from an existing rule

```text
Generate the Kubernetes Operator YAML for my "Nginx Access Logs" parsing rule.
```

### Create a rule and export

```text
Create a block rule that drops health-check logs from the load balancer,
then generate the Kubernetes Operator YAML for it.
```

### Bulk export

```text
List all parsing rules with "production" in the name and generate
Terraform HCL for each one.
```

## Important behaviors

- **Update requires retrieval first.** To update a parsing rule, the agent retrieves the current configuration using `get` or `list`, then applies your changes.
- **IaC generation requires the full rule definition.** For existing rules, the agent retrieves the rule first. For new rules, describe the configuration and the agent generates IaC without creating the rule in Coralogix.
- **Rules apply at ingestion.** Parsing rules transform logs as they enter Coralogix. Changes take effect on newly ingested data.
- **Full type coverage.** Every parsing rule type available in the Coralogix platform has a dedicated schema, covering the complete range of log transformation operations.

## Next steps

Review the [Permissions](https://coralogix.com/docs/user-guides/mcp-server/permissions/index.md) required to use MCP server tools.