Parser Factory builds parsers from your unparsed logs

13 July 2026. The kymeer Parser Factory now turns logs that no parser recognised into working parsers, built from your own samples.

What it does

Every SOC has sources that do not parse cleanly. In kymeer, those lines are kept, not discarded, and they remain searchable by keyword. They are also the input for the Parser Factory.

The Parser Factory:

1. collects unparsed logs from the dead-letter store, separately for each tenant and source
2. groups the lines by their structure; a parser is never built from a single line
3. builds a candidate parser for each group and scores it against that group's own lines
4. applies the parser only if it clears an automated quality gate; a candidate that falls short is left for a person to complete and is never partly applied
5. parses the waiting backlog for that source again, so earlier records gain their fields too

If a first attempt needs improvement, the Parser Factory can ask an AI model for help using redacted samples. That step checks the platform's AI egress switch on every call, so with egress off it does not run.

Sample log lines are customer data. In this release, each tenant's parsers and sample lines stayed within that tenant.

Who it is for

• SOC leads with sources that arrive unparsed and leave gaps in detection.
• MSSPs onboarding clients whose estates include unusual or custom log formats.
• Teams moving off another SIEM who need their priority sources parsed before they commit.

Since October

The Parser Factory now adds the shapes it learns to one shared parser per device type, so every tenant with that device benefits, and a live shape applies to events as they arrive. Shared parsers carry structure only, never log lines or tenant identities. See the October 2026 release notes.

Learn more

Read Formats and the Parser Factory, or see Collection and Parser Factory.