---
title: NerdGraph tutorial: Manage log parsing rules
source: https://docs.newrelic.com/docs/apis/nerdgraph/examples/nerdgraph-log-parsing-rules-tutorial
---

You can use NerdGraph at [api.newrelic.com/graphiql](https://api.newrelic.com/graphiql) to create, query, and manage your [parsing rules](https://docs.newrelic.com/docs/logs/log-management/ui-data/parsing/) for logs. NerdGraph is our GraphQL-format API explorer.

## Data parsing schema [#parsing-schema]

Available parsing rule fields include:

| Fields         | Description                                                                                                                                                                                                                                                                                                                                                               |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `id`           | Unique data parsing identifier.                                                                                                                                                                                                                                                                                                                                           |
| `parsingRules` | The name of the parsing rule.                                                                                                                                                                                                                                                                                                                                             |
| `description`  | A description of what this parsing rule represents.                                                                                                                                                                                                                                                                                                                       |
| `grok`         | The Grok pattern for this parsing rule. For example, you can include the `logtype` for the Grok pattern you are using with a [built-in parsing rule](https://docs.newrelic.com/docs/logs/log-management/ui-data/built-log-parsing-rulesets/), such as `logtype = 'alb'`. However, you are not limited to using `logtype`; any attribute can be used as matching criteria. |
| `lucene`       | The search value used from the New Relic UI; for example, `logtype:alb`. For more information about valid Lucene functions in the New Relic UI, see our documentation about [logs query syntax](https://docs.newrelic.com/docs/logs/log-management/ui-data/query-syntax-logs/).                                                                                           |
| `accountId`    | The New Relic account ID for the user.                                                                                                                                                                                                                                                                                                                                    |
| `nrql`         | The NRQL query string used for queries, if applicable; for example: `"SELECT * FROM Log WHERE `logtype` = 'testLogs'"`                                                                                                                                                                                                                                                    |
| `createdBy`    | The user who created the rule. Optional: You can also include `email`, `gravatar`, `id`, and `name` with this.                                                                                                                                                                                                                                                            |
| `updatedBy`    | The user who last updated the rule. Optional: You can also include `email`, `gravatar`, `id`, and `name` with this.                                                                                                                                                                                                                                                       |
| `enabled`      | Whether or not this parsing rule is enabled.                                                                                                                                                                                                                                                                                                                              |
| `deleted`      | Whether or not this parsing rule has been deleted. Deleting a parsing rule does not delete the already routed logs.                                                                                                                                                                                                                                                       |

## Example query of log parsing rules [#query-parsing-rules]

This NerdGraph API request example gets all of the parsing rules for a given account. In this example, all of the available fields are requested.

```graphql
query{
  actor {
    account(id: YOUR_ACCOUNT_ID) {
      logConfigurations {
        parsingRules {
          accountId
          createdBy {
            email
            gravatar
            id
            name
          }
          deleted
          description
          enabled
          grok
          id
          lucene
          nrql
          updatedAt
          updatedBy {
            email
            gravatar
            id
            name
          }
        }
      }
    }
  }
}
```

The response returned will look similar to this:

```json
{
  "data": {
    "actor": {
      "account": {
        "id": 12345678,
        "logConfigurations": {
          "parsingRules": [
            {
              "accountId": 12345678,
              "createdBy": {
                "email": "myname@ncompany.com",
                "gravatar": "https://secure.gravatar.com/avatar/d0a88888888d666d111111111111111f",
                "id": 7777777,
                "name": "My Name"
              },
              "deleted": false,
              "description": "Integer Test",
              "enabled": true,
              "grok": "source=%{NUMBER:test:int}",
              "id": "123",
              "lucene":  ,
              "nrql": "SELECT * FROM Log WHERE `logtype` = 'integer'",
              "updatedAt": "2021-08-23T17:25:06.553Z[UTC]",
              "updatedBy": {
                "email": "myname@ncompany.com",
                "gravatar": "https://secure.gravatar.com/avatar/d0a88888888d666d111111111111111f",
                "id": 7777777,
                "name": "My Name"
              }
            }
...
```

## Create parsing rules [#create-parsing-rules]

This example creates a new log parsing rule. Before creating the rule, be sure to review the documentation about [log parsing](https://docs.newrelic.com/docs/logs/log-management/ui-data/parsing/) and [built-in parsing rules](https://docs.newrelic.com/docs/logs/log-management/ui-data/built-log-parsing-rulesets/).

```graphql
mutation {
  logConfigurationsCreateParsingRule(
    accountId: YOUR_ACCOUNT_ID
    rule: {
      description: "example parsing rule"
      enabled: false
      grok: "sampleattribute=%{NUMBER:test:int}"
      lucene: "logtype:testLogs"
      nrql: "SELECT * FROM Log WHERE `logtype` = 'testLogs'"
    }
  ) {
    rule {
      id
      enabled
      description
      grok
    }
    errors {
      message
      type
    }
  }
}
```

## Update parsing rules [#update-parsing-rules]

This example updates the parsing rule whose `id` is `"123"`. You can update any of the following fields as needed: `description`, `enabled`, `grok`, `lucene`, and `nrql`.

```graphql
mutation {
  logConfigurationsUpdateParsingRule(
    accountId: YOUR_ACCOUNT_ID
    rule: {
      description: "example parsing rule"
      enabled: false
      grok: "sampleattribute=%{NUMBER:test:int}"
      lucene: "logtype:testLogs"
      nrql: "SELECT * FROM Log WHERE `logtype` = 'testLogs'"
    }
    id: "123"
  ) {
    errors {
      message
      type
    }
    rule {
      id
      grok
      description
      enabled
    }
  }
}
```

## Delete parsing rules [#delete-parsing-rules]

Deleting a parsing rule doesn't delete data that has already been parsed. The data is retained for a given period of time defined by the `retentionPolicy` field.

```graphql
mutation {
  logConfigurationsDeleteParsingRule(accountId: YOUR_ACCOUNT_ID, id: "123") {
    errors {
      message
      type
    }
  }
}
```