ListCbnParsers parity mapping

Supported in:

This guide details the request and response mapping specifications and property parity analysis for migrating from the legacy Backstory Tools API (ListCbnParsers) to the modern Chronicle API (ListParsers).

Protocol and mapping overview

Feature Legacy API (ListCbnParsers) Modern Chronicle API (ListParsers)
HTTP Method GET GET
Permissions Partner token or legacy API keys chronicle.googleapis.com/parsers.list

Request payload field-by-field parity

The modern Chronicle API ListParsersRequest scopes listings under target parent paths and adds options for filtering and basic views.

Legacy Field (ListCbnParsersRequest) Modern Field (ListParsersRequest) Field type Parity & Migration Notes
— parent (in HTTP path) string Google Cloud Scoping Context: Scopes the list target under parent projects using standard resource paths: projects/{project}/locations/{location}/instances/{instance}/logTypes/{log_type}. To list parsers across all log types (matching legacy ListCbnParsers without a log type filter), specify - for {log_type}: projects/.../logTypes/-/parsers.
page_size page_size int32 Parity Mapped: Pagination page size limit. Rename to pageSize in JSON.
page_token page_token string Parity Mapped: Paging resumption token. Rename to pageToken in JSON.
filter filter string Parity Mapped / Syntax Shift: Filter expression strings. While legacy filters searched on log_type or config state, log type filtering is now handled natively using the parent path parameter, and status filtering follows standard AIP-160 filter syntax (for example, filtering by release stage or author).
— view enum New Parameter: Selects the parser view (ParserView enum: BASIC_VIEW, FULL_VIEW). Default is FULL_VIEW. BASIC_VIEW omits large binary configs and changelogs.

Response payload field-by-field parity

Both APIs return lists of parser configurations and pagination continuation tokens.

Legacy Field (ListCbnParsersResponse) Modern Field (ListParsersResponse message) Field type Parity & Migration Notes
cbn_parsers parsers repeated Parser Parity Mapped / Restructured: Mapped from legacy CbnParser lists to standard Parser message lists. Rename to parsers in JSON.
next_page_token next_page_token string Parity Mapped: Token to retrieve subsequent pages of parsers. Rename to nextPageToken in JSON.

Nested Parser property mappings

The fields mapping inside individual Parser definitions is as follows:

Legacy Field (CbnParser message) Modern Field (Parser message) Field type Parity & Migration Notes
config_id name string Parity Mapped: Mapped into standard canonical resource paths under name: projects/{pr}/locations/{loc}/instances/{in}/logTypes/{lt}/parsers/{id}.
log_type — (implicit in resource path) string Managed under the parent segment of the canonical name.
config cbn bytes Raw CBN parser bytes (omitted if view was set to BASIC_VIEW).
state release_stage / validation_stage enum Restructured: Legacy monolithic CbnConfigState enum is split into granular lifecycle attributes: release_stage and validation_stage.
submit_time / timestamps create_time Timestamp Standardized creation timestamp (createTime in JSON).
sha256 — string Retired: Hash verification is managed internally by Chronicle API storage engines.
validation_errors — (in validation_stage) Message If validation failed, errors are captured under standard operation metadata or error details.
change_log changelogs Message Structured changelog representation (omitted in BASIC_VIEW).
author creator.author string Mapped inside creator object.

Key differences

  • Service Consolidation and Architectural Shift:
    • Legacy backstory provided two separate methods: ListCbnParserHistory (for a specific log type) and ListCbnParsers (for all default parsers).
    • Modern Chronicle API consolidates parser listing into a single ListParsers method on ParserService. Scoping is determined by the parent resource path (specifying a specific log type or - for all log types).
  • Google Cloud Project Scoping Integration:
    • Scoped natively under parent project instance log type bindings.
  • View and Filtering Capabilities:
    • Introduces view options (BASIC_VIEW / FULL_VIEW) allowing clients to query parser summaries without downloading large configuration binaries.