1. A method performed by a distributed agent of a network security system, the method comprising: accessing a message in a message log, wherein the message log associates a host identifier with the message, the host identifier being an identifier of a host that sent the message to the message log; accessing a host-specific list of multiple parsers associated with the host identifier associated with the message; the agent attempting to parse the message using a first parser in the host-specific list; responsive to unsuccessful parsing using the first parser, attempting to parse the message using a second parser in the host-specific list; responsive to unsuccessful parsing using all the parsers in the host-specific list: attempting to parse the message using a parser in a comprehensive list of multiple parsers; and responsive to successful parsing using the parser in the comprehensive list, adding the parser to the host-specific list.