Adoption Guides-Draft

Hi everyone,I'm working on a Google SecOps Parser Extension for Terraform Enterprise logs.The base parser is successfully extracting data into UDM. For example: extracted.fields["_raw.component"] = "nginx" extracted.fields["_raw.log"] = [removed by moderator] - - [07/Aug/2026:18:12:19 +0000] "GET /api/v2/organizations/uwm/workspaces HTTP/1.1" 304 0 "https://terraform.uwm.com/app/uwm/workspaces" "Mozilla/5.0 ..."Show more linesRaw event:{"_raw": {"component": "nginx","log": " [removed by moderator] - - [07/Aug/2026:18:12:19 +0000] \"GET /api/v2/organizations/uwm/workspaces HTTP/1.1\" 304 0 ..."},"cribl_group": "AzureEastUS2-Upper"}My goal is to create a Parser Extension that parses the nginx access log and maps fields such as:client_iphttp_methodurl_pathstatus_codeuser_agent However, when I try to reference:[_raw][log][_raw][component]or%{_raw.log} I get errors such as: "_raw.log" not found in state data Questions:What is the correct way to reference fields that are already extracted by

Hi everyone,I'm working on a Google SecOps Parser Extension for Terraform Enterprise logs.The base parser is successfully extracting data into UDM. For example: extracted.fields["_raw.component"] = "nginx" extracted.fields["_raw.log"] =127.0.0.6 - - [07/Aug/2026:18:12:19 +0000] "GET /api/v2/organizations/uwm/workspaces HTTP/1.1" 304 0 "https://terraform.uwm.com/app/uwm/workspaces" "Mozilla/5.0 ..."Show more linesRaw event:{"_raw": {"component": "nginx","log": "127.0.0.6 - - [07/Aug/2026:18:12:19 +0000] \"GET /api/v2/organizations/uwm/workspaces HTTP/1.1\" 304 0 ..."},"cribl_group": "AzureEastUS2-Upper"}My goal is to create a Parser Extension that parses the nginx access log and maps fields such as:client_iphttp_methodurl_pathstatus_codeuser_agent However, when I try to reference:[_raw][log][_raw][component]or%{_raw.log} I get errors such as: "_raw.log" not found in state data Questions:What is the correct way to reference fields that are already extracted by the base parser, such as:ex