Hello everyone!
I recently started using Fluent Bit to send DNS logs from Windows Server to Google Chronicle Forwarder which then forwards them to Google Chronicle SIEM.

But I have a doubt.

Im able to send dns logs in JSON raw format, using the following configuration:

[input]
Name              winlog
Channels          DNS Server
Interval_Sec      5
[output]
Name          tcp
Match         *
Host          IP of Chronicle forwarder
Port          PORT of Chronicle
Format        json_lines

However, the logs are sent in raw (json) format and are not parsed to UDM (structured data format of Chronicle).

Should I modify the configuration ?

Or the problem is with SIEM?

Thank you in advance!