All Journald fields end up in the extracted_fields.
https://cloud.google.com/chronicle/docs/ingestion/parser-list/journald-changelog
Solved
Is anyone else having trouble with the JOURNALD parser that doesn't normalize event fields to UDM?
+9- Silver 2
Best answer by cmmartin_google
A parser updated was recently added and is expected to start rolling out from the 7th October onwards that will normalize those JOURNALD added fields.
A parser updated was recently added and is expected to start rolling out from the 7th October onwards that will normalize those JOURNALD added fields.
+9- Silver 2
β
I checked the logs this morning and the `metadata.parser_version = "1.0"`. Also, no updates in the docs page:Β https://cloud.google.com/chronicle/docs/ingestion/parser-list/journald-changelogΒ
Login to the community
Login with SSO
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.