All Journald fields end up in the extracted_fields.
https://cloud.google.com/chronicle/docs/ingestion/parser-list/journald-changelog
Solved
Is anyone else having trouble with the JOURNALD parser that doesn't normalize event fields to UDM?
+8- Bronze 5
- 36 replies
Best answer by cmmartin_google
A parser updated was recently added and is expected to start rolling out from the 7th October onwards that will normalize those JOURNALD added fields.
+10A parser updated was recently added and is expected to start rolling out from the 7th October onwards that will normalize those JOURNALD added fields.
+8- Bronze 5
- 36 replies
I checked the logs this morning and the `metadata.parser_version = "1.0"`. Also, no updates in the docs page: https://cloud.google.com/chronicle/docs/ingestion/parser-list/journald-changelog
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.