SecOps Custom Parser - Error [recursive rawDataToProto failed: field \"security_result\"]

​@Lutfi0_0  We just hosted two Parsing webinars in Community in Jan and Dec ‘25. These might help. 

​@Lutfi0_0 Also try this out… full disclosure this is a Gemini response so please double check the information before implementing. Let me know if this solves your problem. 

The error you are seeing (received non-slice or non-array raw output for repeated field) happens because the security_result field in the UDM schema is a repeated field (essentially an array).

Your current logic is trying to pass a single object/string to a field that expects a list. To fix this, you need to build your security result in a temporary variable and then merge it into the UDM path wrapped in square brackets [].

Here is the corrected version of your logic:

# 1. Map values to a temporary intermediate object
if [reason] =~ "Allowed" or [reason] =~ "ALLOWED" {
  mutate {
    replace => {
      "tmp_security_result.action" => "ALLOW"
    }
  }
}

mutate {
  replace => {
    "tmp_security_result.action_details" => "%{action}"
  }
}

# 2. Merge into UDM using the repeated field syntax (brackets)
if [tmp_security_result] != "" {
  mutate {
    merge => {
      # The [ ] brackets tell the parser to treat this as an array/slice
      "event.idm.read_only_udm.security_result" => [ "tmp_security_result" ]
    }
  }
}

Key Changes Made:

• The Array Wrap: In the final merge statement, I changed "security_result" to [ "tmp_security_result" ]. This satisfies the "repeated field" requirement in the proto conversion.

• Intermediate Mapping: Using a tmp_ prefix ensures you aren't accidentally overwriting existing UDM structures before they are fully formed.

A quick note: Double-check that the variable %{action} is defined earlier in your parser. If it isn't, action_details will be populated with the literal string "%{action}".

Hope this helps!