Google SecOps Parser Extension - How to reference extracted.fields["_raw.log"] from base parser?

Hi everyone,

I'm working on a Google SecOps Parser Extension for Terraform Enterprise logs.

The base parser is successfully extracting data into UDM. For example:

extracted.fields["_raw.component"] = "nginx"

extracted.fields["_raw.log"] =

[removed by moderator] - - [07/Aug/2026:18:12:19 +0000] "GET /api/v2/organizations/uwm/workspaces HTTP/1.1" 304 0 "https://terraform.uwm.com/app/uwm/workspaces" "Mozilla/5.0 ..."

Show more lines

Raw event:

{

"_raw": {

"component": "nginx",

"log": " [removed by moderator] - - [07/Aug/2026:18:12:19 +0000] \"GET /api/v2/organizations/uwm/workspaces HTTP/1.1\" 304 0 ..."

},

"cribl_group": "AzureEastUS2-Upper"

}

My goal is to create a Parser Extension that parses the nginx access log and maps fields such as:

client_ip

http_method

url_path

status_code

user_agent

• However, when I try to reference:

[_raw][log]

[_raw][component]

or

%{_raw.log}

I get errors such as:

"_raw.log" not found in state data

Questions:

1. What is the correct way to reference fields that are already extracted by the base parser, such as:

extracted.fields["_raw.component"]

extracted.fields["_raw.log"]

1. Are extracted.fields accessible within a Parser Extension?

2. Is there a recommended approach for parsing the nginx log stored in _raw.log and mapping the results into UDM fields?

Any examples or documentation would be greatly appreciated.

Thanks!