AWS GuardDuty logs are not getting parsed

[g0wtham]

Hello team, 

We have recently ingested the AWS GuardDuty logs to our Secops platform but they are not getting parsed as expected. We do not face such issues with the rest of the feeds from AWS platform such as CloudTrail, EC2 VPCs, AWS Config. There is no error message but there appears a tag "UNPARSED_RAW_LOG

[BrianK]

How are you ingesting these?  Are they in unmodified JSON?  If so it's possible these are messages that haven't been considered in the parser and would need a support ticket to get updated,  you can create a parser extension in the mean time.