Solved: Use parser extension to remove field mapping - Page 2

lukas-lr · 12-14-2023 06:42 AM

Hi everyone,

Is there a way to delete a field value by using a parser extension? I want to "move" a value from one UDM field to the other, leaving the UDM field used by the default parser empty. However, I could not find an explicit way to set it to null or empty, such that the value set by the default parser is removed from the UDM event.

cmmartin_google

You can't remove a mapping from the default parser is my understanding of using Parser Extensions.

You can write a GROK extension to take the original value from the raw log into a new UDM field, but if you add a value as empty then the original UDM value will be used.

I think this would be a FR for Parser Extensions to support this, or else an update to the default parser via support.

View solution in original post

Webinar May 14th: Gemini's generative AI within Google SecOpsWebinar May 29th: Log Ingestion: Bindplane + Google SecOps

Use parser extension to remove field mapping

Webinar May 14th: Gemini's generative AI within Google SecOps
Webinar May 29th: Log Ingestion: Bindplane + Google SecOps