Question

A SecOps engineer ingests a high-volume proxy log source that is already mapped by a default parser. Analysts frequently pivot on a vendor-specific field, 'x-forwarded-user', that the default parser leaves in the raw log but does not map to any UDM field. As a result, analysts must run slow raw-log regex searches to find events by that user identity, and these searches routinely time out during investigations. What is the most appropriate way to make this field efficiently searchable without disrupting the existing default parser behavior?

Accepted Answer

Create a parser extension that maps 'x-forwarded-user' to an appropriate UDM field such as principal.user.userid so events are indexed at ingestion time

Answer

Request a brand-new custom log type and fully rewrite the parser so the field is captured, replacing the default parser entirely

Answer

Add 'x-forwarded-user' values to a reference list so analysts can filter searches against known users

Answer

Instruct analysts to continue using raw-log regex searches but narrow the time range to avoid timeouts