Question

A security operations engineer is onboarding a third-party web application firewall (WAF) into Google SecOps. The vendor's appliance emits two distinct log formats depending on the event category: HTTP transaction logs in structured JSON and administrative/audit events in syslog key-value pairs. Both formats arrive on the same forwarder feed under one log source. During validation, the engineer notices that only the JSON events are producing correctly normalized UDM records, while the audit events generate parser errors. What is the most appropriate way to ensure both formats are correctly parsed and normalized?

Accepted Answer

Build a single parser that includes conditional branching logic to detect the format of each incoming raw log and apply the appropriate extraction and UDM mapping for JSON versus key-value events.

Answer

Split the feed into two separate log sources at the forwarder and assign a different Google-provided default parser to each, since a log source can only map to one format.

Answer

Disable normalization for the audit events and ingest them as raw logs only, since key-value syslog cannot be mapped to UDM.

Answer

Configure a parser extension that overrides the JSON mapping so all events are treated as key-value pairs, forcing consistent extraction.