Change log for GCP_APP_ENGINE
| Date | Changes |
|---|---|
| 2025-12-29 |
- event.idm.read_only_udm.principal.ip: Newly mapped protoPayload.requestMetadata.callerIp raw log field with event.idm.read_only_udm.principal.ip UDM field.- event.idm.read_only_udm.principal.asset.ip: Newly mapped protoPayload.requestMetadata.callerIp raw log field with event.idm.read_only_udm.principal.asset.ip UDM field.- event.idm.read_only_udm.principal.user.email_addresses: Newly mapped protoPayload.authenticationInfo.principalEmail raw log field with event.idm.read_only_udm.principal.user.email_addresses UDM field.- event.idm.read_only_udm.metadata.product_event_type: Newly mapped protoPayload.methodName raw log field with event.idm.read_only_udm.metadata.product_event_type UDM field.- event.idm.read_only_udm.target.resource.name: Newly mapped protoPayload.resourceName raw log field with event.idm.read_only_udm.target.resource.name UDM field.- event.idm.read_only_udm.target.application: Newly mapped protoPayload.serviceName raw log field with event.idm.read_only_udm.target.application UDM field.- event.idm.read_only_udm.target.resource.attribute.labels: Newly mapped protoPayload.resourceLocation.currentLocations raw log field with event.idm.read_only_udm.target.resource.attribute.labels UDM field.- event.idm.read_only_udm.principal.resource.attribute.labels: Newly mapped protoPayload.authenticationInfo.oauthInfo.oauthClientId raw log field with event.idm.read_only_udm.principal.resource.attribute.labels UDM field.- event.idm.read_only_udm.additional.fields: Newly mapped protoPayload.requestMetadata.requestAttributes.time, operation.first, protoPayload.serviceData.updateService.request.updateMask, operation.id, protoPayload.authenticationInfo.serviceAccountKeyName raw log fields with event.idm.read_only_udm.additional.fields UDM field.- event.idm.read_only_udm.security_result.rule_name: Newly mapped protoPayload.authorizationInfo.permission raw log field with event.idm.read_only_udm.security_result.rule_name UDM field.- event.idm.read_only_udm.security_result.description: Newly mapped protoPayload.authorizationInfo.permissionType raw log field with event.idm.read_only_udm.security_result.description UDM field.- event.idm.read_only_udm.security_result.action: Newly mapped protoPayload.authorizationInfo.granted raw log field with event.idm.read_only_udm.security_result.action UDM field.- The conditional logic for security_result.severity was updated to include NOTICE in addition to INFO for setting the severity to INFORMATIONAL.
|
| 2024-08-01 |
- If principal machine data is present, then set metadata.event_type to STATUS_UPDATE.- Mapped protoPayload.ip to principal.ip and principal.asset.ip.- Mapped protoPayload.appId to principal.resource.attribute.labels.- Mapped protoPayload.host to principal.hostname.- Mapped protoPayload.method to network.http.method.- Mapped protoPayload.@type , labels.clone_id and operation.producer to additional.labels.
|
| 2024-06-03 | - Added support for a new type of JSON logs. |
| 2024-03-05 | - Newly created parser. |