{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-161-validate-parsed-fields-before-removing-the-original-log-column-in-a-transformation/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-161-validate-parsed-fields-before-removing-the-original-log-column-in-a-transformation/", "slug": "dse-20260917-161-validate-parsed-fields-before-removing-the-original-log-column-in-a-transformation", "url": "https://update.dsesecurity.com/updates/dse-20260917-161-validate-parsed-fields-before-removing-the-original-log-column-in-a-transformation/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-161-validate-parsed-fields-before-removing-the-original-log-column-in-a-transformation.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-161-validate-parsed-fields-before-removing-the-original-log-column-in-a-transformation/" }, "title": "Validate parsed fields before removing the original log column in a transformation", "summary": "Preserve the intended information when replacing free text with structured fields.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:19+00:00", "modified_at": "2026-09-17T16:46:29+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 214, "potentially_affected": "Apply this review to a single-stage Azure Monitor transformation that proposes to remove an original text column. Identify which information must remain available to responders and which text is deliberately excluded. Keep preview multi-stage processing outside this particular change review.", "dse_recommendation": "DSE recommends building sanitized examples of expected, incomplete and malformed input before removing the original field.", "primary_source": { "name": "Sample transformations in Azure Monitor - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/data-collection-transformations-samples", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s transformation examples extract useful content with string or parsing functions, create a new column with extend and remove the original column with project-away. This pattern replaces the source text in the outgoing record with the selected parsed information. Microsoft Learn.

\n

Applicability

\n

Apply this review to a single-stage Azure Monitor transformation that proposes to remove an original text column. Identify which information must remain available to responders and which text is deliberately excluded. Keep preview multi-stage processing outside this particular change review.

\n

DSE recommendation

\n

DSE recommends building sanitized examples of expected, incomplete and malformed input before removing the original field. Have the log consumer approve the retained fields and the handling of failed parsing. Compare the current source’s example with the actual target-table schema. Retain the previous transformation and a controlled source sample for investigating unexpected output.

\n

Verification

\n

Process the approved examples and compare every retained field with the input’s intended meaning. Confirm the original column is absent only where the change specification expects that outcome. Exercise malformed records to ensure their handling is visible and acceptable. Preserve the input/output comparisons before broad rollout so successful parsing of one normal record does not stand in for coverage of the real format variations.

\n

Official references

\n

Microsoft Learn: Sample transformations in Azure Monitor.

", "content_text": "Source facts\nMicrosoft’s transformation examples extract useful content with string or parsing functions, create a new column with extend and remove the original column with project-away. This pattern replaces the source text in the outgoing record with the selected parsed information. Microsoft Learn.\nApplicability\nApply this review to a single-stage Azure Monitor transformation that proposes to remove an original text column. Identify which information must remain available to responders and which text is deliberately excluded. Keep preview multi-stage processing outside this particular change review.\nDSE recommendation\nDSE recommends building sanitized examples of expected, incomplete and malformed input before removing the original field. Have the log consumer approve the retained fields and the handling of failed parsing. Compare the current source’s example with the actual target-table schema. Retain the previous transformation and a controlled source sample for investigating unexpected output.\nVerification\nProcess the approved examples and compare every retained field with the input’s intended meaning. Confirm the original column is absent only where the change specification expects that outcome. Exercise malformed records to ensure their handling is visible and acceptable. Preserve the input/output comparisons before broad rollout so successful parsing of one normal record does not stand in for coverage of the real format variations.\nOfficial references\nMicrosoft Learn: Sample transformations in Azure Monitor.", "content_markdown": "## Source facts\n\nMicrosoft’s transformation examples extract useful content with string or parsing functions, create a new column with extend and remove the original column with project-away. This pattern replaces the source text in the outgoing record with the selected parsed information. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/data-collection-transformations-samples).\n\n## Applicability\n\nApply this review to a single-stage Azure Monitor transformation that proposes to remove an original text column. Identify which information must remain available to responders and which text is deliberately excluded. Keep preview multi-stage processing outside this particular change review.\n\n## DSE recommendation\n\nDSE recommends building sanitized examples of expected, incomplete and malformed input before removing the original field. Have the log consumer approve the retained fields and the handling of failed parsing. Compare the current source’s example with the actual target-table schema. Retain the previous transformation and a controlled source sample for investigating unexpected output.\n\n## Verification\n\nProcess the approved examples and compare every retained field with the input’s intended meaning. Confirm the original column is absent only where the change specification expects that outcome. Exercise malformed records to ensure their handling is visible and acceptable. Preserve the input/output comparisons before broad rollout so successful parsing of one normal record does not stand in for coverage of the real format variations.\n\n## Official references\n\n[Microsoft Learn: Sample transformations in Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/data-collection-transformations-samples)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-161-validate-parsed-fields-before-removing-the-original-log-column-in-a-transformation/", "url": "https://update.dsesecurity.com/updates/dse-20260917-161-validate-parsed-fields-before-removing-the-original-log-column-in-a-transformation/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-161-validate-parsed-fields-before-removing-the-original-log-column-in-a-transformation/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Validate parsed fields before removing the original log column in a transformation", "item": "https://update.dsesecurity.com/updates/dse-20260917-161-validate-parsed-fields-before-removing-the-original-log-column-in-a-transformation/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-161-validate-parsed-fields-before-removing-the-original-log-column-in-a-transformation/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-161-validate-parsed-fields-before-removing-the-original-log-column-in-a-transformation/", "url": "https://update.dsesecurity.com/updates/dse-20260917-161-validate-parsed-fields-before-removing-the-original-log-column-in-a-transformation/", "headline": "Validate parsed fields before removing the original log column in a transformation", "description": "Preserve the intended information when replacing free text with structured fields.", "abstract": "Preserve the intended information when replacing free text with structured fields.", "articleBody": "Source facts\nMicrosoft’s transformation examples extract useful content with string or parsing functions, create a new column with extend and remove the original column with project-away. This pattern replaces the source text in the outgoing record with the selected parsed information. Microsoft Learn.\nApplicability\nApply this review to a single-stage Azure Monitor transformation that proposes to remove an original text column. Identify which information must remain available to responders and which text is deliberately excluded. Keep preview multi-stage processing outside this particular change review.\nDSE recommendation\nDSE recommends building sanitized examples of expected, incomplete and malformed input before removing the original field. Have the log consumer approve the retained fields and the handling of failed parsing. Compare the current source’s example with the actual target-table schema. Retain the previous transformation and a controlled source sample for investigating unexpected output.\nVerification\nProcess the approved examples and compare every retained field with the input’s intended meaning. Confirm the original column is absent only where the change specification expects that outcome. Exercise malformed records to ensure their handling is visible and acceptable. Preserve the input/output comparisons before broad rollout so successful parsing of one normal record does not stand in for coverage of the real format variations.\nOfficial references\nMicrosoft Learn: Sample transformations in Azure Monitor.", "datePublished": "2026-09-17T16:32:19+00:00", "dateModified": "2026-09-17T16:46:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-161-validate-parsed-fields-before-removing-the-original-log-column-in-a-transformation/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-161-validate-parsed-fields-before-removing-the-original-log-column-in-a-transformation/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Validate parsed fields before removing the original log column in a transformation" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 214, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Sample transformations in Azure Monitor - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/data-collection-transformations-samples" } } ] } }