# Validate parsed fields before removing the original log column in a transformation

> Preserve the intended information when replacing free text with structured fields.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-161-validate-parsed-fields-before-removing-the-original-log-column-in-a-transformation/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:19+00:00
- Modified: 2026-09-17T16:46:29+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Preserve the intended information when replacing free text with structured fields.

## Potentially affected

Apply this review to a single-stage Azure Monitor transformation that proposes to remove an original text column. Identify which information must remain available to responders and which text is deliberately excluded. Keep preview multi-stage processing outside this particular change review.

## DSE recommendation

DSE recommends building sanitized examples of expected, incomplete and malformed input before removing the original field.

## Article

## Source facts

Microsoft’s transformation examples extract useful content with string or parsing functions, create a new column with extend and remove the original column with project-away. This pattern replaces the source text in the outgoing record with the selected parsed information. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/data-collection-transformations-samples).

## Applicability

Apply this review to a single-stage Azure Monitor transformation that proposes to remove an original text column. Identify which information must remain available to responders and which text is deliberately excluded. Keep preview multi-stage processing outside this particular change review.

## DSE recommendation

DSE recommends building sanitized examples of expected, incomplete and malformed input before removing the original field. Have the log consumer approve the retained fields and the handling of failed parsing. Compare the current source’s example with the actual target-table schema. Retain the previous transformation and a controlled source sample for investigating unexpected output.

## Verification

Process the approved examples and compare every retained field with the input’s intended meaning. Confirm the original column is absent only where the change specification expects that outcome. Exercise malformed records to ensure their handling is visible and acceptable. Preserve the input/output comparisons before broad rollout so successful parsing of one normal record does not stand in for coverage of the real format variations.

## Official references

[Microsoft Learn: Sample transformations in Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/data-collection-transformations-samples).

## Primary reference

- Name: Sample transformations in Azure Monitor - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/data-collection-transformations-samples
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Validate parsed fields before removing the original log column in a transformation,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-161-validate-parsed-fields-before-removing-the-original-log-column-in-a-transformation/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.