QuestionQ36Verified/Parsing and NormalizationCopy linkReport a problemAsk AstroTutorSave questionWhat should be done with a field that is not CPS-compliant when it is added to a parser?ARemove the field from the parser outputBLeave the field unchangedCConvert the field to ECS formatDPrefix the field with VendorShow AnswerAnswerExplanationCPS-compliant parsers preserve fields that do not exist in ECS by prefixing their names with Vendor., which keeps vendor-specific fields distinct while reserving the root namespace for ECS fields.Learn moreCPS-Compliant ParsersShow comments0Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion