We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for GCP_APIGEE

Date Changes

2025-10-23 Enhancement:
- event.idm.read_only_udm.principal.ip: Newly mapped src_ip, clientIp raw log field with event.idm.read_only_udm.principal.ip UDM field.
- event.idm.read_only_udm.principal.asset.ip: Newly mapped src_ip, clientIp raw log field with event.idm.read_only_udm.principal.asset.ip UDM field.
- event.idm.read_only_udm.target.hostname: Newly mapped vhost raw log field with event.idm.read_only_udm.target.hostname UDM field.
- event.idm.read_only_udm.principal.nat_ip: Newly mapped xff raw log field with event.idm.read_only_udm.principal.nat_ip UDM field.
- event.idm.read_only_udm.network.http.user_agent: Newly mapped userAgent raw log field with event.idm.read_only_udm.network.http.user_agent UDM field.
- event.idm.read_only_udm.principal.user.userid: Newly mapped clientId, user raw log field with event.idm.read_only_udm.principal.user.userid UDM field.
- event.idm.read_only_udm.principal.application: Newly mapped appName raw log field with event.idm.read_only_udm.principal.application UDM field.
- event.idm.read_only_udm.target.application: Newly mapped app raw log field with event.idm.read_only_udm.target.application UDM field.
- event.idm.read_only_udm.principal.resource.product_object_id: Newly mapped appId raw log field with event.idm.read_only_udm.principal.resource.product_object_id UDM field.
- event.idm.read_only_udm.principal.user.email_addresses: Newly mapped developerMail raw log field with event.idm.read_only_udm.principal.user.email_addresses UDM field.
- event.idm.read_only_udm.network.http.method: Newly mapped requestVerb, requests.requestVerb raw log field with event.idm.read_only_udm.network.http.method UDM field.
- event.idm.read_only_udm.target.url: Newly mapped targetUrl, target_metadata.targetUri raw log field with event.idm.read_only_udm.target.url UDM field.
- event.idm.read_only_udm.target.resource.name: Newly mapped targetName raw log field with event.idm.read_only_udm.target.resource.name UDM field.
- event.idm.read_only_udm.network.http.response_code: Newly mapped statusCode raw log field with event.idm.read_only_udm.network.http.response_code UDM field.
- event.idm.read_only_udm.network.session_id: Newly mapped requestId raw log field with event.idm.read_only_udm.network.session_id UDM field.
- event.idm.read_only_udm.metadata.product_log_id: Newly mapped apiTraceId, messageId raw log field with event.idm.read_only_udm.metadata.product_log_id UDM field.
- event.idm.read_only_udm.intermediary: Newly mapped intermediary raw log field with event.idm.read_only_udm.intermediary UDM field.
- event.idm.read_only_udm.intermediary.resource.name: Newly mapped apiProxyName raw log field with event.idm.read_only_udm.intermediary.resource.name UDM field.
- event.idm.read_only_udm.intermediary.administrative_domain: Newly mapped organizationName raw log field with event.idm.read_only_udm.intermediary.administrative_domain UDM field.
- event.idm.read_only_udm.target.ip: Newly mapped requests.requestHost, requests.requestIp raw log field with event.idm.read_only_udm.target.ip UDM field.
- event.idm.read_only_udm.target.asset.ip: Newly mapped requests.requestHost, requests.requestIp raw log field with event.idm.read_only_udm.target.asset.ip UDM field.
- event.idm.read_only_udm.additional.fields: Newly mapped apiStatistics.apmNumber, responseStatusCode,alertInstanceId, alertInstanceTime,failOverDeveloperApp,flowName,requestUri, responseCode, applog, activity, parameters, message_data, traceId, developerApp, authStatus, latencyTotal, envStatus, failover_enabled, active_active_enabled, reference_id, duration, requests.requestScheme, requests.requestReceivedStartTimestamp, requests.requestReceivedEndTimestamp, requests.requestSentStartTimestamp, requests.requestSentEndTimestamp, requests.requestPayload, response.responsePayload, apiStatistics.organization, apiStatistics.environment, apiStatistics.flow_name, requestHeaders, responseHeaders, environmentName, environment, targetVerb, clientReceivedStartTimestamp, clientReceivedEndTimestamp, targetSentStartTimestamp, targetSentEndTimestamp, targetReceivedStartTimestamp, targetReceivedEndTimestamp, clientSentStartTimestamp, clientSentEndTimestamp, responseDesc, apikey, gatewayAuthId, gatewayAuthId2, gatewayAuthLevel, latencyRequestTotal, isErrorCodeCategorized, request.header.Timestamp, request.header.Message-Signature, target_metadata.targetVerb raw log field with event.idm.read_only_udm.additional.fields UDM field.
- event.idm.read_only_udm.target.resource.attribute.labels: Newly mapped environmentName, environment, targetVerb, latencyHeader, clientReceivedStartTimestamp, clientReceivedEndTimestamp, targetSentStartTimestamp, targetSentEndTimestamp, targetReceivedStartTimestamp, targetReceivedEndTimestamp, clientSentStartTimestamp, clientSentEndTimestamp, responseDesc, apikey, gatewayAuthId, gatewayAuthId2, gatewayAuthLevel, latencyRequestTotal, latencyTarget, latencyProxy, isErrorCodeCategorized, request.header.Timestamp, request.header.Message-Signature, target_metadata.targetVerb raw log field with event.idm.read_only_udm.target.resource.attribute.labels UDM field.
- event.idm.read_only_udm.security_result: Newly mapped security_result raw log field with event.idm.read_only_udm.security_result UDM field.
- event.idm.read_only_udm.security_result.detection_fields: Newly mapped hmac.computed, honeyPot, honeyPotMerchant raw log field with event.idm.read_only_udm.security_result.detection_fields UDM field.
- event.idm.read_only_udm.security_result.action_details: Newly mapped statusReason raw log field with event.idm.read_only_udm.security_result.action_details UDM field.
- event.idm.read_only_udm.security_result.action: Newly mapped security_result_action raw log field with event.idm.read_only_udm.security_result.action UDM field.
- event.idm.read_only_udm.security_result.category_details: Newly mapped signature raw log field with event.idm.read_only_udm.security_result.category_details UDM field.
- event.idm.read_only_udm.metadata.event_type: If has_principal_user is true, updated to USER_UNCATEGORIZED.
- event.idm.read_only_udm.metadata.event_type: If has_principal_ip is true and has_target is true, updated to NETWORK_CONNECTION.
- event.idm.read_only_udm.metadata.event_type: If has_principal_ip is true and has_target is false, updated to STATUS_UPDATE.
- event.idm.read_only_udm.metadata.event_type: Otherwise, updated to GENERIC_EVENT.
- Added gsub function to replace message with message_data in json_data.

Date	Changes
2025-10-23	Enhancement: - event.idm.read_only_udm.principal.ip: Newly mapped `src_ip`, `clientIp` raw log field with `event.idm.read_only_udm.principal.ip` UDM field. - event.idm.read_only_udm.principal.asset.ip: Newly mapped `src_ip`, `clientIp` raw log field with `event.idm.read_only_udm.principal.asset.ip` UDM field. - event.idm.read_only_udm.target.hostname: Newly mapped `vhost` raw log field with `event.idm.read_only_udm.target.hostname` UDM field. - event.idm.read_only_udm.principal.nat_ip: Newly mapped `xff` raw log field with `event.idm.read_only_udm.principal.nat_ip` UDM field. - event.idm.read_only_udm.network.http.user_agent: Newly mapped `userAgent` raw log field with `event.idm.read_only_udm.network.http.user_agent` UDM field. - event.idm.read_only_udm.principal.user.userid: Newly mapped `clientId`, `user` raw log field with `event.idm.read_only_udm.principal.user.userid` UDM field. - event.idm.read_only_udm.principal.application: Newly mapped `appName` raw log field with `event.idm.read_only_udm.principal.application` UDM field. - event.idm.read_only_udm.target.application: Newly mapped `app` raw log field with `event.idm.read_only_udm.target.application` UDM field. - event.idm.read_only_udm.principal.resource.product_object_id: Newly mapped `appId` raw log field with `event.idm.read_only_udm.principal.resource.product_object_id` UDM field. - event.idm.read_only_udm.principal.user.email_addresses: Newly mapped `developerMail` raw log field with `event.idm.read_only_udm.principal.user.email_addresses` UDM field. - event.idm.read_only_udm.network.http.method: Newly mapped `requestVerb`, `requests.requestVerb` raw log field with `event.idm.read_only_udm.network.http.method` UDM field. - event.idm.read_only_udm.target.url: Newly mapped `targetUrl`, `target_metadata.targetUri` raw log field with `event.idm.read_only_udm.target.url` UDM field. - event.idm.read_only_udm.target.resource.name: Newly mapped `targetName` raw log field with `event.idm.read_only_udm.target.resource.name` UDM field. - event.idm.read_only_udm.network.http.response_code: Newly mapped `statusCode` raw log field with `event.idm.read_only_udm.network.http.response_code` UDM field. - event.idm.read_only_udm.network.session_id: Newly mapped `requestId` raw log field with `event.idm.read_only_udm.network.session_id` UDM field. - event.idm.read_only_udm.metadata.product_log_id: Newly mapped `apiTraceId`, `messageId` raw log field with `event.idm.read_only_udm.metadata.product_log_id` UDM field. - event.idm.read_only_udm.intermediary: Newly mapped `intermediary` raw log field with `event.idm.read_only_udm.intermediary` UDM field. - event.idm.read_only_udm.intermediary.resource.name: Newly mapped `apiProxyName` raw log field with `event.idm.read_only_udm.intermediary.resource.name` UDM field. - event.idm.read_only_udm.intermediary.administrative_domain: Newly mapped `organizationName` raw log field with `event.idm.read_only_udm.intermediary.administrative_domain` UDM field. - event.idm.read_only_udm.target.ip: Newly mapped `requests.requestHost`, `requests.requestIp` raw log field with `event.idm.read_only_udm.target.ip` UDM field. - event.idm.read_only_udm.target.asset.ip: Newly mapped `requests.requestHost`, `requests.requestIp` raw log field with `event.idm.read_only_udm.target.asset.ip` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `apiStatistics.apmNumber`, `responseStatusCode`,`alertInstanceId`, `alertInstanceTime`,`failOverDeveloperApp`,`flowName`,`requestUri`, `responseCode`, `applog`, `activity`, `parameters`, `message_data`, `traceId`, `developerApp`, `authStatus`, `latencyTotal`, `envStatus`, `failover_enabled`, `active_active_enabled`, `reference_id`, `duration`, `requests.requestScheme`, `requests.requestReceivedStartTimestamp`, `requests.requestReceivedEndTimestamp`, `requests.requestSentStartTimestamp`, `requests.requestSentEndTimestamp`, `requests.requestPayload`, `response.responsePayload`, `apiStatistics.organization`, `apiStatistics.environment`, `apiStatistics.flow_name`, `requestHeaders`, `responseHeaders`, `environmentName`, `environment`, `targetVerb`, `clientReceivedStartTimestamp`, `clientReceivedEndTimestamp`, `targetSentStartTimestamp`, `targetSentEndTimestamp`, `targetReceivedStartTimestamp`, `targetReceivedEndTimestamp`, `clientSentStartTimestamp`, `clientSentEndTimestamp`, `responseDesc`, `apikey`, `gatewayAuthId`, `gatewayAuthId2`, `gatewayAuthLevel`, `latencyRequestTotal`, `isErrorCodeCategorized`, `request.header.Timestamp`, `request.header.Message-Signature`, `target_metadata.targetVerb` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.target.resource.attribute.labels: Newly mapped `environmentName`, `environment`, `targetVerb`, `latencyHeader`, `clientReceivedStartTimestamp`, `clientReceivedEndTimestamp`, `targetSentStartTimestamp`, `targetSentEndTimestamp`, `targetReceivedStartTimestamp`, `targetReceivedEndTimestamp`, `clientSentStartTimestamp`, `clientSentEndTimestamp`, `responseDesc`, `apikey`, `gatewayAuthId`, `gatewayAuthId2`, `gatewayAuthLevel`, `latencyRequestTotal`, `latencyTarget`, `latencyProxy`, `isErrorCodeCategorized`, `request.header.Timestamp`, `request.header.Message-Signature`, `target_metadata.targetVerb` raw log field with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. - event.idm.read_only_udm.security_result: Newly mapped `security_result` raw log field with `event.idm.read_only_udm.security_result` UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped `hmac.computed`, `honeyPot`, `honeyPotMerchant` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - event.idm.read_only_udm.security_result.action_details: Newly mapped `statusReason` raw log field with `event.idm.read_only_udm.security_result.action_details` UDM field. - event.idm.read_only_udm.security_result.action: Newly mapped `security_result_action` raw log field with `event.idm.read_only_udm.security_result.action` UDM field. - event.idm.read_only_udm.security_result.category_details: Newly mapped `signature` raw log field with `event.idm.read_only_udm.security_result.category_details` UDM field. - event.idm.read_only_udm.metadata.event_type: If has_principal_user is true, updated to USER_UNCATEGORIZED. - event.idm.read_only_udm.metadata.event_type: If has_principal_ip is true and has_target is true, updated to NETWORK_CONNECTION. - event.idm.read_only_udm.metadata.event_type: If has_principal_ip is true and has_target is false, updated to STATUS_UPDATE. - event.idm.read_only_udm.metadata.event_type: Otherwise, updated to GENERIC_EVENT. - Added gsub function to replace `message` with `message_data` in json_data.