Change log for AWS_REDSHIFT

Date	Changes
2025-04-16	- csv_data: Added support for csv format. -event.idm.read_only_udm.metadata.product_event_type: Newly mapped column1 raw field to event.idm.read_only_udm.metadata.product_event_type UDM field. -event.idm.read_only_udm.metadata.timestamp: Newly mapped column2 raw field to event.idm.read_only_udm.metadata.timestamp UDM field. -event.idm.read_only_udm.principal.ip: Newly mapped column3 raw field to event.idm.read_only_udm.principal.ip UDM field if valid IP. -event.idm.read_only_udm.principal.asset.ip: Newly mapped column3 raw field to event.idm.read_only_udm.principal.asset.ip UDM field if valid IP. -event.idm.read_only_udm.principal.principal.hostname: Newly mapped column3 raw field to event.idm.read_only_udm.principal.hostname UDM field if not valid IP. -event.idm.read_only_udm.principal.port: Newly mapped column4 raw field to event.idm.read_only_udm.principal.port UDM field if valid HOSTPORT. -event.idm.read_only_udm.principal.process.pid: Newly mapped column5 raw field to event.idm.read_only_udm.principal.process.pid UDM field. -event.idm.read_only_udm.target.resource.name: Newly mapped column6 raw field to event.idm.read_only_udm.target.resource.name UDM field. - Updated has_target_resource to true if column6 is not empty. -event.idm.read_only_udm.target.resource.type: Newly mapped event.idm.read_only_udm.target.resource.type UDM field to DATABASE. -event.idm.read_only_udm.target.user.user_display_name: Newly mapped column7 raw field to event.idm.read_only_udm.target.user.user_display_name UDM field. -event.idm.read_only_udm.security_result.detection_fields: Newly mapped column8 raw field to event.idm.read_only_udm.security_result.detection_fields UDM field. -event.idm.read_only_udm.network.session_duration.seconds: Newly mapped column9 raw field to event.idm.read_only_udm.network.session_duration.seconds UDM field. -event.idm.read_only_udm.network.tls.version: Newly mapped column10 raw field to event.idm.read_only_udm.network.tls.version UDM field. -event.idm.read_only_udm.network.tls.cipher: Newly mapped column11 raw field to event.idm.read_only_udm.network.tls.cipher UDM field. -event.idm.read_only_udm.security_result.detection_fields: Newly mapped column12 raw field to event.idm.read_only_udm.security_result.detection_fields UDM field. -event.idm.read_only_udm.security_result.detection_fields: Newly mapped column13 raw field to event.idm.read_only_udm.security_result.detection_fields UDM field. -event.idm.read_only_udm.security_result.detection_fields: Newly mapped column14 raw field to event.idm.read_only_udm.security_result.detection_fields UDM field. -event.idm.read_only_udm.security_result.detection_fields: Newly mapped column15 raw field to event.idm.read_only_udm.security_result.detection_fields UDM field. -event.idm.read_only_udm.principal.application: Newly mapped column16 raw field to event.idm.read_only_udm.principal.application UDM field. -event.idm.read_only_udm.principal.platform_version: Newly mapped column17 raw field to event.idm.read_only_udm.principal.platform_version UDM field. -event.idm.read_only_udm.security_result.detection_fields: Newly mapped column18 raw field to event.idm.read_only_udm.security_result.detection_fields UDM field. -event.idm.read_only_udm.security_result.detection_fields: Newly mapped column19 raw field to event.idm.read_only_udm.security_result.detection_fields UDM field. -event.idm.read_only_udm.network.application_protocol_version: Newly mapped column20 raw field to event.idm.read_only_udm.network.application_protocol_version UDM field. -event.idm.read_only_udm.network.session_id: Newly mapped column21 raw field to event.idm.read_only_udm.network.session_id UDM field. -event.idm.read_only_udm.security_result.detection_fields: Newly mapped column22 raw field to event.idm.read_only_udm.security_result.detection_fields UDM field.
2025-03-06	-event.idm.read_only_udm.principal.process.pid: Newly mapped pid to event.idm.read_only_udm.principal.process.pid UDM field. -event.idm.read_only_udm.target.resource.attribute.labels: Newly mapped time_zone to event.idm.read_only_udm.target.resource.attribute.labels UDM field. -event.idm.read_only_udm.target.resource.attribute.labels: Newly mapped sql_query to event.idm.read_only_udm.target.resource.attribute.labels UDM field. -event.idm.read_only_udm.target.resource.name: Newly mapped db to event.idm.read_only_udm.target.resource.name UDM field. -event.idm.read_only_udm.target.resource.type: Newly mapped db to event.idm.read_only_udm.target.resource.type UDM field. -event.idm.read_only_udm.target.user.user_display_name: Newly mapped user to event.idm.read_only_udm.target.user.user_display_name UDM field. -event.idm.read_only_udm.principal.user.userid: Newly mapped user_id to event.idm.read_only_udm.principal.user.userid UDM field. -event.idm.read_only_udm.network.session_id: Newly mapped xid to event.idm.read_only_udm.network.session_id UDM field. -event.idm.read_only_udm.metadata.event_type: Newly mapped metadata.event_type UDM field to USER_RESOURCE_ACCESS if has_target_resource and has_user is true. -event.idm.read_only_udm.metadata.event_type: Newly mapped metadata.event_type UDM field to STATUS_UPDATE if has_principal is true. -event.idm.read_only_udm.metadata.event_type: Newly mapped metadata.event_type UDM field to USER_UNCATEGORIZED if has_user is true. -event.idm.read_only_udm.metadata.event_type: Newly mapped metadata.event_type UDM field to GENERIC_EVENT if none of the above conditions are true. -Modified the message field by replacing all occurrences of \\ with $ -Modified the message field by replacing all occurrences of # with , -Added support for parsing a JSON array within the message field. -Added a grok pattern to parse the record field. -Added a kv filter to parse key-value pairs from the kv_data field.
2025-02-06	Newly created parser.