Change log for POSTGRESQL

Date	Changes
2025-09-19	Enhancement: - Added a grok pattern to parse the `resourceId` field to extract cloud project and resource information. - `event.idm.read_only_udm.target.resource.name`: Newly mapped `properties.DatabaseName` raw log field to `event.idm.read_only_udm.target.resource.name` UDM field. - `event.idm.read_only_udm.target.resource.attribute.labels`: Newly mapped `properties.Schemaname`, `resourcegroups` (extracted from resourceId), `providers` (extracted from resourceId), `flexibleservers` (extracted from resourceId), `subscriptions` (extracted from resourceId) raw log fields to `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `properties.Tables_counter`, `properties.Tables_vacuumed`, `properties.N_live_tup`, `properties.Tables_autovacuumed`, `properties.Tables_analyzed`, `properties.Tables_autoanalyzed`, `properties.N_dead_tup`, `properties.Seq_scan`, `properties.Seq_tup_read`, `properties.Idx_scan`, `properties.Idx_tup_fetch`, `properties.N_tup_ins`, `properties.N_tup_upd`, `properties.N_tup_del`, `properties.N_tup_hot_upd`, `properties.N_mod_since_analyze`, `properties.Vacuum_count`, `properties.Autovacuum_count`, `properties.Analyze_count`, `properties.Autoanalyze_count`, `loggingSourceName` raw log fields to `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.metadata.event_timestamp`: Newly mapped `time` raw log field to `event.idm.read_only_udm.metadata.event_timestamp` UDM field when the `Timestamp` field is not available.
2025-06-05	Enhancement: - Added gsub to to modify `message` in the raw log to `msg`. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped `backend_type` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - event.idm.read_only_udm.principal.port: Newly mapped `remote_port` raw log field with `event.idm.read_only_udm.principal.port` UDM field. - event.idm.read_only_udm.principal.ip, event.idm.read_only_udm.principal.asset.ip: Newly mapped `remote_host` raw log field with `event.idm.read_only_udm.principal.ip`, `event.idm.read_only_udm.principal.asset.ip` UDM fields when `remote_host` is a valid IP. - event.idm.read_only_udm.principal.hostname, event.idm.read_only_udm.principal.asset.hostname: Newly mapped `remote_host` raw log field with `event.idm.read_only_udm.principal.hostname`, `event.idm.read_only_udm.principal.asset.hostname` UDM fields when `remote_host` is not a valid IP. - event.idm.read_only_udm.security_result.description: Newly mapped `msg` raw log field with `event.idm.read_only_udm.security_result.description` UDM field. - event.idm.read_only_udm.target.application: Newly mapped `application_name` raw log field with `event.idm.read_only_udm.target.application` UDM field. - event.idm.read_only_udm.security_result.severity_details: Newly mapped `error_severity` raw log field with `event.idm.read_only_udm.security_result.severity_details` UDM field. - event.idm.read_only_udm.target.resource.parent: Newly mapped `dbname` raw log field with `event.idm.read_only_udm.target.resource.parent` UDM field. - event.idm.read_only_udm.principal.ip, event.idm.read_only_udm.principal.asset.ip: Newly mapped `detail_ip` raw log field with `event.idm.read_only_udm.principal.ip`, `event.idm.read_only_udm.principal.asset.ip` UDM fields. - event.idm.read_only_udm.principal.process.pid: Newly mapped `pid` raw log field with `event.idm.read_only_udm.principal.process.pid` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `query_id`, `txid`, `vxid`, `state_code`, `detail` and `line_num` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped `timeStamp` raw log field with `event.idm.read_only_udm.metadata.event_timestamp` UDM field. - event.idm.read_only_udm.metadata.event_type: Set `event.idm.read_only_udm.metadata.event_type` to `USER_LOGIN` when `ps` is `authentication` or `message` contains `LOGON`. - event.idm.read_only_udm.metadata.event_type: Set `event.idm.read_only_udm.metadata.event_type` to `USER_RESOURCE_CREATION` when `msg` contains `CREATE USER`, `CREATE TABLE`, `CREATE DATABASE` or `CREATE OBJECT`, `has_target_resource`, `has_principal` and `has_user` are true. - event.idm.read_only_udm.metadata.event_type: Set `event.idm.read_only_udm.metadata.event_type` to `USER_RESOURCE_DELETION` when `msg` contains `Delete` or `Drop`, `has_target_resource`, `has_principal` and `has_user` are true. - event.idm.read_only_udm.metadata.event_type: Set `event.idm.read_only_udm.metadata.event_type` to `USER_RESOURCE_UPDATE_PERMISSIONS` when `msg` contains `Grant`, `has_target_resource`, `has_principal` and `has_user` are true. - event.idm.read_only_udm.metadata.event_type: Set `event.idm.read_only_udm.metadata.event_type` to `USER_RESOURCE_UPDATE_CONTENT` when `msg` contains `Alter`, `has_target_resource`, `has_principal` and `has_user` are true.
2024-08-07	- Newly created parser