We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for WORKSPACE_USERS

Date	Changes
2025-08-27	- additional.fields: Newly mapped all key-value pairs from the `customSchemas` object in the raw log to the `additional.fields` UDM field.
2025-07-16	Updated the parser to correctly handle edge cases for the addresses.formatted raw field.
2024-03-27	Removed the mapping of the extracted user ID from the `primaryEmail` raw log field to the `entity.user.userid` UDM field.
2023-11-29	Added additional mappings for deprecated labels.
2023-09-06	Modified logic for relations object to handle missing field `value`.
2023-07-26	Updated mapping of `lastLoginTime` field from `entity.user.attribute.labels` to `entity.user.last_login_time`.
2023-04-12	Promoted `WORKSPACE_USERS` parser to default. For the field mapping reference, see https://cloud.google.com/chronicle/docs/ingestion/default-parsers/collect-workspace-logs#field-mapping>Collect Google Workspace logs.