Rules (XQL)
[INGEST:vendor="Google", product="Workspace Chrome", target_dataset="google_workspace_chrome_raw", no_hit=keep]
call GOOGLE_WORKSPACE_CHROME_PARSING_RULE;
[INGEST:vendor="Google", product="Workspace_Chrome", target_dataset="google_workspace_chrome_raw", no_hit=keep]
call GOOGLE_WORKSPACE_CHROME_PARSING_RULE;
[RULE: GOOGLE_WORKSPACE_CHROME_PARSING_RULE]
alter
// Getting the JSON from either event OR events.
tmp_get_events_json = if(events = null, null, to_string(events) !~= "^\[", to_string(events) -> parameters[]),
tmp_get_events_jsonarray = if(events = null, null, to_string(events) ~= "^\[", arrayindex(to_string(events) -> [], 0) -> parameters[])
| alter
tmp_get_field = coalesce(tmp_get_events_json, tmp_get_events_jsonarray)
| alter
// Get all of the keys and values.
// Get all of the object names to a regex format.
tmp_get_keys = rtrim(arraystring(arraymap(tmp_get_field, concat("(?P<", lowercase("@element" -> name), ">[^|]+)?\|")), ""), "\|"),
// Get all of the object values to a String format.
tmp_get_values = arraystring(arraymap(tmp_get_field, if("@element" ~= "intValue", "@element" -> intValue, "@element" ~= "value", "@element" -> value, "")), "|")
| alter
// Only work in Parsing Rules, use the regexcapture function to display the data in an organized JSON format.
parameters = if(event =null, to_string(regexcapture(tmp_get_values, tmp_get_keys)), event)
// -------------- TIME --------------
| alter
tmp_get_timestamp_afterdot = arrayindex(regextract(coalesce(parameters -> timestamp, parameters -> time), "\.(\d+)"), 0),
tmp_get_timestamp_clean = replace(coalesce(parameters -> timestamp, parameters -> time), ".", "")
| alter
tmp_check_afterdot = if(tmp_get_timestamp_afterdot = null, "", tmp_get_timestamp_afterdot ~= "^\d$", "00", tmp_get_timestamp_afterdot ~= "^\d{2}$", "0", tmp_get_timestamp_afterdot ~= "^\d{3}$", "")
| alter
tmp_updated_timestamp_format = to_integer(concat(tmp_get_timestamp_clean, tmp_check_afterdot)),
tmp_updated_timestamp_len = len(concat(tmp_get_timestamp_clean, tmp_check_afterdot))
// convert epoch representation to a datetime type timestamp
// in_case of nanoseconds, we convert them to microseconds since to_timestamp does not support nanoseconds
| alter _time = if(
tmp_updated_timestamp_len = 10, to_timestamp(tmp_updated_timestamp_format, "SECONDS"),
tmp_updated_timestamp_len = 13, to_timestamp(tmp_updated_timestamp_format, "MILLIS"),
tmp_updated_timestamp_len = 16, to_timestamp(tmp_updated_timestamp_format, "MICROS"),
tmp_updated_timestamp_len = 19, to_timestamp(to_integer(divide(tmp_updated_timestamp_format, 1000)), "MICROS"));