Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Important
Lakewatch is in Private Preview. To request access, reach out to your Azure Databricks account team.
Lakewatch schematizes ingested data with parsers: versioned YAML documents that describe the output columns of a log source. Lakewatch provides built-in parsers for common security sources. When you ingest a source that no built-in parser covers, or you want to tailor the columns, validators, or observables a parser produces, author a custom parser.
Custom and built-in parsers use the same YAML format and attach to datasources the same way. You can browse all parsers (built-in and custom) on the dedicated Parsers page in the Lakewatch navigation.
In this section
| Topic | Description |
|---|---|
| Create a custom parser | Write, save, attach, and test a custom parser for a source no built-in parser covers |
| Parser reference | The YAML parser format: field attributes, types, validators, observables, and classification |