When JSON logs from a third-party system have missing fields, what should you do to parse them quickly into UDM?

• A. Configure auto extraction to add additional fields.
• B. Create parser extensions using the no-code approach.
• C. Create parser extensions using the code snippet approach.
• D. Submit a parser improvement request to Cloud Customer Care.

Answer: (B)

Handling JSON logs with missing fields is fastest when you use a parser extension built with the no-code approach. This lets you visually define how to extract each field from the JSON and map it into the Unified Data Model, without writing any code. You can specify the JSON paths for fields, set default values or nulls for absent fields, and quickly test and deploy the rules. This approach is ideal for third-party logs because you can adapt to variations on the fly and still keep the data dimensionalized in UDM.

Auto extraction might help in some scenarios, but it often won’t reliably capture fields that aren’t consistently present and may require extra tweaking. Writing a code snippet parser extension works, but it takes more time and technical effort, slowing down a quick ingestion setup. Submitting a parser improvement request is a slower, external route that won’t address the immediate need to parse and ingest the data.

So, for rapid parsing of third-party JSON logs with missing fields into UDM, the no-code parser extension is the best fit.