Custom logs

Preview

Lakewatch is in Private Preview. To request access, reach out to your Databricks account team.

Lakewatch schematizes ingested data with parsers: versioned YAML documents that describe the output columns of a log source. Lakewatch provides built-in parsers for common security sources. When you ingest a source that no built-in parser covers, or you want to tailor the columns, validators, or observables a parser produces, author a custom parser.

Custom and built-in parsers use the same YAML format and attach to datasources the same way. You can browse all parsers (built-in and custom) on the dedicated Parsers page in the Lakewatch navigation.

In this section

• • Create a custom parser
  • Write, save, attach, and test a custom parser for a source no built-in parser covers
• • Parser reference
  • The YAML parser format: field attributes, types, validators, observables, and classification