Skip to content

Commit a1c1c84

Browse files
committed
Added more output messages to the list
1 parent e90f113 commit a1c1c84

File tree

1 file changed

+6
-3
lines changed

1 file changed

+6
-3
lines changed

articles/sentinel/normalization-develop-parsers.md

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -242,13 +242,16 @@ Handle the results as follows:
242242
| Message | Action |
243243
| ------- | ------ |
244244
| **(0) Error: Missing mandatory field [\<Field\>]** | Add this field to your parser. In many cases, this would be a derived value or a constant value, and not a field already available from the source. |
245-
| **(0) Error: Missing mandatory alias [\<Field\>] aliasing column [\<Field\>]** | Add this alias to your parser. |
245+
| **(0) Error: Missing mandatory alias [\<Field\>] aliasing existing column [\<Field\>]** | Add this alias to your parser. |
246+
| **(0) Error: Missing mandatory alias [\<Field\>] aliasing missing column [\<Field\>]** | This error accompanies a similar error on | **(0) Error: Missing recommended alias [\<Field\>] aliasing existing column [\<Field\>]** | Add this alias to your parser. |
247+
the aliased field. Correct the aliased field error and add this alias to your parser. |
248+
| **(0) Error: Missing optional alias [\<Field\>] aliasing existing column [\<Field\>]** | Add this alias to your parser. |
246249
| **(0) Error: type mismatch for field [\<Field\>]. It is currently [\<Type\>] and should be [\<Type\>]** | Make sure that the type of normalized field is correct, usually by using a [conversion function](/azure/data-explorer/kusto/query/scalarfunctions#conversion-functions) such as `tostring`. |
247250
| **(1) Warning: Missing recommended field [\<Field\>]** | Consider adding this field to your parser. |
248-
| **(1) Warning: Missing recommended alias [\<Field\>] aliasing column [\<Field\>]** | Add this alias to your parser if the aliased field is available in the parser. |
251+
| **(1) Warning: Missing recommended alias [\<Field\>] aliasing non-existent column [\<Field\>]** | If you add the aliased field to the parser, make sure to add this alias as well. |
252+
| **(1) Warning: Missing optional alias [\<Field\>] aliasing non-existent column [\<Field\>]** | If you add the aliased field to the parser, make sure to add this alias as well. |
249253
| **(2) Info: Missing optional field [\<Field\>]** | While optional fields are often missing, it is worth reviewing the list to determine if any of the optional fields can be mapped from the source. |
250254
| **(2) Info: extra unnormalized field [\<Field\>]** | While unnormalized fields are valid, it is worth reviewing the list to determine if any of the unnormalized values can be mapped to an optional field. |
251-
| **(2) Info: Missing optional alias [\<Field\>] aliasing column [\<Field\>]** | Add this alias to your parser if the aliased field is available in the parser. |
252255
|||
253256

254257
> [!NOTE]

0 commit comments

Comments
 (0)