Even I have same problem like we get security logs from different applications on monthly basis. The applications are customer specific so they don’t have proper logging mechanism. Sometimes we had to get them from debug logs where each event would further split into many events. what I do is I onboard all the logs required for security monitoring, identify the required event types by just simulating few scenarios where high risk is involved and apply props|transforms, the rest of events which are not matching with my event types will be discarded. I know this is not a solution for your question. Kind of feedback you can consider. There is no such option to automate props and transforms on unknown data/events. we can can automate field-aliases if the event is in key-value fair, not tagging of events. tagging of events is most important to make use of DATA MODELS.
... View more
