ocsf-schema
ocsf-schema copied to clipboard
Potential Redundancy: metadata.loggers vs metadata.logged_time
A while back, the loggers
array was added to the metadata
object. The purpose was to account for the different logging 'hops' as a log travels through a data pipeline.
The loggers
object is an array of logger
object, which contains the logged_time
attribute for each hop.
Could metadata.logged_time
and metadata.loggers
(which contains logged_time
) be a redundancy?
The main point of confusion is in the event that there is only one ‘logger’, do you use metadata.logged_time
OR just a single-entry array in loggers? To resolve this confusion, should metadata.logged_time
be considered for deprecation in lieu of metadata.loggers
?