ocsf-schema icon indicating copy to clipboard operation
ocsf-schema copied to clipboard

Potential Redundancy: metadata.loggers vs metadata.logged_time

Open mikeradka opened this issue 10 months ago • 2 comments

A while back, the loggers array was added to the metadata object. The purpose was to account for the different logging 'hops' as a log travels through a data pipeline.

The loggers object is an array of logger object, which contains the logged_time attribute for each hop.

Could metadata.logged_time and metadata.loggers (which contains logged_time) be a redundancy?

image image

The main point of confusion is in the event that there is only one ‘logger’, do you use metadata.logged_time OR just a single-entry array in loggers? To resolve this confusion, should metadata.logged_time be considered for deprecation in lieu of metadata.loggers?

mikeradka avatar Apr 01 '24 20:04 mikeradka