CSV Custom IOC Parser

[mokatsu]

I am trying to pull data by using the CSV Custom IOC feed from a GCP storage bucket. Looking at the Parser I structured the csv that is saved within the GCP storage based on the parser but When logs are ingested they are still coming in as "unparsed".

1. Has anyone had any luck with that parser/feed?
2. Does each column need to be filled (no empty values)?

Any tips or guidance would be appreciated.

[DanHansen]

You very likely do have to be as specific as possible with filling out the fields since this feature seems relatively unpolished. There should be an error resource on your incoming logs that looks something like this. 

{
  "reason": string,
  "location": string,
  "debugInfo": string,
  "message": string
}