The SAP_CHANGE_DOCUMENT
parser tracks changes made to business objects in SAP systems, including creations, modifications, and deletions of data.
For information about Google SecOps for SAP, see Secure SAP applications with Google SecOps .
Field mapping reference
The following table describes the mapping between SAP Change Document log fields and Google SecOps UDM fields.
| Log field | UDM mapping | Logic |
|---|---|---|
UDATE
|
event.idm.read_only_udm.metadata.event_timestamp
|
Date of the change event; combined with UTIME. |
UTIME
|
event.idm.read_only_udm.metadata.event_timestamp
|
Time of the change event; combined with UDATE. |
MANDANT
|
event.idm.read_only_udm.target.resource.attribute.labels["MANDANT"]
|
SAP Client (Tenant) identifier. |
OBJECTCLAS
|
event.idm.read_only_udm.target.resource.name
|
The SAP object class (e.g., EINKBELEG for purchasing documents). |
OBJECTID
|
event.idm.read_only_udm.target.resource.product_object_id
|
The specific identifier of the SAP object. |
CHANGENR
|
event.idm.read_only_udm.metadata.product_log_id
|
Unique SAP change document number. |
USERNAME
|
event.idm.read_only_udm.principal.user.userid
|
The ID of the user who performed the change. |
TCODE
|
event.idm.read_only_udm.target.application
|
SAP Transaction Code used to initiate the change. |
CHANGE_IND
|
event.idm.read_only_udm.target.resource.attribute.labels["CHANGE_IND"]
|
Indicator for the overall change type (U=Update, I=Insert, D=Delete). |
CHANGE_IND (applied)
|
event.idm.read_only_udm.metadata.event_type
|
Used to derive the UDM event type based on user/resource involvement. |
LANGU
|
event.idm.read_only_udm.target.resource.attribute.labels["LANGU"]
|
SAP Language key. |
VERSION
|
event.idm.read_only_udm.metadata.product_version
|
Change document version number. |
_DATAAGING
|
event.idm.read_only_udm.additional.fields["_DATAAGING"]
|
Raw data aging information. |
CDPOS_ITEMS
|
event.idm.read_only_udm.additional.fields["key_index"]
|
Array of position items; each key-value pair is mapped with its index. |
TABNAME
|
event.idm.read_only_udm.target.resource.attribute.labels["TABNAME"]
|
Name of the specific SAP table being changed. |
TABKEY
|
event.idm.read_only_udm.target.resource.attribute.labels["TABKEY"]
|
The specific key/row ID within the target table. |
FNAME
|
event.idm.read_only_udm.additional.fields["FNAME"]
|
Name of the specific field that was modified. |
CHNGIND
|
event.idm.read_only_udm.target.resource.attribute.labels["CHNGIND"]
|
Field-level change indicator. |
VALUE_OLD
|
event.idm.read_only_udm.additional.fields["VALUE_OLD"]
|
Previous value of the field before the change. |
VALUE_NEW
|
event.idm.read_only_udm.additional.fields["VALUE_NEW"]
|
New value of the field after the change. |
UNIT_OLD
|
event.idm.read_only_udm.additional.fields["UNIT_OLD"]
|
Previous unit of measure. |
UNIT_NEW
|
event.idm.read_only_udm.additional.fields["UNIT_NEW"]
|
New unit of measure. |
CUKY_OLD
|
event.idm.read_only_udm.additional.fields["CUKY_OLD"]
|
Previous currency key. |
CUKY_NEW
|
event.idm.read_only_udm.additional.fields["CUKY_NEW"]
|
New currency key. |
TEXT_CASE
|
event.idm.read_only_udm.target.resource.attribute.labels["TEXT_CASE"]
|
Indicates if the change is related to a text object. |
WAS_PLANND
|
event.idm.read_only_udm.target.resource.attribute.labels["WAS_PLANND"]
|
Flag indicating if the change was previously planned. |
ACT_CHNGNO
|
event.idm.read_only_udm.additional.fields["ACT_CHNGNO"]
|
Activation change number. |
PLANCHNGNR
|
event.idm.read_only_udm.additional.fields["PLANCHNGNR"]
|
Planned change number. |
CDHDR_DATAAGING
|
event.idm.read_only_udm.additional.fields["CDHDR_DATAAGING"]
|
Data aging timestamp for the header record. |
CDPOS_DATAAGING
|
event.idm.read_only_udm.additional.fields["CDPOS_DATAAGING"]
|
Data aging timestamp for the position record. |
