Why does Google SecOps use a schema-on-write approach for UDM normalization?

Normalizing every log into UDM at ingestion time, rather than leaving raw, differently-structured logs to be parsed and reconciled at query time, is what lets Google SecOps deliver consistently fast search and detection performance even across enormous, heterogeneous log volumes.

If normalization instead happened at query time (schema-on-read), every search or detection rule execution would need to repeat the work of interpreting each log source's specific format on the fly, which becomes increasingly expensive as data volume and source diversity grow; doing that work once, upfront, at ingestion means the cost is paid a single time per log rather than repeatedly for every query that happens to touch it.

It also enables consistency: a detection rule referencing target.ip behaves identically regardless of whether the underlying event came from a firewall, a cloud VPC flow log, or an endpoint agent, since all three were already normalized into the same UDM field during ingestion — a guarantee that's much harder to make reliably under a schema-on-read model where interpretation logic might subtly differ depending on exactly how a given query happens to be written.