The old parser guardduty-json is deprecated, and replaced by the new parser aws-guardduty. While the old parser will remain available during a tranisition period, all future changes will only go into the new aws-guardduty parser. We recommend switching to the newer parser as soon as possible, to make for the smoothest upgrade. The old guardduty-json parser will be removed at some point in the future. In your data, the field #type contains the name of the parser, so any queries you may have that searches for this field need to accomodate this change.

The old guardduty-json parser would duplicate certain fields, which the new aws-guardduty parser will not. The fields which were previously duplicated, would be present both under the Vendor namespace (e.g. Vendor.srcIp), and as a field mapped to CPS (e.g. source.ip). If the value of two such fields is byte-for-byte the same, the new parser will no longer preserve the vendor-specific field, but only the CPS field. If the value of the two fields differ, both fields will be preserved.