Github user mmiklavc commented on the issue: https://github.com/apache/metron/pull/863 It seems this PR is meant to address the global case, since the writer is general purpose. Per @cestella's comments, I don't know that we can include original_string. I do think there's value in minimally ensuring the timestamp and source.type fields are validated in the near term. It seems that addressing a broader validation strategy might be in order, but maybe we could handle that separately as a compromise? Thoughts @ottobackwards?