Central log pipeline is green but one parser update silently drops a whole class of security events

Collection is alive and dashboards look healthy, yet one format change causes a parser to reject or discard a subset of events without obvious pipeline failure.