SIEM pipeline is healthy but one event class disappears

A forwarder still ships logs, but investigation data is missing because a parser drops one event type after a field change.