The Normalizer in SuzieQ is responsible for converting raw, multi-vendor device data into a unified format that can be easily analyzed and acted upon. Here’s how the process works, step by step:

1. Vendor Abstraction:
   Takes device-specific data, regardless of vendor (Cisco, Arista, Juniper, etc.), and structures it into a vendor-agnostic schema to enable seamless multi-vendor analysis.
2. Field Standardization:
   Harmonizes field names, data types, and measurement units so data from various sources can be compared consistently.
3. Data Enrichment:
   Adds useful context such as mapping interfaces to logical groups, VRFs, or site-specific tags, allowing users to perform more insightful queries.
4. Error Handling:
   Detects malformed or incomplete data and either corrects minor issues automatically, flags discrepancies for review, or excludes unprocessable entries.
5. Schema Validation:
   Compares the normalized output with the expected schema to ensure all required fields are present and properly conformed before data is delivered for analytics or visualization.

The SuzieQ Normalizer is designed to work across a broad range of network equipment from different vendors. It abstracts platform-specific command outputs and APIs into a consistent and structured view for observability and analytics. Supported devices are grouped by vendor and cover both legacy and modern platforms:

• Cisco:
  Includes NX-OS, IOS-XE, and IOS-XR-based devices. SuzieQ supports both CLI-based data collection and API-based integrations where available.
• Arista:
  Supports EOS platforms using eAPI and CLI. Normalization ensures data can be processed whether gathered via command line or automation-friendly APIs.
• Juniper:
  Works with Junos-based devices using CLI and NETCONF for data collection. SuzieQ normalizes the proprietary Junos hierarchy into flat table formats.
• Cumulus Linux:
  Normalizes Linux-native network configuration and operational states using standard Linux tools and structured outputs from FRR and system daemons.
• SONiC:
  Offers support for open networking platforms running SONiC OS. The normalizer adapts to telemetry and CLI outputs generated by the SAI and environmental services.
• VyOS:
  Supports Linux-based routers leveraging CLI and config file parsing. Useful for labs, cloud deployments, or lightweight virtualized network nodes.

Support for additional platforms can be added by contributing custom normalizer modules or extending device-specific mappings.

The Normalizer organizes and structures collected data into a set of standardized models. Each model represents a specific category of network information — making it easier to search, correlate, and analyze across vendors and topologies.

• Interfaces:
  Captures operational and administrative state of physical and virtual interfaces, including metrics such as speed, MTU, MAC address, and counters like input/output bytes and packet errors.
• Device Facts:
  Represents fundamental attributes of devices, such as hostname, model, OS version, serial number, and uptime. This helps baseline network inventory and device health tracking.
• Routing Data:
  Normalizes routing entries including prefixes, next-hops, protocols (OSPF, BGP, static), metrics, and route selection flags like best or rejected.
• BGP/OSPF Neighbors:
  Documents peer relationships, ASN, peer IP, session state, flap count, and uptime. Useful for tracking neighbor stability and network convergence.
• ARP/ND Entries:
  Resolves IP to MAC mappings, showing dynamic and static entries with associated interface and age. Helpful for validation of host reachability and security.
• Services and Daemons:
  Tracks status of routing and network services such as BGP, LLDP, NTP, or SNMP across platforms to ensure operational consistency.

Each model enables targeted queries and visualizations over time, empowering engineers to correlate changes across layers, from physical ports to routing updates.

The Normalizer in SuzieQ can be customized and extended to support additional platforms, data formats, or vendor-specific quirks. This makes it flexible for diverse environments and evolving infrastructure. Here’s how customization and extension works step by step:

1. Create a Custom Normalizer Module:
   Build a Python module that defines how raw data from a new platform should be structured. This module translates vendor-specific output into the normalized SuzieQ schema.
2. Define Parsing Logic:
   Use standard parsing techniques to extract fields from CLI, JSON, YAML, or API responses. This ensures structured data can be transformed regardless of its original format.
3. Map Fields to Schema:
   Align vendor-specific field names to existing attributes in SuzieQ models. This enables support for new platforms without modifying downstream query or visualization logic.
4. Test with Device Output:
   Use saved or live output from the device to test your custom normalizer. Validate correctness using SuzieQ’s built-in testing utilities to ensure consistent results.
5. Enable and Register the Module:
   Update configuration files to register your new module. Once integrated, SuzieQ will automatically apply your normalizer when polling matching devices.

Customization makes SuzieQ adaptable to proprietary hardware, new operating systems, and edge networking gear not officially supported out of the box.

When working with the SuzieQ Normalizer, it’s important to follow structured troubleshooting methods and apply best practices that ensure normalization is accurate, performant, and scalable across diverse environments. Here’s how to approach it:

1. Enable Verbose Logging:
   Increase the logging level to capture detailed output during normalization. This helps trace which value or field caused a failure or produced unexpected results.
2. Isolate the Problem:
   Run normalization on a small subset of collected data or use a single device. This reduces complexity when debugging parsing errors or missing fields.
3. Compare with Raw Output:
   Validate the normalized data against the original CLI or API output from the device. Ensure that expected values are being parsed correctly and mapped to the right attributes.
4. Use Schema Validation Tools:
   Leverage SuzieQ’s built-in tools to check that all required fields are present and formatted correctly before data is accepted into the database.
5. Optimize for Performance:
   Minimize excessive parsing logic or deep transformations that could slow down large-scale normalization. Cache lookups when possible and avoid repeated parsing of the same data fragments.

Following these guidelines keeps your observability workflow stable and helps ensure that normalized data remains trustworthy as your network scales or as vendors update device responses.