Not only is there no documentation, there's often inconsistency in how these fields are used.
For example, user.dst is normally the user on which the action is performed (account logged into, account manipulated), but it's also used for the user initiating an action by the bluecoat parser. Similarly firewall parsers often populate ip.srcport and ip.dstport but the network packet parsers populate udp.dstport/tcp.dstport or the srcport equivalents. Similarly there's no resolution from name to IP so you're stuck with whatever happened to be in the logs with little or no enrichment.
The other thing that's missing is clear documentation of the log taxonomy model.
After 18 months with SA, and a couple of years with EnVision beforethat, I generally have a pretty good idea of what goes where, but the inconsistencies in the standard parsing drive my users crazy.
If you've dug down to the level of writing your own parsers, then it's worth spending some time looking at table-map.xml and index-concentrator.xml. We've made extensive modifications to these (via the -custom.xml) files to ensure the right metadata is stored and indexed in the way we need it. I'm not sure many organisations could justify the amount of time we've spent on it, though.
