Add Excel .xlsx / ODS spreadsheet parser

crates/ax-normalize/Cargo.toml

@@ -51,12 +51,20 @@ evtx = { version = "0.11", optional = true }
 # feature, so the text-only build stays lean.
 pcap-parser = { version = "0.17", optional = true }
 etherparse = { version = "0.20", optional = true }
+# Excel (.xlsx/.xls/.xlsb) and OpenDocument (.ods) spreadsheets. calamine reads
+# all of them (pure Rust) and we lower the first sheet to a RecordSet. Behind the
+# default-on `xlsx` feature (binary format), so the text-only build stays lean.
+calamine = { version = "0.35", optional = true }
 
 [features]
-default = ["polars", "evtx", "pcap"]
+default = ["polars", "evtx", "pcap", "xlsx"]
 polars = ["dep:polars"]
 evtx = ["dep:evtx"]
 pcap = ["dep:pcap-parser", "dep:etherparse"]
+xlsx = ["dep:calamine"]
 
 [dev-dependencies]
 proptest = { workspace = true }
+# Writes a tiny .xlsx in-memory for the xlsx parser's roundtrip test (no
+# committed binary fixture).
+rust_xlsxwriter = "0.95"

crates/ax-normalize/src/parser.rs

@@ -218,6 +218,8 @@ mod tests {
         expected.push("evtx");
         #[cfg(feature = "pcap")]
         expected.push("pcap");
+        #[cfg(feature = "xlsx")]
+        expected.push("xlsx");
         expected.extend([
             "otlp",
             "cloudtrail",

crates/ax-normalize/src/parsers/mod.rs

@@ -26,6 +26,8 @@ pub mod prometheus;
 pub mod syslog;
 pub mod toml;
 pub mod vpcflow;
+#[cfg(feature = "xlsx")]
+pub mod xlsx;
 pub mod xml;
 pub mod yaml;
 pub mod zeek;
@@ -55,6 +57,8 @@ pub use prometheus::PrometheusParser;
 pub use syslog::SyslogParser;
 pub use toml::{IniParser, TomlParser};
 pub use vpcflow::VpcFlowParser;
+#[cfg(feature = "xlsx")]
+pub use xlsx::XlsxParser;
 pub use xml::XmlParser;
 pub use yaml::YamlParser;
 pub use zeek::ZeekParser;
@@ -74,6 +78,8 @@ pub fn default_registry() -> ParserRegistry {
     r.register(Box::new(EvtxParser));
     #[cfg(feature = "pcap")]
     r.register(Box::new(PcapParser));
+    #[cfg(feature = "xlsx")]
+    r.register(Box::new(XlsxParser));
     // OTLP before NDJSON: a compact single-object OTLP doc must win the
     // `resourceSpans` signature before any JSON-line heuristic sees it.
     r.register(Box::new(OtlpParser));