Function parse_field_spec 

pub fn parse_field_spec(key: &str) -> Result<FieldSpec>

Parse a field specification string like "TargetObject|endswith".

Reference: pySigma rule/detection.py — field, *modifier_ids = key.split("|")