Log normalization is a process where log data from various sources are standardized into a common format, which is crucial for effective correlation and analysis. This feature is key when the aim is to correlate events across different device logs. A sensor, in this context, refers to a component that detects events on the network, not specifically to log collection or normalization. Data de-duplication is a storage-saving technique that doesn't contribute to log normalization or correlation. Geolocation may be used for adding location context to logs but isn't related to normalization. Log forwarding is a basic functionality of log collectors to send logs to another destination but does not guarantee normalization.