@@ -25145,6 +25145,7 @@ components:
25145
25145
- $ref: '#/components/schemas/ObservabilityPipelineSentinelOneDestination'
25146
25146
- $ref: '#/components/schemas/ObservabilityPipelineOpenSearchDestination'
25147
25147
- $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestination'
25148
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketDestination'
25148
25149
ObservabilityPipelineConfigProcessorItem:
25149
25150
description: A processor for the pipeline.
25150
25151
oneOf:
@@ -25164,6 +25165,7 @@ components:
25164
25165
- $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableProcessor'
25165
25166
- $ref: '#/components/schemas/ObservabilityPipelineReduceProcessor'
25166
25167
- $ref: '#/components/schemas/ObservabilityPipelineThrottleProcessor'
25168
+ - $ref: '#/components/schemas/ObservabilityPipelineRemapVrlProcessor'
25167
25169
ObservabilityPipelineConfigSourceItem:
25168
25170
description: A data source for the pipeline.
25169
25171
oneOf:
@@ -25182,6 +25184,7 @@ components:
25182
25184
- $ref: '#/components/schemas/ObservabilityPipelineGooglePubSubSource'
25183
25185
- $ref: '#/components/schemas/ObservabilityPipelineHttpClientSource'
25184
25186
- $ref: '#/components/schemas/ObservabilityPipelineLogstashSource'
25187
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSource'
25185
25188
ObservabilityPipelineData:
25186
25189
description: "Contains the pipeline\u2019s ID, type, and configuration attributes."
25187
25190
properties:
@@ -26827,6 +26830,88 @@ components:
26827
26830
type: string
26828
26831
x-enum-varnames:
26829
26832
- REDUCE
26833
+ ObservabilityPipelineRemapVrlProcessor:
26834
+ description: The `custom_processor` processor transforms events using [Vector
26835
+ Remap Language (VRL)](https://vector.dev/docs/reference/vrl/) scripts with
26836
+ advanced filtering capabilities.
26837
+ properties:
26838
+ id:
26839
+ description: The unique identifier for this processor.
26840
+ example: remap-vrl-processor
26841
+ type: string
26842
+ include:
26843
+ description: A Datadog search query used to determine which logs this processor
26844
+ targets. This field should always be set to `*` for the custom_processor
26845
+ processor.
26846
+ example: '*'
26847
+ type: string
26848
+ inputs:
26849
+ description: A list of component IDs whose output is used as the input for
26850
+ this processor.
26851
+ example:
26852
+ - datadog-agent-source
26853
+ items:
26854
+ type: string
26855
+ type: array
26856
+ remaps:
26857
+ description: Array of VRL remap rules.
26858
+ items:
26859
+ $ref: '#/components/schemas/ObservabilityPipelineRemapVrlProcessorRemap'
26860
+ maxItems: 15
26861
+ minItems: 1
26862
+ type: array
26863
+ type:
26864
+ $ref: '#/components/schemas/ObservabilityPipelineRemapVrlProcessorType'
26865
+ required:
26866
+ - id
26867
+ - type
26868
+ - include
26869
+ - remaps
26870
+ - inputs
26871
+ type: object
26872
+ ObservabilityPipelineRemapVrlProcessorRemap:
26873
+ description: Defines a single VRL remap rule with its own filtering and transformation
26874
+ logic.
26875
+ properties:
26876
+ drop_on_error:
26877
+ default: false
26878
+ description: Whether to drop events that caused errors during processing.
26879
+ example: false
26880
+ type: boolean
26881
+ enabled:
26882
+ default: true
26883
+ description: Whether this remap rule is enabled.
26884
+ example: true
26885
+ type: boolean
26886
+ include:
26887
+ description: A Datadog search query used to filter events for this specific
26888
+ remap rule.
26889
+ example: service:web
26890
+ type: string
26891
+ name:
26892
+ description: A descriptive name for this remap rule.
26893
+ example: Parse JSON from message field
26894
+ type: string
26895
+ source:
26896
+ description: The VRL script source code that defines the processing logic.
26897
+ Must not exceed 10 000 characters.
26898
+ example: . = parse_json!(.message)
26899
+ maxLength: 10000
26900
+ type: string
26901
+ required:
26902
+ - include
26903
+ - name
26904
+ - source
26905
+ type: object
26906
+ ObservabilityPipelineRemapVrlProcessorType:
26907
+ default: custom_processor
26908
+ description: The processor type. The value should always be `custom_processor`.
26909
+ enum:
26910
+ - custom_processor
26911
+ example: custom_processor
26912
+ type: string
26913
+ x-enum-varnames:
26914
+ - CUSTOM_PROCESSOR
26830
26915
ObservabilityPipelineRemoveFieldsProcessor:
26831
26916
description: The `remove_fields` processor deletes specified fields from logs.
26832
26917
properties:
@@ -27465,6 +27550,278 @@ components:
27465
27550
type: string
27466
27551
x-enum-varnames:
27467
27552
- SENTINEL_ONE
27553
+ ObservabilityPipelineSocketDestination:
27554
+ description: 'The `socket` destination sends logs over TCP or UDP to a remote
27555
+ server.
27556
+
27557
+ '
27558
+ properties:
27559
+ encoding:
27560
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationEncoding'
27561
+ framing:
27562
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFraming'
27563
+ id:
27564
+ description: The unique identifier for this component.
27565
+ example: socket-destination
27566
+ type: string
27567
+ inputs:
27568
+ description: A list of component IDs whose output is used as the `input`
27569
+ for this component.
27570
+ example:
27571
+ - filter-processor
27572
+ items:
27573
+ type: string
27574
+ type: array
27575
+ mode:
27576
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationMode'
27577
+ tls:
27578
+ $ref: '#/components/schemas/ObservabilityPipelineTls'
27579
+ description: TLS configuration. Relevant only when `mode` is `tcp`.
27580
+ type:
27581
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationType'
27582
+ required:
27583
+ - id
27584
+ - type
27585
+ - inputs
27586
+ - encoding
27587
+ - framing
27588
+ - mode
27589
+ type: object
27590
+ ObservabilityPipelineSocketDestinationEncoding:
27591
+ description: Encoding format for log events.
27592
+ enum:
27593
+ - json
27594
+ - raw_message
27595
+ example: json
27596
+ type: string
27597
+ x-enum-varnames:
27598
+ - JSON
27599
+ - RAW_MESSAGE
27600
+ ObservabilityPipelineSocketDestinationFraming:
27601
+ description: Framing method configuration.
27602
+ oneOf:
27603
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingNewlineDelimited'
27604
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingBytes'
27605
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingCharacterDelimited'
27606
+ ObservabilityPipelineSocketDestinationFramingBytes:
27607
+ description: Event data is not delimited at all.
27608
+ properties:
27609
+ method:
27610
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingBytesMethod'
27611
+ required:
27612
+ - method
27613
+ type: object
27614
+ ObservabilityPipelineSocketDestinationFramingBytesMethod:
27615
+ description: The definition of `ObservabilityPipelineSocketDestinationFramingBytesMethod`
27616
+ object.
27617
+ enum:
27618
+ - bytes
27619
+ example: bytes
27620
+ type: string
27621
+ x-enum-varnames:
27622
+ - BYTES
27623
+ ObservabilityPipelineSocketDestinationFramingCharacterDelimited:
27624
+ description: Each log event is separated using the specified delimiter character.
27625
+ properties:
27626
+ delimiter:
27627
+ description: A single ASCII character used as a delimiter.
27628
+ example: '|'
27629
+ maxLength: 1
27630
+ minLength: 1
27631
+ type: string
27632
+ method:
27633
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingCharacterDelimitedMethod'
27634
+ required:
27635
+ - method
27636
+ - delimiter
27637
+ type: object
27638
+ ObservabilityPipelineSocketDestinationFramingCharacterDelimitedMethod:
27639
+ description: The definition of `ObservabilityPipelineSocketDestinationFramingCharacterDelimitedMethod`
27640
+ object.
27641
+ enum:
27642
+ - character_delimited
27643
+ example: character_delimited
27644
+ type: string
27645
+ x-enum-varnames:
27646
+ - CHARACTER_DELIMITED
27647
+ ObservabilityPipelineSocketDestinationFramingNewlineDelimited:
27648
+ description: Each log event is delimited by a newline character.
27649
+ properties:
27650
+ method:
27651
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingNewlineDelimitedMethod'
27652
+ required:
27653
+ - method
27654
+ type: object
27655
+ ObservabilityPipelineSocketDestinationFramingNewlineDelimitedMethod:
27656
+ description: The definition of `ObservabilityPipelineSocketDestinationFramingNewlineDelimitedMethod`
27657
+ object.
27658
+ enum:
27659
+ - newline_delimited
27660
+ example: newline_delimited
27661
+ type: string
27662
+ x-enum-varnames:
27663
+ - NEWLINE_DELIMITED
27664
+ ObservabilityPipelineSocketDestinationMode:
27665
+ description: Protocol used to send logs.
27666
+ enum:
27667
+ - tcp
27668
+ - udp
27669
+ example: tcp
27670
+ type: string
27671
+ x-enum-varnames:
27672
+ - TCP
27673
+ - UDP
27674
+ ObservabilityPipelineSocketDestinationType:
27675
+ default: socket
27676
+ description: The destination type. The value should always be `socket`.
27677
+ enum:
27678
+ - socket
27679
+ example: socket
27680
+ type: string
27681
+ x-enum-varnames:
27682
+ - SOCKET
27683
+ ObservabilityPipelineSocketSource:
27684
+ description: 'The `socket` source ingests logs over TCP or UDP.
27685
+
27686
+ '
27687
+ properties:
27688
+ framing:
27689
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFraming'
27690
+ id:
27691
+ description: The unique identifier for this component. Used to reference
27692
+ this component in other parts of the pipeline (e.g., as input to downstream
27693
+ components).
27694
+ example: socket-source
27695
+ type: string
27696
+ mode:
27697
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceMode'
27698
+ tls:
27699
+ $ref: '#/components/schemas/ObservabilityPipelineTls'
27700
+ description: TLS configuration. Relevant only when `mode` is `tcp`.
27701
+ type:
27702
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceType'
27703
+ required:
27704
+ - id
27705
+ - type
27706
+ - mode
27707
+ - framing
27708
+ type: object
27709
+ ObservabilityPipelineSocketSourceFraming:
27710
+ description: Framing method configuration for the socket source.
27711
+ oneOf:
27712
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingNewlineDelimited'
27713
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingBytes'
27714
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingCharacterDelimited'
27715
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingOctetCounting'
27716
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingChunkedGelf'
27717
+ ObservabilityPipelineSocketSourceFramingBytes:
27718
+ description: Byte frames are passed through as-is according to the underlying
27719
+ I/O boundaries (for example, split between messages or stream segments).
27720
+ properties:
27721
+ method:
27722
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingBytesMethod'
27723
+ required:
27724
+ - method
27725
+ type: object
27726
+ ObservabilityPipelineSocketSourceFramingBytesMethod:
27727
+ description: Byte frames are passed through as-is according to the underlying
27728
+ I/O boundaries (for example, split between messages or stream segments).
27729
+ enum:
27730
+ - bytes
27731
+ example: bytes
27732
+ type: string
27733
+ x-enum-varnames:
27734
+ - BYTES
27735
+ ObservabilityPipelineSocketSourceFramingCharacterDelimited:
27736
+ description: Byte frames which are delimited by a chosen character.
27737
+ properties:
27738
+ delimiter:
27739
+ description: A single ASCII character used to delimit events.
27740
+ example: '|'
27741
+ maxLength: 1
27742
+ minLength: 1
27743
+ type: string
27744
+ method:
27745
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingCharacterDelimitedMethod'
27746
+ required:
27747
+ - method
27748
+ - delimiter
27749
+ type: object
27750
+ ObservabilityPipelineSocketSourceFramingCharacterDelimitedMethod:
27751
+ description: Byte frames which are delimited by a chosen character.
27752
+ enum:
27753
+ - character_delimited
27754
+ example: character_delimited
27755
+ type: string
27756
+ x-enum-varnames:
27757
+ - CHARACTER_DELIMITED
27758
+ ObservabilityPipelineSocketSourceFramingChunkedGelf:
27759
+ description: Byte frames which are chunked GELF messages.
27760
+ properties:
27761
+ method:
27762
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingChunkedGelfMethod'
27763
+ required:
27764
+ - method
27765
+ type: object
27766
+ ObservabilityPipelineSocketSourceFramingChunkedGelfMethod:
27767
+ description: Byte frames which are chunked GELF messages.
27768
+ enum:
27769
+ - chunked_gelf
27770
+ example: chunked_gelf
27771
+ type: string
27772
+ x-enum-varnames:
27773
+ - CHUNKED_GELF
27774
+ ObservabilityPipelineSocketSourceFramingNewlineDelimited:
27775
+ description: Byte frames which are delimited by a newline character.
27776
+ properties:
27777
+ method:
27778
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingNewlineDelimitedMethod'
27779
+ required:
27780
+ - method
27781
+ type: object
27782
+ ObservabilityPipelineSocketSourceFramingNewlineDelimitedMethod:
27783
+ description: Byte frames which are delimited by a newline character.
27784
+ enum:
27785
+ - newline_delimited
27786
+ example: newline_delimited
27787
+ type: string
27788
+ x-enum-varnames:
27789
+ - NEWLINE_DELIMITED
27790
+ ObservabilityPipelineSocketSourceFramingOctetCounting:
27791
+ description: Byte frames according to the octet counting format as per RFC6587.
27792
+ properties:
27793
+ method:
27794
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingOctetCountingMethod'
27795
+ required:
27796
+ - method
27797
+ type: object
27798
+ ObservabilityPipelineSocketSourceFramingOctetCountingMethod:
27799
+ description: Byte frames according to the octet counting format as per RFC6587.
27800
+ enum:
27801
+ - octet_counting
27802
+ example: octet_counting
27803
+ type: string
27804
+ x-enum-varnames:
27805
+ - OCTET_COUNTING
27806
+ ObservabilityPipelineSocketSourceMode:
27807
+ description: Protocol used to receive logs.
27808
+ enum:
27809
+ - tcp
27810
+ - udp
27811
+ example: tcp
27812
+ type: string
27813
+ x-enum-varnames:
27814
+ - TCP
27815
+ - UDP
27816
+ ObservabilityPipelineSocketSourceType:
27817
+ default: socket
27818
+ description: The source type. The value should always be `socket`.
27819
+ enum:
27820
+ - socket
27821
+ example: socket
27822
+ type: string
27823
+ x-enum-varnames:
27824
+ - SOCKET
27468
27825
ObservabilityPipelineSpec:
27469
27826
description: Input schema representing an observability pipeline configuration.
27470
27827
Used in create and validate requests.
0 commit comments