@@ -25104,6 +25104,7 @@ components:
25104
25104
- $ref: '#/components/schemas/ObservabilityPipelineSentinelOneDestination'
25105
25105
- $ref: '#/components/schemas/ObservabilityPipelineOpenSearchDestination'
25106
25106
- $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestination'
25107
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketDestination'
25107
25108
ObservabilityPipelineConfigProcessorItem:
25108
25109
description: A processor for the pipeline.
25109
25110
oneOf:
@@ -25123,6 +25124,7 @@ components:
25123
25124
- $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableProcessor'
25124
25125
- $ref: '#/components/schemas/ObservabilityPipelineReduceProcessor'
25125
25126
- $ref: '#/components/schemas/ObservabilityPipelineThrottleProcessor'
25127
+ - $ref: '#/components/schemas/ObservabilityPipelineRemapVrlProcessor'
25126
25128
ObservabilityPipelineConfigSourceItem:
25127
25129
description: A data source for the pipeline.
25128
25130
oneOf:
@@ -25141,6 +25143,7 @@ components:
25141
25143
- $ref: '#/components/schemas/ObservabilityPipelineGooglePubSubSource'
25142
25144
- $ref: '#/components/schemas/ObservabilityPipelineHttpClientSource'
25143
25145
- $ref: '#/components/schemas/ObservabilityPipelineLogstashSource'
25146
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSource'
25144
25147
ObservabilityPipelineData:
25145
25148
description: "Contains the pipeline\u2019s ID, type, and configuration attributes."
25146
25149
properties:
@@ -26786,6 +26789,87 @@ components:
26786
26789
type: string
26787
26790
x-enum-varnames:
26788
26791
- REDUCE
26792
+ ObservabilityPipelineRemapVrlProcessor:
26793
+ description: The `remap_vrl` processor transforms events using Vector Remap
26794
+ Language (VRL) scripts with advanced filtering capabilities.
26795
+ properties:
26796
+ id:
26797
+ description: The unique identifier for this processor.
26798
+ example: remap-vrl-processor
26799
+ type: string
26800
+ include:
26801
+ description: A Datadog search query used to determine which logs this processor
26802
+ targets. This field should always be set to `*` for the remap_vrl processor.
26803
+ example: '*'
26804
+ type: string
26805
+ inputs:
26806
+ description: A list of component IDs whose output is used as the input for
26807
+ this processor.
26808
+ example:
26809
+ - datadog-agent-source
26810
+ items:
26811
+ type: string
26812
+ type: array
26813
+ remaps:
26814
+ description: Array of VRL remap configurations. Each remap defines a transformation
26815
+ rule with its own filter and VRL script.
26816
+ items:
26817
+ $ref: '#/components/schemas/ObservabilityPipelineRemapVrlProcessorRemap'
26818
+ maxItems: 15
26819
+ minItems: 1
26820
+ type: array
26821
+ type:
26822
+ $ref: '#/components/schemas/ObservabilityPipelineRemapVrlProcessorType'
26823
+ required:
26824
+ - id
26825
+ - type
26826
+ - include
26827
+ - remaps
26828
+ - inputs
26829
+ type: object
26830
+ ObservabilityPipelineRemapVrlProcessorRemap:
26831
+ description: Defines a single VRL remap transformation rule with its own filtering
26832
+ and transformation logic.
26833
+ properties:
26834
+ dropOnError:
26835
+ default: false
26836
+ description: Whether to drop events that cause errors during transformation.
26837
+ example: false
26838
+ type: boolean
26839
+ enabled:
26840
+ default: true
26841
+ description: Whether this remap rule is enabled.
26842
+ example: true
26843
+ type: boolean
26844
+ include:
26845
+ description: A Datadog search query used to filter events for this specific
26846
+ remap rule.
26847
+ example: service:web
26848
+ type: string
26849
+ name:
26850
+ description: A descriptive name for this remap rule.
26851
+ example: Parse JSON from message field
26852
+ type: string
26853
+ source:
26854
+ description: The VRL script source code that defines the transformation
26855
+ logic. Must not exceed 3000 characters and cannot contain forbidden functions.
26856
+ example: . = parse_json!(.message)
26857
+ maxLength: 3000
26858
+ type: string
26859
+ required:
26860
+ - include
26861
+ - name
26862
+ - source
26863
+ type: object
26864
+ ObservabilityPipelineRemapVrlProcessorType:
26865
+ default: remap_vrl
26866
+ description: The processor type. The value should always be `remap_vrl`.
26867
+ enum:
26868
+ - remap_vrl
26869
+ example: remap_vrl
26870
+ type: string
26871
+ x-enum-varnames:
26872
+ - REMAP_VRL
26789
26873
ObservabilityPipelineRemoveFieldsProcessor:
26790
26874
description: The `remove_fields` processor deletes specified fields from logs.
26791
26875
properties:
@@ -27424,6 +27508,278 @@ components:
27424
27508
type: string
27425
27509
x-enum-varnames:
27426
27510
- SENTINEL_ONE
27511
+ ObservabilityPipelineSocketDestination:
27512
+ description: 'The `socket` destination sends logs over TCP or UDP to a remote
27513
+ server.
27514
+
27515
+ '
27516
+ properties:
27517
+ encoding:
27518
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationEncoding'
27519
+ framing:
27520
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFraming'
27521
+ id:
27522
+ description: The unique identifier for this component.
27523
+ example: socket-destination
27524
+ type: string
27525
+ inputs:
27526
+ description: A list of component IDs whose output is used as the `input`
27527
+ for this component.
27528
+ example:
27529
+ - filter-processor
27530
+ items:
27531
+ type: string
27532
+ type: array
27533
+ mode:
27534
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationMode'
27535
+ tls:
27536
+ $ref: '#/components/schemas/ObservabilityPipelineTls'
27537
+ description: TLS configuration. Relevant only when `mode` is `tcp`.
27538
+ type:
27539
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationType'
27540
+ required:
27541
+ - id
27542
+ - type
27543
+ - inputs
27544
+ - encoding
27545
+ - framing
27546
+ - mode
27547
+ type: object
27548
+ ObservabilityPipelineSocketDestinationEncoding:
27549
+ description: Encoding format for log events.
27550
+ enum:
27551
+ - json
27552
+ - raw_message
27553
+ example: json
27554
+ type: string
27555
+ x-enum-varnames:
27556
+ - JSON
27557
+ - RAW_MESSAGE
27558
+ ObservabilityPipelineSocketDestinationFraming:
27559
+ description: Framing method configuration.
27560
+ oneOf:
27561
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingNewlineDelimited'
27562
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingBytes'
27563
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingCharacterDelimited'
27564
+ ObservabilityPipelineSocketDestinationFramingBytes:
27565
+ description: Event data is not delimited at all.
27566
+ properties:
27567
+ method:
27568
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingBytesMethod'
27569
+ required:
27570
+ - method
27571
+ type: object
27572
+ ObservabilityPipelineSocketDestinationFramingBytesMethod:
27573
+ description: The definition of `ObservabilityPipelineSocketDestinationFramingBytesMethod`
27574
+ object.
27575
+ enum:
27576
+ - bytes
27577
+ example: bytes
27578
+ type: string
27579
+ x-enum-varnames:
27580
+ - BYTES
27581
+ ObservabilityPipelineSocketDestinationFramingCharacterDelimited:
27582
+ description: Each log event is separated using the specified delimiter character.
27583
+ properties:
27584
+ delimiter:
27585
+ description: A single ASCII character used as a delimiter.
27586
+ example: '|'
27587
+ maxLength: 1
27588
+ minLength: 1
27589
+ type: string
27590
+ method:
27591
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingCharacterDelimitedMethod'
27592
+ required:
27593
+ - method
27594
+ - delimiter
27595
+ type: object
27596
+ ObservabilityPipelineSocketDestinationFramingCharacterDelimitedMethod:
27597
+ description: The definition of `ObservabilityPipelineSocketDestinationFramingCharacterDelimitedMethod`
27598
+ object.
27599
+ enum:
27600
+ - character_delimited
27601
+ example: character_delimited
27602
+ type: string
27603
+ x-enum-varnames:
27604
+ - CHARACTER_DELIMITED
27605
+ ObservabilityPipelineSocketDestinationFramingNewlineDelimited:
27606
+ description: Each log event is delimited by a newline character.
27607
+ properties:
27608
+ method:
27609
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingNewlineDelimitedMethod'
27610
+ required:
27611
+ - method
27612
+ type: object
27613
+ ObservabilityPipelineSocketDestinationFramingNewlineDelimitedMethod:
27614
+ description: The definition of `ObservabilityPipelineSocketDestinationFramingNewlineDelimitedMethod`
27615
+ object.
27616
+ enum:
27617
+ - newline_delimited
27618
+ example: newline_delimited
27619
+ type: string
27620
+ x-enum-varnames:
27621
+ - NEWLINE_DELIMITED
27622
+ ObservabilityPipelineSocketDestinationMode:
27623
+ description: Protocol used to send logs.
27624
+ enum:
27625
+ - tcp
27626
+ - udp
27627
+ example: tcp
27628
+ type: string
27629
+ x-enum-varnames:
27630
+ - TCP
27631
+ - UDP
27632
+ ObservabilityPipelineSocketDestinationType:
27633
+ default: socket
27634
+ description: The destination type. The value should always be `socket`.
27635
+ enum:
27636
+ - socket
27637
+ example: socket
27638
+ type: string
27639
+ x-enum-varnames:
27640
+ - SOCKET
27641
+ ObservabilityPipelineSocketSource:
27642
+ description: 'The `socket` source ingests logs over TCP or UDP.
27643
+
27644
+ '
27645
+ properties:
27646
+ framing:
27647
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFraming'
27648
+ id:
27649
+ description: The unique identifier for this component. Used to reference
27650
+ this component in other parts of the pipeline (e.g., as input to downstream
27651
+ components).
27652
+ example: socket-source
27653
+ type: string
27654
+ mode:
27655
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceMode'
27656
+ tls:
27657
+ $ref: '#/components/schemas/ObservabilityPipelineTls'
27658
+ description: TLS configuration. Relevant only when `mode` is `tcp`.
27659
+ type:
27660
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceType'
27661
+ required:
27662
+ - id
27663
+ - type
27664
+ - mode
27665
+ - framing
27666
+ type: object
27667
+ ObservabilityPipelineSocketSourceFraming:
27668
+ description: Framing method configuration for the socket source.
27669
+ oneOf:
27670
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingNewlineDelimited'
27671
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingBytes'
27672
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingCharacterDelimited'
27673
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingOctetCounting'
27674
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingChunkedGelf'
27675
+ ObservabilityPipelineSocketSourceFramingBytes:
27676
+ description: Byte frames are passed through as-is according to the underlying
27677
+ I/O boundaries (for example, split between messages or stream segments).
27678
+ properties:
27679
+ method:
27680
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingBytesMethod'
27681
+ required:
27682
+ - method
27683
+ type: object
27684
+ ObservabilityPipelineSocketSourceFramingBytesMethod:
27685
+ description: Byte frames are passed through as-is according to the underlying
27686
+ I/O boundaries (for example, split between messages or stream segments).
27687
+ enum:
27688
+ - bytes
27689
+ example: bytes
27690
+ type: string
27691
+ x-enum-varnames:
27692
+ - BYTES
27693
+ ObservabilityPipelineSocketSourceFramingCharacterDelimited:
27694
+ description: Byte frames which are delimited by a chosen character.
27695
+ properties:
27696
+ delimiter:
27697
+ description: A single ASCII character used to delimit events.
27698
+ example: '|'
27699
+ maxLength: 1
27700
+ minLength: 1
27701
+ type: string
27702
+ method:
27703
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingCharacterDelimitedMethod'
27704
+ required:
27705
+ - method
27706
+ - delimiter
27707
+ type: object
27708
+ ObservabilityPipelineSocketSourceFramingCharacterDelimitedMethod:
27709
+ description: Byte frames which are delimited by a chosen character.
27710
+ enum:
27711
+ - character_delimited
27712
+ example: character_delimited
27713
+ type: string
27714
+ x-enum-varnames:
27715
+ - CHARACTER_DELIMITED
27716
+ ObservabilityPipelineSocketSourceFramingChunkedGelf:
27717
+ description: Byte frames which are chunked GELF messages.
27718
+ properties:
27719
+ method:
27720
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingChunkedGelfMethod'
27721
+ required:
27722
+ - method
27723
+ type: object
27724
+ ObservabilityPipelineSocketSourceFramingChunkedGelfMethod:
27725
+ description: Byte frames which are chunked GELF messages.
27726
+ enum:
27727
+ - chunked_gelf
27728
+ example: chunked_gelf
27729
+ type: string
27730
+ x-enum-varnames:
27731
+ - CHUNKED_GELF
27732
+ ObservabilityPipelineSocketSourceFramingNewlineDelimited:
27733
+ description: Byte frames which are delimited by a newline character.
27734
+ properties:
27735
+ method:
27736
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingNewlineDelimitedMethod'
27737
+ required:
27738
+ - method
27739
+ type: object
27740
+ ObservabilityPipelineSocketSourceFramingNewlineDelimitedMethod:
27741
+ description: Byte frames which are delimited by a newline character.
27742
+ enum:
27743
+ - newline_delimited
27744
+ example: newline_delimited
27745
+ type: string
27746
+ x-enum-varnames:
27747
+ - NEWLINE_DELIMITED
27748
+ ObservabilityPipelineSocketSourceFramingOctetCounting:
27749
+ description: Byte frames according to the octet counting format as per RFC6587.
27750
+ properties:
27751
+ method:
27752
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingOctetCountingMethod'
27753
+ required:
27754
+ - method
27755
+ type: object
27756
+ ObservabilityPipelineSocketSourceFramingOctetCountingMethod:
27757
+ description: Byte frames according to the octet counting format as per RFC6587.
27758
+ enum:
27759
+ - octet_counting
27760
+ example: octet_counting
27761
+ type: string
27762
+ x-enum-varnames:
27763
+ - OCTET_COUNTING
27764
+ ObservabilityPipelineSocketSourceMode:
27765
+ description: Protocol used to receive logs.
27766
+ enum:
27767
+ - tcp
27768
+ - udp
27769
+ example: tcp
27770
+ type: string
27771
+ x-enum-varnames:
27772
+ - TCP
27773
+ - UDP
27774
+ ObservabilityPipelineSocketSourceType:
27775
+ default: socket
27776
+ description: The source type. The value should always be `socket`.
27777
+ enum:
27778
+ - socket
27779
+ example: socket
27780
+ type: string
27781
+ x-enum-varnames:
27782
+ - SOCKET
27427
27783
ObservabilityPipelineSpec:
27428
27784
description: Input schema representing an observability pipeline configuration.
27429
27785
Used in create and validate requests.
0 commit comments