@@ -25153,6 +25153,7 @@ components:
25153
25153
- $ref: '#/components/schemas/ObservabilityPipelineSentinelOneDestination'
25154
25154
- $ref: '#/components/schemas/ObservabilityPipelineOpenSearchDestination'
25155
25155
- $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestination'
25156
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketDestination'
25156
25157
ObservabilityPipelineConfigProcessorItem:
25157
25158
description: A processor for the pipeline.
25158
25159
oneOf:
@@ -25172,6 +25173,7 @@ components:
25172
25173
- $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableProcessor'
25173
25174
- $ref: '#/components/schemas/ObservabilityPipelineReduceProcessor'
25174
25175
- $ref: '#/components/schemas/ObservabilityPipelineThrottleProcessor'
25176
+ - $ref: '#/components/schemas/ObservabilityPipelineRemapVrlProcessor'
25175
25177
ObservabilityPipelineConfigSourceItem:
25176
25178
description: A data source for the pipeline.
25177
25179
oneOf:
@@ -25190,6 +25192,7 @@ components:
25190
25192
- $ref: '#/components/schemas/ObservabilityPipelineGooglePubSubSource'
25191
25193
- $ref: '#/components/schemas/ObservabilityPipelineHttpClientSource'
25192
25194
- $ref: '#/components/schemas/ObservabilityPipelineLogstashSource'
25195
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSource'
25193
25196
ObservabilityPipelineData:
25194
25197
description: "Contains the pipeline\u2019s ID, type, and configuration attributes."
25195
25198
properties:
@@ -26835,6 +26838,87 @@ components:
26835
26838
type: string
26836
26839
x-enum-varnames:
26837
26840
- REDUCE
26841
+ ObservabilityPipelineRemapVrlProcessor:
26842
+ description: The `remap_vrl` processor (also called "Custom processor") transforms
26843
+ events using [Vector Remap Language (VRL)](https://vector.dev/docs/reference/vrl/)
26844
+ scripts with advanced filtering capabilities.
26845
+ properties:
26846
+ id:
26847
+ description: The unique identifier for this processor.
26848
+ example: remap-vrl-processor
26849
+ type: string
26850
+ include:
26851
+ description: A Datadog search query used to determine which logs this processor
26852
+ targets. This field should always be set to `*` for the remap_vrl processor.
26853
+ example: '*'
26854
+ type: string
26855
+ inputs:
26856
+ description: A list of component IDs whose output is used as the input for
26857
+ this processor.
26858
+ example:
26859
+ - datadog-agent-source
26860
+ items:
26861
+ type: string
26862
+ type: array
26863
+ remaps:
26864
+ description: Array of VRL remap rules.
26865
+ items:
26866
+ $ref: '#/components/schemas/ObservabilityPipelineRemapVrlProcessorRemap'
26867
+ maxItems: 15
26868
+ minItems: 1
26869
+ type: array
26870
+ type:
26871
+ $ref: '#/components/schemas/ObservabilityPipelineRemapVrlProcessorType'
26872
+ required:
26873
+ - id
26874
+ - type
26875
+ - include
26876
+ - remaps
26877
+ - inputs
26878
+ type: object
26879
+ ObservabilityPipelineRemapVrlProcessorRemap:
26880
+ description: Defines a single VRL remap rule with its own filtering and transformation
26881
+ logic.
26882
+ properties:
26883
+ dropOnError:
26884
+ default: false
26885
+ description: Whether to drop events that caused errors during processing.
26886
+ example: false
26887
+ type: boolean
26888
+ enabled:
26889
+ default: true
26890
+ description: Whether this remap rule is enabled.
26891
+ example: true
26892
+ type: boolean
26893
+ include:
26894
+ description: A Datadog search query used to filter events for this specific
26895
+ remap rule.
26896
+ example: service:web
26897
+ type: string
26898
+ name:
26899
+ description: A descriptive name for this remap rule.
26900
+ example: Parse JSON from message field
26901
+ type: string
26902
+ source:
26903
+ description: The VRL script source code that defines the processing logic.
26904
+ Must not exceed 3000 characters and cannot contain forbidden functions.
26905
+ example: . = parse_json!(.message)
26906
+ maxLength: 3000
26907
+ type: string
26908
+ required:
26909
+ - include
26910
+ - name
26911
+ - source
26912
+ type: object
26913
+ ObservabilityPipelineRemapVrlProcessorType:
26914
+ default: remap_vrl
26915
+ description: The processor type. The value should always be `remap_vrl`.
26916
+ enum:
26917
+ - remap_vrl
26918
+ example: remap_vrl
26919
+ type: string
26920
+ x-enum-varnames:
26921
+ - REMAP_VRL
26838
26922
ObservabilityPipelineRemoveFieldsProcessor:
26839
26923
description: The `remove_fields` processor deletes specified fields from logs.
26840
26924
properties:
@@ -27473,6 +27557,278 @@ components:
27473
27557
type: string
27474
27558
x-enum-varnames:
27475
27559
- SENTINEL_ONE
27560
+ ObservabilityPipelineSocketDestination:
27561
+ description: 'The `socket` destination sends logs over TCP or UDP to a remote
27562
+ server.
27563
+
27564
+ '
27565
+ properties:
27566
+ encoding:
27567
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationEncoding'
27568
+ framing:
27569
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFraming'
27570
+ id:
27571
+ description: The unique identifier for this component.
27572
+ example: socket-destination
27573
+ type: string
27574
+ inputs:
27575
+ description: A list of component IDs whose output is used as the `input`
27576
+ for this component.
27577
+ example:
27578
+ - filter-processor
27579
+ items:
27580
+ type: string
27581
+ type: array
27582
+ mode:
27583
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationMode'
27584
+ tls:
27585
+ $ref: '#/components/schemas/ObservabilityPipelineTls'
27586
+ description: TLS configuration. Relevant only when `mode` is `tcp`.
27587
+ type:
27588
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationType'
27589
+ required:
27590
+ - id
27591
+ - type
27592
+ - inputs
27593
+ - encoding
27594
+ - framing
27595
+ - mode
27596
+ type: object
27597
+ ObservabilityPipelineSocketDestinationEncoding:
27598
+ description: Encoding format for log events.
27599
+ enum:
27600
+ - json
27601
+ - raw_message
27602
+ example: json
27603
+ type: string
27604
+ x-enum-varnames:
27605
+ - JSON
27606
+ - RAW_MESSAGE
27607
+ ObservabilityPipelineSocketDestinationFraming:
27608
+ description: Framing method configuration.
27609
+ oneOf:
27610
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingNewlineDelimited'
27611
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingBytes'
27612
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingCharacterDelimited'
27613
+ ObservabilityPipelineSocketDestinationFramingBytes:
27614
+ description: Event data is not delimited at all.
27615
+ properties:
27616
+ method:
27617
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingBytesMethod'
27618
+ required:
27619
+ - method
27620
+ type: object
27621
+ ObservabilityPipelineSocketDestinationFramingBytesMethod:
27622
+ description: The definition of `ObservabilityPipelineSocketDestinationFramingBytesMethod`
27623
+ object.
27624
+ enum:
27625
+ - bytes
27626
+ example: bytes
27627
+ type: string
27628
+ x-enum-varnames:
27629
+ - BYTES
27630
+ ObservabilityPipelineSocketDestinationFramingCharacterDelimited:
27631
+ description: Each log event is separated using the specified delimiter character.
27632
+ properties:
27633
+ delimiter:
27634
+ description: A single ASCII character used as a delimiter.
27635
+ example: '|'
27636
+ maxLength: 1
27637
+ minLength: 1
27638
+ type: string
27639
+ method:
27640
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingCharacterDelimitedMethod'
27641
+ required:
27642
+ - method
27643
+ - delimiter
27644
+ type: object
27645
+ ObservabilityPipelineSocketDestinationFramingCharacterDelimitedMethod:
27646
+ description: The definition of `ObservabilityPipelineSocketDestinationFramingCharacterDelimitedMethod`
27647
+ object.
27648
+ enum:
27649
+ - character_delimited
27650
+ example: character_delimited
27651
+ type: string
27652
+ x-enum-varnames:
27653
+ - CHARACTER_DELIMITED
27654
+ ObservabilityPipelineSocketDestinationFramingNewlineDelimited:
27655
+ description: Each log event is delimited by a newline character.
27656
+ properties:
27657
+ method:
27658
+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingNewlineDelimitedMethod'
27659
+ required:
27660
+ - method
27661
+ type: object
27662
+ ObservabilityPipelineSocketDestinationFramingNewlineDelimitedMethod:
27663
+ description: The definition of `ObservabilityPipelineSocketDestinationFramingNewlineDelimitedMethod`
27664
+ object.
27665
+ enum:
27666
+ - newline_delimited
27667
+ example: newline_delimited
27668
+ type: string
27669
+ x-enum-varnames:
27670
+ - NEWLINE_DELIMITED
27671
+ ObservabilityPipelineSocketDestinationMode:
27672
+ description: Protocol used to send logs.
27673
+ enum:
27674
+ - tcp
27675
+ - udp
27676
+ example: tcp
27677
+ type: string
27678
+ x-enum-varnames:
27679
+ - TCP
27680
+ - UDP
27681
+ ObservabilityPipelineSocketDestinationType:
27682
+ default: socket
27683
+ description: The destination type. The value should always be `socket`.
27684
+ enum:
27685
+ - socket
27686
+ example: socket
27687
+ type: string
27688
+ x-enum-varnames:
27689
+ - SOCKET
27690
+ ObservabilityPipelineSocketSource:
27691
+ description: 'The `socket` source ingests logs over TCP or UDP.
27692
+
27693
+ '
27694
+ properties:
27695
+ framing:
27696
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFraming'
27697
+ id:
27698
+ description: The unique identifier for this component. Used to reference
27699
+ this component in other parts of the pipeline (e.g., as input to downstream
27700
+ components).
27701
+ example: socket-source
27702
+ type: string
27703
+ mode:
27704
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceMode'
27705
+ tls:
27706
+ $ref: '#/components/schemas/ObservabilityPipelineTls'
27707
+ description: TLS configuration. Relevant only when `mode` is `tcp`.
27708
+ type:
27709
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceType'
27710
+ required:
27711
+ - id
27712
+ - type
27713
+ - mode
27714
+ - framing
27715
+ type: object
27716
+ ObservabilityPipelineSocketSourceFraming:
27717
+ description: Framing method configuration for the socket source.
27718
+ oneOf:
27719
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingNewlineDelimited'
27720
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingBytes'
27721
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingCharacterDelimited'
27722
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingOctetCounting'
27723
+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingChunkedGelf'
27724
+ ObservabilityPipelineSocketSourceFramingBytes:
27725
+ description: Byte frames are passed through as-is according to the underlying
27726
+ I/O boundaries (for example, split between messages or stream segments).
27727
+ properties:
27728
+ method:
27729
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingBytesMethod'
27730
+ required:
27731
+ - method
27732
+ type: object
27733
+ ObservabilityPipelineSocketSourceFramingBytesMethod:
27734
+ description: Byte frames are passed through as-is according to the underlying
27735
+ I/O boundaries (for example, split between messages or stream segments).
27736
+ enum:
27737
+ - bytes
27738
+ example: bytes
27739
+ type: string
27740
+ x-enum-varnames:
27741
+ - BYTES
27742
+ ObservabilityPipelineSocketSourceFramingCharacterDelimited:
27743
+ description: Byte frames which are delimited by a chosen character.
27744
+ properties:
27745
+ delimiter:
27746
+ description: A single ASCII character used to delimit events.
27747
+ example: '|'
27748
+ maxLength: 1
27749
+ minLength: 1
27750
+ type: string
27751
+ method:
27752
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingCharacterDelimitedMethod'
27753
+ required:
27754
+ - method
27755
+ - delimiter
27756
+ type: object
27757
+ ObservabilityPipelineSocketSourceFramingCharacterDelimitedMethod:
27758
+ description: Byte frames which are delimited by a chosen character.
27759
+ enum:
27760
+ - character_delimited
27761
+ example: character_delimited
27762
+ type: string
27763
+ x-enum-varnames:
27764
+ - CHARACTER_DELIMITED
27765
+ ObservabilityPipelineSocketSourceFramingChunkedGelf:
27766
+ description: Byte frames which are chunked GELF messages.
27767
+ properties:
27768
+ method:
27769
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingChunkedGelfMethod'
27770
+ required:
27771
+ - method
27772
+ type: object
27773
+ ObservabilityPipelineSocketSourceFramingChunkedGelfMethod:
27774
+ description: Byte frames which are chunked GELF messages.
27775
+ enum:
27776
+ - chunked_gelf
27777
+ example: chunked_gelf
27778
+ type: string
27779
+ x-enum-varnames:
27780
+ - CHUNKED_GELF
27781
+ ObservabilityPipelineSocketSourceFramingNewlineDelimited:
27782
+ description: Byte frames which are delimited by a newline character.
27783
+ properties:
27784
+ method:
27785
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingNewlineDelimitedMethod'
27786
+ required:
27787
+ - method
27788
+ type: object
27789
+ ObservabilityPipelineSocketSourceFramingNewlineDelimitedMethod:
27790
+ description: Byte frames which are delimited by a newline character.
27791
+ enum:
27792
+ - newline_delimited
27793
+ example: newline_delimited
27794
+ type: string
27795
+ x-enum-varnames:
27796
+ - NEWLINE_DELIMITED
27797
+ ObservabilityPipelineSocketSourceFramingOctetCounting:
27798
+ description: Byte frames according to the octet counting format as per RFC6587.
27799
+ properties:
27800
+ method:
27801
+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingOctetCountingMethod'
27802
+ required:
27803
+ - method
27804
+ type: object
27805
+ ObservabilityPipelineSocketSourceFramingOctetCountingMethod:
27806
+ description: Byte frames according to the octet counting format as per RFC6587.
27807
+ enum:
27808
+ - octet_counting
27809
+ example: octet_counting
27810
+ type: string
27811
+ x-enum-varnames:
27812
+ - OCTET_COUNTING
27813
+ ObservabilityPipelineSocketSourceMode:
27814
+ description: Protocol used to receive logs.
27815
+ enum:
27816
+ - tcp
27817
+ - udp
27818
+ example: tcp
27819
+ type: string
27820
+ x-enum-varnames:
27821
+ - TCP
27822
+ - UDP
27823
+ ObservabilityPipelineSocketSourceType:
27824
+ default: socket
27825
+ description: The source type. The value should always be `socket`.
27826
+ enum:
27827
+ - socket
27828
+ example: socket
27829
+ type: string
27830
+ x-enum-varnames:
27831
+ - SOCKET
27476
27832
ObservabilityPipelineSpec:
27477
27833
description: Input schema representing an observability pipeline configuration.
27478
27834
Used in create and validate requests.
0 commit comments