Skip to content

Commit 4ad1778

Browse files
author
ci.datadog-api-spec
committed
Regenerate client from commit a23bfac of spec repo
1 parent b35bbbf commit 4ad1778

File tree

25 files changed

+1974
-0
lines changed

25 files changed

+1974
-0
lines changed

‎.generator/schemas/v1/openapi.yaml‎

Lines changed: 238 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6331,6 +6331,7 @@ components:
63316331
- $ref: '#/components/schemas/LogsSpanRemapper'
63326332
- $ref: '#/components/schemas/LogsArrayProcessor'
63336333
- $ref: '#/components/schemas/LogsDecoderProcessor'
6334+
- $ref: '#/components/schemas/LogsSchemaProcessor'
63346335
LogsQueryCompute:
63356336
description: Define computation for a log query.
63366337
properties:
@@ -6392,6 +6393,243 @@ components:
63926393
periods.
63936394
type: string
63946395
type: object
6396+
LogsSchemaCategoryMapper:
6397+
description: "Use the Schema Category Mapper to categorize log event into enum
6398+
fields.\nIn the case of OCSF, they can be used to map sibling fields which
6399+
are composed of an ID and a name.\n\n**Notes**:\n\n- The syntax of the query
6400+
is the one of Logs Explorer search bar.\n The query can be done on any log
6401+
attribute or tag, whether it is a facet or not.\n Wildcards can also be used
6402+
inside your query.\n- Categories are executed in order and processing stops
6403+
at the first match.\n Make sure categories are properly ordered in case a
6404+
log could match multiple queries.\n- Sibling fields always have a numerical
6405+
ID field and a human-readable string name.\n- A fallback section handles cases
6406+
where the name or ID value matches a specific value.\n If the name matches
6407+
\"Other\" or the ID matches 99, the value of the sibling name field will be
6408+
pulled from a source field from the original log."
6409+
properties:
6410+
categories:
6411+
description: 'Array of filters to match or not a log and their
6412+
6413+
corresponding `name` to assign a custom value to the log.'
6414+
example:
6415+
- filter:
6416+
query: '@eventName:(ConsoleLogin OR ExternalIdPDirectoryLogin OR UserAuthentication
6417+
OR Authenticate)'
6418+
id: 1
6419+
name: Logon
6420+
- filter:
6421+
query: '@eventName:*'
6422+
id: 99
6423+
name: Other
6424+
items:
6425+
$ref: '#/components/schemas/LogsSchemaCategoryMapperCategory'
6426+
type: array
6427+
fallback:
6428+
$ref: '#/components/schemas/LogsSchemaCategoryMapperFallback'
6429+
name:
6430+
description: Name of the logs schema category mapper.
6431+
example: activity_id and activity_name
6432+
type: string
6433+
targets:
6434+
$ref: '#/components/schemas/LogsSchemaCategoryMapperTargets'
6435+
type:
6436+
$ref: '#/components/schemas/LogsSchemaCategoryMapperType'
6437+
required:
6438+
- categories
6439+
- targets
6440+
- type
6441+
- name
6442+
type: object
6443+
LogsSchemaCategoryMapperCategory:
6444+
description: Object describing the logs filter with corresponding category ID
6445+
and name assignment.
6446+
properties:
6447+
filter:
6448+
$ref: '#/components/schemas/LogsFilter'
6449+
id:
6450+
description: ID to inject into the category.
6451+
example: 1
6452+
format: int64
6453+
type: integer
6454+
name:
6455+
description: Value to assign to target schema field.
6456+
example: Password Change
6457+
type: string
6458+
required:
6459+
- filter
6460+
- id
6461+
- name
6462+
type: object
6463+
LogsSchemaCategoryMapperFallback:
6464+
description: Used to override hardcoded category values with a value pulled
6465+
from a source attribute on the log.
6466+
properties:
6467+
sources:
6468+
additionalProperties:
6469+
items:
6470+
type: string
6471+
type: array
6472+
description: Fallback sources used to populate value of field.
6473+
example: {}
6474+
type: object
6475+
values:
6476+
additionalProperties:
6477+
type: string
6478+
description: Values that define when the fallback is used.
6479+
example: {}
6480+
type: object
6481+
type: object
6482+
LogsSchemaCategoryMapperTargets:
6483+
description: Name of the target attributes which value is defined by the matching
6484+
category.
6485+
properties:
6486+
id:
6487+
description: ID of the field to map log attributes to.
6488+
example: ocsf.activity_id
6489+
type: string
6490+
name:
6491+
description: Name of the field to map log attributes to.
6492+
example: ocsf.activity_name
6493+
type: string
6494+
type: object
6495+
LogsSchemaCategoryMapperType:
6496+
description: Type of logs schema category mapper.
6497+
enum:
6498+
- schema-category-mapper
6499+
example: schema-category-mapper
6500+
type: string
6501+
x-enum-varnames:
6502+
- SCHEMA_CATEGORY_MAPPER
6503+
LogsSchemaData:
6504+
description: Configuration of the schema data to use.
6505+
properties:
6506+
class_name:
6507+
description: Class name of the schema to use.
6508+
example: Account Change
6509+
type: string
6510+
class_uid:
6511+
description: Class UID of the schema to use.
6512+
example: 3001
6513+
format: int64
6514+
type: integer
6515+
profiles:
6516+
description: Optional list of profiles to modify the schema.
6517+
example:
6518+
- security_control
6519+
- host
6520+
items:
6521+
type: string
6522+
type: array
6523+
schema_type:
6524+
description: Type of schema to use.
6525+
example: ocsf
6526+
type: string
6527+
version:
6528+
description: Version of the schema to use.
6529+
example: 1.5.0
6530+
type: string
6531+
required:
6532+
- schema_type
6533+
- version
6534+
- class_uid
6535+
- class_name
6536+
type: object
6537+
LogsSchemaMapper:
6538+
description: Configuration of the schema processor mapper to use.
6539+
oneOf:
6540+
- $ref: '#/components/schemas/LogsSchemaRemapper'
6541+
- $ref: '#/components/schemas/LogsSchemaCategoryMapper'
6542+
LogsSchemaProcessor:
6543+
description: A processor that has additional validations and checks for a given
6544+
schema. Currently supported schema types include OCSF.
6545+
properties:
6546+
is_enabled:
6547+
default: false
6548+
description: Whether or not the processor is enabled.
6549+
type: boolean
6550+
mappers:
6551+
description: The `LogsSchemaProcessor` `mappers`.
6552+
example:
6553+
- name: Map userIdentity to ocsf.user.uid
6554+
sources:
6555+
- userIdentity.principalId
6556+
target: ocsf.user.uid
6557+
type: schema-remapper
6558+
items:
6559+
$ref: '#/components/schemas/LogsSchemaMapper'
6560+
type: array
6561+
name:
6562+
description: Name of the processor.
6563+
example: Map additionalEventData.LoginTo to ocsf.dst_endpoint.svc_name
6564+
type: string
6565+
schema:
6566+
$ref: '#/components/schemas/LogsSchemaData'
6567+
type:
6568+
$ref: '#/components/schemas/LogsSchemaProcessorType'
6569+
required:
6570+
- name
6571+
- mappers
6572+
- type
6573+
- schema
6574+
type: object
6575+
LogsSchemaProcessorType:
6576+
default: schema-processor
6577+
description: Type of logs schema processor.
6578+
enum:
6579+
- schema-processor
6580+
example: schema-processor
6581+
type: string
6582+
x-enum-varnames:
6583+
- SCHEMA_PROCESSOR
6584+
LogsSchemaRemapper:
6585+
description: The schema remapper maps source log fields to their correct fields.
6586+
properties:
6587+
name:
6588+
description: Name of the logs schema remapper.
6589+
example: Map userIdentity.principalId, responseElements.role.roleId, responseElements.user.userId
6590+
to ocsf.user.uid
6591+
type: string
6592+
override_on_conflict:
6593+
default: false
6594+
description: Override or not the target element if already set.
6595+
type: boolean
6596+
preserve_source:
6597+
default: false
6598+
description: Remove or preserve the remapped source element.
6599+
type: boolean
6600+
sources:
6601+
description: Array of source attributes.
6602+
example:
6603+
- userIdentity.principalId
6604+
- responseElements.role.roleId
6605+
- responseElements.user.userId
6606+
items:
6607+
description: Attribute used as a source to remap its value to the target
6608+
attribute.
6609+
type: string
6610+
type: array
6611+
target:
6612+
description: Target field to map log source field to.
6613+
example: ocsf.user.uid
6614+
type: string
6615+
target_format:
6616+
$ref: '#/components/schemas/TargetFormatType'
6617+
type:
6618+
$ref: '#/components/schemas/LogsSchemaRemapperType'
6619+
required:
6620+
- name
6621+
- sources
6622+
- target
6623+
- type
6624+
type: object
6625+
LogsSchemaRemapperType:
6626+
description: Type of logs schema remapper.
6627+
enum:
6628+
- schema-remapper
6629+
example: schema-remapper
6630+
type: string
6631+
x-enum-varnames:
6632+
- SCHEMA_REMAPPER
63956633
LogsServiceRemapper:
63966634
description: 'Use this processor if you want to assign one or more attributes
63976635
as the official service.

‎cassettes/v1/Logs-Pipelines_3794283453/Create-a-pipeline-with-Schema-Processor-and-preserve_source-false-returns-OK-response_4156521119/frozen.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2025-10-22T19:11:58.774Z"

‎cassettes/v1/Logs-Pipelines_3794283453/Create-a-pipeline-with-Schema-Processor-and-preserve_source-false-returns-OK-response_4156521119/recording.har‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
{
2+
"log": {
3+
"_recordingName": "Logs Pipelines/Create a pipeline with Schema Processor and preserve_source false returns \"OK\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "98435b4b38f66ccde06a72100d3c817d",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 3314,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "application/json"
22+
},
23+
{
24+
"_fromType": "array",
25+
"name": "content-type",
26+
"value": "application/json"
27+
}
28+
],
29+
"headersSize": 575,
30+
"httpVersion": "HTTP/1.1",
31+
"method": "POST",
32+
"postData": {
33+
"mimeType": "application/json",
34+
"params": [],
35+
"text": "{\"filter\":{\"query\":\"source:python\"},\"name\":\"testSchemaProcessor\",\"processors\":[{\"is_enabled\":true,\"mappers\":[{\"categories\":[{\"filter\":{\"query\":\"@eventName:(*Create*)\"},\"id\":1,\"name\":\"Create\"},{\"filter\":{\"query\":\"@eventName:(ChangePassword OR PasswordUpdated)\"},\"id\":3,\"name\":\"Password Change\"},{\"filter\":{\"query\":\"@eventName:(*Attach*)\"},\"id\":7,\"name\":\"Attach Policy\"},{\"filter\":{\"query\":\"@eventName:(*Detach* OR *Remove*)\"},\"id\":8,\"name\":\"Detach Policy\"},{\"filter\":{\"query\":\"@eventName:(*Delete*)\"},\"id\":6,\"name\":\"Delete\"},{\"filter\":{\"query\":\"@eventName:*\"},\"id\":99,\"name\":\"Other\"}],\"fallback\":{\"sources\":{\"ocsf.activity_name\":[\"eventName\"]},\"values\":{\"ocsf.activity_id\":\"99\",\"ocsf.activity_name\":\"Other\"}},\"name\":\"activity_id and activity_name\",\"targets\":{\"id\":\"ocsf.activity_id\",\"name\":\"ocsf.activity_name\"},\"type\":\"schema-category-mapper\"},{\"categories\":[{\"filter\":{\"query\":\"-@errorCode:*\"},\"id\":1,\"name\":\"Success\"},{\"filter\":{\"query\":\"@errorCode:*\"},\"id\":2,\"name\":\"Failure\"}],\"name\":\"status\",\"targets\":{\"id\":\"ocsf.status_id\",\"name\":\"ocsf.status\"},\"type\":\"schema-category-mapper\"},{\"categories\":[{\"filter\":{\"query\":\"@eventName:*\"},\"id\":1,\"name\":\"Informational\"}],\"name\":\"Set default severity\",\"targets\":{\"id\":\"ocsf.severity_id\",\"name\":\"ocsf.severity\"},\"type\":\"schema-category-mapper\"},{\"name\":\"Map userIdentity to ocsf.user.uid\",\"preserve_source\":false,\"sources\":[\"userIdentity.principalId\",\"responseElements.role.roleId\",\"responseElements.user.userId\"],\"target\":\"ocsf.user.uid\",\"type\":\"schema-remapper\"},{\"name\":\"Map userName to ocsf.user.name\",\"preserve_source\":false,\"sources\":[\"requestParameters.userName\",\"responseElements.role.roleName\",\"requestParameters.roleName\",\"responseElements.user.userName\"],\"target\":\"ocsf.user.name\",\"type\":\"schema-remapper\"},{\"name\":\"Map api to ocsf.api\",\"preserve_source\":false,\"sources\":[\"api\"],\"target\":\"ocsf.api\",\"type\":\"schema-remapper\"},{\"name\":\"Map user to ocsf.user\",\"preserve_source\":false,\"sources\":[\"user\"],\"target\":\"ocsf.user\",\"type\":\"schema-remapper\"},{\"name\":\"Map actor to ocsf.actor\",\"preserve_source\":false,\"sources\":[\"actor\"],\"target\":\"ocsf.actor\",\"type\":\"schema-remapper\"},{\"name\":\"Map cloud to ocsf.cloud\",\"preserve_source\":false,\"sources\":[\"cloud\"],\"target\":\"ocsf.cloud\",\"type\":\"schema-remapper\"},{\"name\":\"Map http_request to ocsf.http_request\",\"preserve_source\":false,\"sources\":[\"http_request\"],\"target\":\"ocsf.http_request\",\"type\":\"schema-remapper\"},{\"name\":\"Map metadata to ocsf.metadata\",\"preserve_source\":false,\"sources\":[\"metadata\"],\"target\":\"ocsf.metadata\",\"type\":\"schema-remapper\"},{\"name\":\"Map time to ocsf.time\",\"preserve_source\":false,\"sources\":[\"time\"],\"target\":\"ocsf.time\",\"type\":\"schema-remapper\"},{\"name\":\"Map src_endpoint to ocsf.src_endpoint\",\"preserve_source\":false,\"sources\":[\"src_endpoint\"],\"target\":\"ocsf.src_endpoint\",\"type\":\"schema-remapper\"},{\"name\":\"Map severity to ocsf.severity\",\"preserve_source\":false,\"sources\":[\"severity\"],\"target\":\"ocsf.severity\",\"type\":\"schema-remapper\"},{\"name\":\"Map severity_id to ocsf.severity_id\",\"preserve_source\":false,\"sources\":[\"severity_id\"],\"target\":\"ocsf.severity_id\",\"type\":\"schema-remapper\"}],\"name\":\"Apply OCSF schema for 3001\",\"schema\":{\"class_name\":\"Account Change\",\"class_uid\":3001,\"profiles\":[\"cloud\",\"datetime\"],\"schema_type\":\"ocsf\",\"version\":\"1.5.0\"},\"type\":\"schema-processor\"}],\"tags\":[]}"
36+
},
37+
"queryString": [],
38+
"url": "https://api.datadoghq.com/api/v1/logs/config/pipelines"
39+
},
40+
"response": {
41+
"bodySize": 3843,
42+
"content": {
43+
"mimeType": "application/json",
44+
"size": 3843,
45+
"text": "{\"id\":\"-qkKiJPYTne-113i8XJ_Nw\",\"type\":\"pipeline\",\"name\":\"testSchemaProcessor\",\"is_enabled\":false,\"is_read_only\":false,\"filter\":{\"query\":\"source:python\"},\"processors\":[{\"name\":\"Apply OCSF schema for 3001\",\"is_enabled\":true,\"mappers\":[{\"name\":\"activity_id and activity_name\",\"categories\":[{\"filter\":{\"query\":\"@eventName:(*Create*)\"},\"name\":\"Create\",\"id\":1},{\"filter\":{\"query\":\"@eventName:(ChangePassword OR PasswordUpdated)\"},\"name\":\"Password Change\",\"id\":3},{\"filter\":{\"query\":\"@eventName:(*Attach*)\"},\"name\":\"Attach Policy\",\"id\":7},{\"filter\":{\"query\":\"@eventName:(*Detach* OR *Remove*)\"},\"name\":\"Detach Policy\",\"id\":8},{\"filter\":{\"query\":\"@eventName:(*Delete*)\"},\"name\":\"Delete\",\"id\":6},{\"filter\":{\"query\":\"@eventName:*\"},\"name\":\"Other\",\"id\":99}],\"targets\":{\"name\":\"ocsf.activity_name\",\"id\":\"ocsf.activity_id\"},\"fallback\":{\"values\":{\"ocsf.activity_id\":\"99\",\"ocsf.activity_name\":\"Other\"},\"sources\":{\"ocsf.activity_name\":[\"eventName\"]}},\"type\":\"schema-category-mapper\"},{\"name\":\"status\",\"categories\":[{\"filter\":{\"query\":\"-@errorCode:*\"},\"name\":\"Success\",\"id\":1},{\"filter\":{\"query\":\"@errorCode:*\"},\"name\":\"Failure\",\"id\":2}],\"targets\":{\"name\":\"ocsf.status\",\"id\":\"ocsf.status_id\"},\"fallback\":{\"values\":{},\"sources\":{}},\"type\":\"schema-category-mapper\"},{\"name\":\"Set default severity\",\"categories\":[{\"filter\":{\"query\":\"@eventName:*\"},\"name\":\"Informational\",\"id\":1}],\"targets\":{\"name\":\"ocsf.severity\",\"id\":\"ocsf.severity_id\"},\"fallback\":{\"values\":{},\"sources\":{}},\"type\":\"schema-category-mapper\"},{\"name\":\"Map userIdentity to ocsf.user.uid\",\"sources\":[\"userIdentity.principalId\",\"responseElements.role.roleId\",\"responseElements.user.userId\"],\"target\":\"ocsf.user.uid\",\"preserve_source\":false,\"override_on_conflict\":false,\"type\":\"schema-remapper\"},{\"name\":\"Map userName to ocsf.user.name\",\"sources\":[\"requestParameters.userName\",\"responseElements.role.roleName\",\"requestParameters.roleName\",\"responseElements.user.userName\"],\"target\":\"ocsf.user.name\",\"preserve_source\":false,\"override_on_conflict\":false,\"type\":\"schema-remapper\"},{\"name\":\"Map api to ocsf.api\",\"sources\":[\"api\"],\"target\":\"ocsf.api\",\"preserve_source\":false,\"override_on_conflict\":false,\"type\":\"schema-remapper\"},{\"name\":\"Map user to ocsf.user\",\"sources\":[\"user\"],\"target\":\"ocsf.user\",\"preserve_source\":false,\"override_on_conflict\":false,\"type\":\"schema-remapper\"},{\"name\":\"Map actor to ocsf.actor\",\"sources\":[\"actor\"],\"target\":\"ocsf.actor\",\"preserve_source\":false,\"override_on_conflict\":false,\"type\":\"schema-remapper\"},{\"name\":\"Map cloud to ocsf.cloud\",\"sources\":[\"cloud\"],\"target\":\"ocsf.cloud\",\"preserve_source\":false,\"override_on_conflict\":false,\"type\":\"schema-remapper\"},{\"name\":\"Map http_request to ocsf.http_request\",\"sources\":[\"http_request\"],\"target\":\"ocsf.http_request\",\"preserve_source\":false,\"override_on_conflict\":false,\"type\":\"schema-remapper\"},{\"name\":\"Map metadata to ocsf.metadata\",\"sources\":[\"metadata\"],\"target\":\"ocsf.metadata\",\"preserve_source\":false,\"override_on_conflict\":false,\"type\":\"schema-remapper\"},{\"name\":\"Map time to ocsf.time\",\"sources\":[\"time\"],\"target\":\"ocsf.time\",\"preserve_source\":false,\"override_on_conflict\":false,\"type\":\"schema-remapper\"},{\"name\":\"Map src_endpoint to ocsf.src_endpoint\",\"sources\":[\"src_endpoint\"],\"target\":\"ocsf.src_endpoint\",\"preserve_source\":false,\"override_on_conflict\":false,\"type\":\"schema-remapper\"},{\"name\":\"Map severity to ocsf.severity\",\"sources\":[\"severity\"],\"target\":\"ocsf.severity\",\"preserve_source\":false,\"override_on_conflict\":false,\"type\":\"schema-remapper\"},{\"name\":\"Map severity_id to ocsf.severity_id\",\"sources\":[\"severity_id\"],\"target\":\"ocsf.severity_id\",\"preserve_source\":false,\"override_on_conflict\":false,\"type\":\"schema-remapper\"}],\"schema\":{\"schema_type\":\"ocsf\",\"version\":\"1.5.0\",\"class_name\":\"Account Change\",\"class_uid\":3001,\"extensions\":[],\"profiles\":[\"cloud\",\"datetime\"]},\"type\":\"schema-processor\"}],\"tags\":[]}\n"
46+
},
47+
"cookies": [],
48+
"headers": [
49+
{
50+
"name": "content-type",
51+
"value": "application/json"
52+
}
53+
],
54+
"headersSize": 703,
55+
"httpVersion": "HTTP/1.1",
56+
"redirectURL": "",
57+
"status": 200,
58+
"statusText": "OK"
59+
},
60+
"startedDateTime": "2025-10-22T19:11:58.776Z",
61+
"time": 190
62+
},
63+
{
64+
"_id": "b2bb1a967f84f27ff9e0bbf774a5d296",
65+
"_order": 0,
66+
"cache": {},
67+
"request": {
68+
"bodySize": 0,
69+
"cookies": [],
70+
"headers": [
71+
{
72+
"_fromType": "array",
73+
"name": "accept",
74+
"value": "*/*"
75+
}
76+
],
77+
"headersSize": 533,
78+
"httpVersion": "HTTP/1.1",
79+
"method": "DELETE",
80+
"queryString": [],
81+
"url": "https://api.datadoghq.com/api/v1/logs/config/pipelines/-qkKiJPYTne-113i8XJ_Nw"
82+
},
83+
"response": {
84+
"bodySize": 3,
85+
"content": {
86+
"mimeType": "application/json",
87+
"size": 3,
88+
"text": "{}\n"
89+
},
90+
"cookies": [],
91+
"headers": [
92+
{
93+
"name": "content-type",
94+
"value": "application/json"
95+
}
96+
],
97+
"headersSize": 677,
98+
"httpVersion": "HTTP/1.1",
99+
"redirectURL": "",
100+
"status": 200,
101+
"statusText": "OK"
102+
},
103+
"startedDateTime": "2025-10-22T19:11:58.972Z",
104+
"time": 217
105+
}
106+
],
107+
"pages": [],
108+
"version": "1.2"
109+
}
110+
}

‎cassettes/v1/Logs-Pipelines_3794283453/Create-a-pipeline-with-Schema-Processor-and-preserve_source-true-returns-OK-response_2340010008/frozen.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2025-10-22T19:11:59.195Z"

0 commit comments

Comments
 (0)