{ "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://artifacts.apis.io/grepr/json-schema/grepr-read-job-schema.json", "title": "ReadJob", "description": "Attributes of the Grepr Job", "x-generated": "2026-10-29", "x-method": "derived", "x-generator": "derive-json-schema.py", "x-source": "openapi/grepr-openapi.json#/components/schemas/ReadJob", "properties": { "createdAt": { "description": "Time the job was accepted for creation", "format": "date-time", "type": "string" }, "desiredState": { "default": "RUNNING", "description": "Desired state of the job", "enum": [ "CREATED", "PENDING", "INFRA_UPDATE", "INFRA_UPDATE_WAIT", "VERIFYING", "WAITING", "RUNNING", "STOPPED", "FINISHED", "FAILED", "CANCELLED", "DELETED", "UPDATING", "STARTING", "RESTARTING", "STOPPING", "ROLLING_BACK", "DELETING" ], "type": "string" }, "editedBy": { "description": "User who created this job version, in format 'Full Name (userId)' or 'system' for automated operations", "type": "string" }, "endedAt": { "description": "Time the job was ended", "format": "date-time", "type": "string" }, "execution": { "default": "ASYNCHRONOUS", "description": "Execution mode of the job", "enum": [ "SYNCHRONOUS", "ASYNCHRONOUS" ], "type": "string" }, "greprVersion": { "description": "The version of Grepr used to create the job", "type": "string" }, "id": { "description": "Id of the job", "type": "string" }, "jobGraph": { "$ref": "#/$defs/GreprJobGraph" }, "name": { "description": "Name of the job", "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "organizationId": { "description": "Organization ID of the job", "type": "string" }, "pipelineStatus": { "$ref": "#/$defs/PipelineStatus" }, "processing": { "default": "STREAMING", "description": "Processing method of the job", "enum": [ "BATCH", "STREAMING" ], "type": "string" }, "startedAt": { "description": "Time the job was started", "format": "date-time", "type": "string" }, "state": { "default": "STARTING", "description": "State of the job", "enum": [ "CREATED", "PENDING", "INFRA_UPDATE", "INFRA_UPDATE_WAIT", "VERIFYING", "WAITING", "RUNNING", "STOPPED", "FINISHED", "FAILED", "CANCELLED", "DELETED", "UPDATING", "STARTING", "RESTARTING", "STOPPING", "ROLLING_BACK", "DELETING" ], "type": "string" }, "tags": { "additionalProperties": { "description": "Custom tags attached to the job for ease of search", "type": "string" }, "default": {}, "description": "Custom tags attached to the job for ease of search", "type": "object" }, "teamIds": { "default": [], "description": "The team IDs that this job is associated with.", "items": { "description": "The team IDs that this job is associated with.", "type": "string" }, "type": "array", "uniqueItems": true }, "updatedAt": { "description": "Time the job was last updated", "format": "date-time", "type": "string" }, "version": { "description": "Version of the job", "format": "int64", "type": "integer" } }, "required": [ "createdAt", "desiredState", "execution", "id", "jobGraph", "name", "organizationId", "processing", "state", "tags", "updatedAt", "version" ], "type": "object", "$defs": { "ActionRule": { "description": "Base class of all Action Rules", "oneOf": [ { "$ref": "#/$defs/EventActionRule" }, { "$ref": "#/$defs/JobActionRule" } ], "type": "object" }, "AddToListAttributeAction": { "properties": { "order": { "default": 0, "description": "Action order. Lower is applied first.", "format": "int32", "type": "integer" }, "targetPath": { "description": "The path to the list to add to.", "type": "string" }, "type": { "description": "Add values to a list in event attributes. If the target list is not present, it is created. If the target is present and not a list, it's a no-op.", "enum": [ "attribute-add-action" ], "type": "string" }, "value": { "$ref": "#/$defs/Any" } }, "required": [ "targetPath", "type", "value" ], "type": "object" }, "AgentLogProcessor": { "description": "Processes native agent-harness OTel logs into canonical agent LogEvents.", "properties": { "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Processes native agent-harness OTel logs.", "enum": [ "agent-log-processor" ], "type": "string" } }, "required": [ "name", "type" ], "type": "object", "x-tags": [ "Transforms" ] }, "AgentSessionAnalytics": { "properties": { "analysisJobId": { "type": "string" }, "analysisVersion": { "type": "string" }, "datasetId": { "type": "string" }, "embeddingCapacity": { "format": "int32", "maximum": 64, "minimum": 1, "type": "integer" }, "embeddingDimensions": { "format": "int32", "minimum": 1, "type": "integer" }, "embeddingModel": { "type": "string" }, "end": { "format": "date-time", "type": "string" }, "labelModel": { "type": "string" }, "maxRetries": { "format": "int32", "maximum": 5, "minimum": 0, "type": "integer" }, "maximumNamedGroups": { "format": "int32", "maximum": 100, "minimum": 1, "type": "integer" }, "modelIntegrationId": { "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "query": { "$ref": "#/$defs/EventPredicate" }, "requestTimeout": { "description": "Duration in ISO-8601 format (e.g., 'PT20.345S' for 20.345 seconds). ", "format": "ISO-8601", "type": "string" }, "retainedAnalyticsMemoryLimitBytes": { "format": "int64", "minimum": 1, "type": "integer" }, "sessionCap": { "format": "int32", "maximum": 100000, "minimum": 1, "type": "integer" }, "start": { "format": "date-time", "type": "string" }, "type": { "enum": [ "agent-session-analytics" ], "type": "string" } }, "required": [ "analysisJobId", "analysisVersion", "datasetId", "embeddingModel", "end", "labelModel", "modelIntegrationId", "name", "query", "requestTimeout", "start", "type" ], "type": "object", "x-tags": [ "Transforms" ] }, "AgentSessionEventsIcebergTableSource": { "properties": { "datasetId": { "description": "The ID of the dataset to read data from.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "end": { "description": "End of time interval to query data for.", "format": "date-time", "type": "string" }, "limit": { "default": 2500, "description": "The maximum number of rows to process", "format": "int32", "type": "integer" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offset": { "default": 0, "description": "Offset on the number of rows to process", "format": "int32", "minimum": 0, "type": "integer" }, "query": { "$ref": "#/$defs/query" }, "sortOrder": { "default": "ASCENDING", "description": "The order in which the rows should be sorted by", "enum": [ "ASCENDING", "DESCENDING", "UNSORTED" ], "type": "string" }, "start": { "description": "Start of time interval to query data for.", "format": "date-time", "type": "string" }, "type": { "description": "Reads every event of the agent sessions whose events match the query.", "enum": [ "agent-session-events-iceberg-table-source" ], "type": "string" }, "variables": { "additionalProperties": { "$ref": "#/$defs/Any" }, "default": {}, "description": "Variables that can be used to modify the query while parsed", "type": "object" } }, "required": [ "datasetId", "end", "name", "query", "start", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "AgentSessionsIcebergTableSource": { "properties": { "datasetId": { "description": "The ID of the dataset to read data from.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "end": { "description": "End of time interval to query data for.", "format": "date-time", "type": "string" }, "limit": { "default": 2500, "description": "The maximum number of rows to process", "format": "int32", "type": "integer" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offset": { "default": 0, "description": "Offset on the number of rows to process", "format": "int32", "minimum": 0, "type": "integer" }, "query": { "$ref": "#/$defs/query" }, "sortOrder": { "default": "ASCENDING", "description": "The order in which the rows should be sorted by", "enum": [ "ASCENDING", "DESCENDING", "UNSORTED" ], "type": "string" }, "start": { "description": "Start of time interval to query data for.", "format": "date-time", "type": "string" }, "type": { "description": "Selects grouped agent session summaries from the logs Iceberg table.", "enum": [ "agent-sessions-iceberg-table-source" ], "type": "string" }, "variables": { "additionalProperties": { "$ref": "#/$defs/Any" }, "default": {}, "description": "Variables that can be used to modify the query while parsed", "type": "object" } }, "required": [ "datasetId", "end", "name", "query", "start", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "AgentSessionsSynchronousSink": { "properties": { "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Sink for returning agent session summaries to the caller.", "enum": [ "agent-sessions-sync-sink" ], "type": "string" } }, "required": [ "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "AgentSignalSink": { "description": "Emits a generic pipeline signal for each input log event.", "properties": { "context": { "description": "Optional author-provided context included with every emitted signal.", "maxLength": 4096, "minLength": 0, "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "targetAgentIds": { "default": [], "description": "Agent ids that should investigate every signal emitted by this sink.", "items": { "type": "string" }, "type": "array" }, "type": { "description": "Emits generic pipeline signals to selected agents.", "enum": [ "agent-signal-sink" ], "type": "string" } }, "required": [ "name", "targetAgentIds", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "AgentSpanProcessor": { "description": "Normalizes agent span attributes and projects observed transcript content as canonical agent LogEvents in one pass.", "properties": { "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Processes native agent-harness OTel spans.", "enum": [ "agent-span-processor" ], "type": "string" } }, "required": [ "name", "type" ], "type": "object", "x-tags": [ "Transforms" ] }, "AggType": { "description": "Aggregation function.", "enum": [ "LATEST", "SUM", "AVG", "CUMULATIVE", "CUMULATIVE_UPDOWN", "DEFAULT", "PERCENTILE", "SLOPE", "MAX", "MIN" ], "type": "string" }, "AggregationDecl": { "description": "One aggregation function declaration.", "properties": { "args": { "default": [], "description": "Function arguments. Heterogeneous; validated at pipeline construction. PERCENTILE accepts [rank], [rank, relativeAccuracy], or [rank, relativeAccuracy, maxNumBins].", "items": { "description": "Function arguments. Heterogeneous; validated at pipeline construction. PERCENTILE accepts [rank], [rank, relativeAccuracy], or [rank, relativeAccuracy, maxNumBins].", "type": "object" }, "type": "array" }, "as": { "description": "Output suffix. Omitted = preserve source metric name; in rule conditions the output is addressed as `.val` (at most one as-less aggregation per block).", "type": "string" }, "fn": { "$ref": "#/$defs/AggType" } }, "required": [ "fn" ], "type": "object" }, "AnalyticsOrderBy": { "default": [], "description": "Ordering applied to the analytical results.", "properties": { "direction": { "default": "ASC", "description": "Sort direction.", "enum": [ "ASC", "DESC" ], "type": "string" }, "expression": { "description": "Grepr SQL expression or projection alias to order by. The expression may reference projection aliases.", "maxLength": 4096, "minLength": 0, "type": "string" } }, "required": [ "expression" ], "type": "object" }, "AnalyticsProjection": { "properties": { "alias": { "description": "Optional result column name.", "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "expression": { "description": "Grepr SQL expression to project.", "maxLength": 4096, "minLength": 0, "type": "string" } }, "required": [ "expression" ], "type": "object" }, "AnalyticsQuery": { "description": "Complete analytical query to execute.", "oneOf": [ { "$ref": "#/$defs/StructuredAnalyticsQuery" } ], "properties": { "type": { "type": "string" } }, "required": [ "type" ], "type": "object" }, "AnalyticsTableBinding": { "description": "Dataset tables available to the query under logical aliases.", "properties": { "alias": { "description": "Logical table name used by the analytical query.", "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "datasetId": { "description": "ID of the dataset that owns the table.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "table": { "description": "Dataset-owned table exposed under the logical alias.", "enum": [ "logs_raw", "logs_dedup", "logs_pattern_lookup", "metrics_raw", "metricdata_raw", "spans_raw", "spans_dedup" ], "type": "string" } }, "required": [ "alias", "datasetId", "table" ], "type": "object" }, "AnalyticsTimeWindow": { "description": "Optional time window that buckets the results. Adds leading 'window_start' and 'window_end' result columns, which are always grouped.", "properties": { "kind": { "description": "Window layout: TUMBLING windows do not overlap; SLIDING windows start every 'slide'.", "enum": [ "TUMBLING", "SLIDING" ], "type": "string" }, "size": { "description": "Window length as an ISO-8601 duration, a whole number of milliseconds.", "format": "ISO-8601", "type": "string" }, "slide": { "description": "Distance between consecutive SLIDING window starts as an ISO-8601 duration, a whole number of milliseconds dividing 'size'. Absent for TUMBLING windows.", "format": "ISO-8601", "type": "string" }, "timestamp": { "default": "EVENT_TIMESTAMP", "description": "Which timestamp the windows bucket by.", "enum": [ "EVENT_TIMESTAMP", "RECEIVED_TIMESTAMP" ], "type": "string" } }, "required": [ "kind", "size" ], "type": "object" }, "AndEventPredicate": { "properties": { "queries": { "default": [], "description": "List of predicates that must all match for this predicate to match.", "items": { "$ref": "#/$defs/EventPredicate" }, "maxItems": 2147483647, "minItems": 1, "title": "Child predicates", "type": "array" }, "type": { "description": "A predicate that matches when every child predicate matches.", "enum": [ "and-predicate" ], "type": "string" } }, "required": [ "queries", "type" ], "type": "object" }, "AnomalyActions": { "description": "Actions applied when an object is flagged anomalous.", "properties": { "objectMetricsPassthrough": { "$ref": "#/$defs/ObjectMetricsPassthrough" } }, "type": "object" }, "AnomalyConfig": { "description": "One anomaly rule.", "properties": { "anomalyDuration": { "description": "START..END lifecycle window after the last triggering datapoint.", "format": "ISO-8601", "type": "string" }, "condition": { "description": "Scalar SQL condition that fires the rule.", "type": "string" }, "from": { "additionalProperties": { "$ref": "#/$defs/MetricAggregation" }, "default": {}, "description": "Alias → aggregation declaration.", "type": "object" }, "joinOn": { "default": [], "description": "Join expressions linking aliases (Calcite-parsed SQL).", "items": { "description": "Join expressions linking aliases (Calcite-parsed SQL).", "type": "string" }, "type": "array" }, "name": { "description": "Unique rule name.", "type": "string" } }, "required": [ "anomalyDuration", "condition", "from", "name" ], "type": "object" }, "Any": { "description": "A value that can be a primitive (String or number), a list, or a map." }, "AthenaAgentSessionsSource": { "properties": { "datasetId": { "description": "The ID of the dataset to read data from.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "end": { "description": "End of time interval to query data for.", "format": "date-time", "type": "string" }, "limit": { "default": 2500, "description": "The maximum number of rows to process", "format": "int32", "type": "integer" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offset": { "default": 0, "description": "Offset on the number of rows to process", "format": "int32", "minimum": 0, "type": "integer" }, "query": { "$ref": "#/$defs/query" }, "sortOrder": { "default": "ASCENDING", "description": "The order in which the rows should be sorted by", "enum": [ "ASCENDING", "DESCENDING", "UNSORTED" ], "type": "string" }, "start": { "description": "Start of time interval to query data for.", "format": "date-time", "type": "string" }, "type": { "description": "Returns grouped agent session summaries through Athena.", "enum": [ "athena-agent-sessions-source" ], "type": "string" }, "variables": { "additionalProperties": { "$ref": "#/$defs/Any" }, "default": {}, "description": "Variables that can be used to modify the query while parsed", "type": "object" } }, "required": [ "datasetId", "end", "name", "query", "start", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "AthenaAnalyticsSource": { "properties": { "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "query": { "$ref": "#/$defs/AnalyticsQuery" }, "scanBudgetBytes": { "default": 107374182400, "description": "Maximum number of bytes this query may scan.", "format": "int64", "minimum": 1, "type": "integer" }, "tables": { "description": "Dataset tables available to the query under logical aliases.", "items": { "$ref": "#/$defs/AnalyticsTableBinding" }, "maxItems": 2147483647, "minItems": 1, "type": "array" }, "type": { "description": "Executes an analytical query against dataset tables using Athena.", "enum": [ "athena-analytics-source" ], "type": "string" } }, "required": [ "name", "query", "tables", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "AttributeMask": { "description": "Masks to apply to attribute values. Each entry names an attribute path (as a list of segments) and the masks to apply to the value at that path. Only string values at the exact path are masked; missing or non-string attributes are skipped. Paths must be unique. The same matching rules as messageMasks apply.", "properties": { "masks": { "additionalProperties": { "$ref": "#/$defs/Mask" }, "description": "Masks to apply to the value at this path, as a map of label to mask. The same matching rules as messageMasks apply.", "type": "object" }, "path": { "description": "Attribute path to mask, as a list of segments.", "items": { "description": "Attribute path to mask, as a list of segments.", "type": "string" }, "maxItems": 2147483647, "minItems": 1, "type": "array" } }, "required": [ "masks", "path" ], "type": "object" }, "AttributeRemappingRule": { "description": "List of attribute-to-attribute remapping rules. Each rule moves the value from a source attribute path to a target attribute path, removing the source unless the rule's preserveSource flag is set. An optional predicate filter controls when each rule is applied.", "properties": { "predicate": { "$ref": "#/$defs/EventPredicate" }, "preserveSource": { "default": false, "description": "When true, the source attribute is preserved (copied) instead of being removed (moved). Defaults to false (source is removed after remapping).", "type": "boolean" }, "source": { "description": "Source attribute path: a dotted string (\"resource.service\" is resource → service), or an array of literal keys ([\"http\", \"user.agent\"]).", "oneOf": [ { "type": "string" }, { "items": { "type": "string" }, "type": "array" } ] }, "target": { "description": "Target attribute path: a dotted string, or an array of literal keys.", "oneOf": [ { "type": "string" }, { "items": { "type": "string" }, "type": "array" } ] } }, "required": [ "source", "target" ], "type": "object" }, "AttributesMergeStrategy": { "default": { "type": "exact" }, "description": "Default merge strategy to use for merging leaf-valued attributes. This is used when no specific merge strategy is defined for an attribute path.", "oneOf": [ { "$ref": "#/$defs/ExactAttributesMergeStrategy" }, { "$ref": "#/$defs/SamplingAttributesMergeStrategy" }, { "$ref": "#/$defs/PreserveAllAttributesMergeStrategy" }, { "$ref": "#/$defs/SumAttributesMergeStrategy" }, { "$ref": "#/$defs/MinAttributesMergeStrategy" }, { "$ref": "#/$defs/MaxAttributesMergeStrategy" }, { "$ref": "#/$defs/AverageAttributesMergeStrategy" }, { "$ref": "#/$defs/CompositeAttributesMergeStrategy" }, { "$ref": "#/$defs/IgnoreAttributesMergeStrategy" } ], "title": "Default attributes merge strategy", "type": "object" }, "AttributesMergeStrategyEntry": { "description": "List of attribute paths and their corresponding merge strategies. If no strategy is defined for a path, the terminal merge strategy will be used.", "properties": { "attributePath": { "description": "The attribute path, represented as an array of strings (e.g., [\"user\", \"id\"]).", "items": { "description": "The attribute path, represented as an array of strings (e.g., [\"user\", \"id\"]).", "type": "string" }, "type": "array" }, "strategy": { "$ref": "#/$defs/AttributesMergeStrategy" } }, "required": [ "attributePath", "strategy" ], "title": "Attributes merge strategy entries", "type": "object" }, "AverageAttributesMergeStrategy": { "properties": { "type": { "description": "AverageAttributesMergeStrategy: Computes the average of numeric attribute values.", "enum": [ "avg" ], "type": "string" } }, "required": [ "type" ], "type": "object" }, "BackfillJobAction": { "properties": { "backfillQuery": { "$ref": "#/$defs/backfillQuery" }, "backfillTimespan": { "description": "The timespan for which to backfill data. This field is not required. If you do not specify it, you need to specify a duration in the trigger. For TraceSamplingTriggers, this can be specified in the traceDuration field. For others, you will need to specify a duration in the variables, e.g. __duration:PT1H", "format": "ISO-8601", "type": "string" }, "datasetId": { "description": "The ID of the dataset to read data from", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "jobTags": { "additionalProperties": { "description": "The tags added to the backfill job, for ease of search.", "type": "string" }, "description": "The tags added to the backfill job, for ease of search.", "type": "object" }, "limit": { "default": 500000, "description": "Maximum number of logs to backfill. Default and max is 500,000.", "format": "int32", "maximum": 500000, "type": "integer" }, "name": { "description": "The name of the backfill job.", "type": "string" }, "order": { "description": "Action order. Lower is applied first.", "format": "int32", "type": "integer" }, "sinkOperations": { "default": [], "description": "Specifies the sinks that should be used for the backfill job.", "items": { "$ref": "#/$defs/Operation" }, "type": "array", "uniqueItems": true }, "type": { "description": "Backfills data from the raw logs to the configured sink. This action runs an asynch batch job to backfill data from the raw logs table to the configured sink. The back-filled data is also added to the processed logs table to ensure that the same log is not backfilled twice leading to duplicates. The context on what needs to be backfilled is provided by the 'backfillQuery' which will filter logs that will be backfilled.", "enum": [ "backfill-job-action" ], "type": "string" } }, "required": [ "backfillQuery", "datasetId", "jobTags", "name", "sinkOperations", "type" ], "type": "object", "x-tags": [ "Job Actions" ] }, "CloudTrailLogsFileSource": { "properties": { "accountIds": { "default": [], "description": "The list of account IDs from which to read logs.", "items": { "description": "The list of account IDs from which to read logs.", "type": "string" }, "maxItems": 2147483647, "minItems": 1, "type": "array" }, "fileReadingStrategy": { "$ref": "#/$defs/FileReadingStrategy" }, "format": { "$ref": "#/$defs/JsonFileFormat" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "pathPrefix": { "default": "", "description": "The s3 path under the provided bucket to monitor. Optional.In the case of CloudTrail logs, this is the path to the AWSLogs/ directory.", "type": "string" }, "regions": { "default": [ "US_EAST_1", "US_EAST_2", "US_WEST_1", "US_WEST_2", "AF_SOUTH_1", "AP_EAST_1", "AP_SOUTH_1", "AP_SOUTH_2", "AP_SOUTHEAST_1", "AP_SOUTHEAST_2", "AP_SOUTHEAST_3", "AP_SOUTHEAST_4", "AP_NORTHEAST_1", "AP_NORTHEAST_2", "AP_NORTHEAST_3", "CA_CENTRAL_1", "CN_NORTH_1", "CN_NORTHWEST_1", "EU_CENTRAL_1", "EU_CENTRAL_2", "EU_WEST_1", "EU_WEST_2", "EU_WEST_3", "EU_NORTH_1", "EU_SOUTH_1", "EU_SOUTH_2", "IL_CENTRAL_1", "ME_CENTRAL_1", "ME_SOUTH_1", "SA_EAST_1" ], "description": "The list of regions from which to read logs from. If empty or null, reads logs from all regions.", "items": { "description": "The list of regions from which to read logs from. If empty or null, reads logs from all regions.", "enum": [ "US_EAST_1", "US_EAST_2", "US_WEST_1", "US_WEST_2", "AF_SOUTH_1", "AP_EAST_1", "AP_SOUTH_1", "AP_SOUTH_2", "AP_SOUTHEAST_1", "AP_SOUTHEAST_2", "AP_SOUTHEAST_3", "AP_SOUTHEAST_4", "AP_NORTHEAST_1", "AP_NORTHEAST_2", "AP_NORTHEAST_3", "CA_CENTRAL_1", "CN_NORTH_1", "CN_NORTHWEST_1", "EU_CENTRAL_1", "EU_CENTRAL_2", "EU_WEST_1", "EU_WEST_2", "EU_WEST_3", "EU_NORTH_1", "EU_SOUTH_1", "EU_SOUTH_2", "IL_CENTRAL_1", "ME_CENTRAL_1", "ME_SOUTH_1", "SA_EAST_1" ], "type": "string" }, "maxItems": 2147483647, "minItems": 1, "type": "array" }, "s3IntegrationId": { "description": "Integration ID for the S3 bucket where Grepr will be reading data. This corresponds to the 's3-data-warehouse' integration type.", "type": "string" }, "streamingPollInterval": { "default": "PT5S", "description": "The interval at which Grepr will check for new files in the S3 bucket. This is only applicable in streaming mode.", "format": "ISO-8601", "type": "string" }, "type": { "description": "Reads logs from an S3 bucket at a CloudTrail path. Only reads logs in folders at or after the specified start time. The path prefix is optional. Each record will need to be mapped to the Grepr data model before being usable.", "enum": [ "cloudtrail-file-source" ], "type": "string" } }, "required": [ "accountIds", "name", "s3IntegrationId", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "CohortOutputDecl": { "description": "One cohort-output entry.", "properties": { "aggregations": { "default": [], "description": "Aggregations to emit. Null = [{ fn: DEFAULT }].", "items": { "$ref": "#/$defs/AggregationDecl" }, "type": "array" }, "selectors": { "$ref": "#/$defs/FilterPrimitive" }, "spaceAggregation": { "default": true, "description": "When false, emit per-series time-only aggregation (no space/cohort collapse); aggregations apply as time-window folds. Default true keeps cohort aggregation.", "type": "boolean" } }, "type": "object" }, "CohortsConfig": { "description": "Cohort-identity + space-aggregation configuration.", "properties": { "identifyingAttributes": { "default": [], "description": "Level-prefixed attribute keys that group objects into cohorts.", "items": { "description": "Level-prefixed attribute keys that group objects into cohorts.", "type": "string" }, "type": "array", "uniqueItems": true }, "metadataAttributes": { "default": [], "description": "Level-prefixed attribute keys describing cohorts.", "items": { "description": "Level-prefixed attribute keys describing cohorts.", "type": "string" }, "type": "array", "uniqueItems": true }, "numShardBits": { "default": 0, "description": "Parallelism multiplier for cohort outputs (anomaly rules ignore this). Splits each cohort across 2^n CohortCalc instances by the low n bits of tsIdLo, trading parallelism for partial per-shard aggregation. 0 = one instance per cohort.", "format": "int32", "maximum": 15, "minimum": 0, "type": "integer" }, "outputs": { "default": [], "description": "Ordered cohort-output entries (first-match-wins).", "items": { "$ref": "#/$defs/CohortOutputDecl" }, "type": "array" } }, "type": "object" }, "CompositeAttributesMergeStrategy": { "properties": { "strategies": { "default": [], "items": { "$ref": "#/$defs/AttributesMergeStrategy" }, "type": "array" }, "type": { "description": "CompositeAttributesMergeStrategy: Applies multiple merge strategies to produce multiple output attributes with suffixed keys.", "enum": [ "composite" ], "type": "string" } }, "required": [ "strategies", "type" ], "type": "object" }, "Condition": { "description": "The action rules that get applied when the condition is triggered.", "properties": { "actionRules": { "default": [], "items": { "$ref": "#/$defs/ActionRule" }, "type": "array", "uniqueItems": true } }, "required": [ "actionRules" ], "type": "object" }, "ConstantSampling": { "properties": { "type": { "description": "A sampler that reduces with a maximum limit.", "enum": [ "constant-sampling" ], "type": "string" } }, "required": [ "type" ], "type": "object" }, "CriticalPathAnalysisConfig": { "description": "Opt-in critical-path analysis settings. Computed during trace assembly; requires tail sampling. The maxSpans and sampleRate levers bound the per-trace cost.", "properties": { "maxSpans": { "description": "Cap on how many spans are analyzed per trace; the critical chain is kept first. Null means no cap beyond the global per-trace assembly limit.", "format": "int32", "minimum": 1, "title": "Max spans analyzed", "type": "integer" }, "sampleRate": { "default": 1.0, "description": "Fraction of assembled traces to analyze, in [0.0, 1.0], selected deterministically by trace id. Defaults to 1.0 (analyze every trace).", "exclusiveMaximum": false, "exclusiveMinimum": false, "format": "double", "maximum": 1.0, "minimum": 0.0, "title": "Analysis sample rate", "type": "number" } }, "title": "Critical Path Analysis", "type": "object" }, "DatadogLogAgentSource": { "properties": { "hostEnrichmentEnabled": { "default": false, "type": "boolean" }, "integrationId": { "description": "The integration id for the observability vendor.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offsetResetStrategy": { "default": "LATEST", "description": "Strategy for resetting Kafka consumer offset when no committed offset exists or has expired. EARLIEST reads from oldest available offset (prevents data loss on restart after retention period). LATEST skips to newest offset (current behavior).", "enum": [ "EARLIEST", "LATEST", "NONE" ], "type": "string" }, "type": { "description": "Reads log events from Grepr's Datadog collection agent. This is used to pre-process logs before being sent to Datadog.", "enum": [ "datadog-log-agent-source" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "DatadogLogCloudSource": { "properties": { "filterQuery": { "default": "", "description": "The Datadog query filter to use when reading logs from Datadog. This is concatenated with the one from the integration.", "maxLength": 1024, "minLength": 0, "type": "string" }, "integrationId": { "description": "The Datadog integration id.", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Pulls log events from the Datadog cloud service for processing using a specified query.", "enum": [ "datadog-log-cloud-source" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "DatadogLogSink": { "properties": { "additionalTags": { "default": [], "description": "Additional tags to add to the logs when writing to Datadog. Gets combined with the integration's additionalTags.", "items": { "type": "string" }, "type": "array" }, "browserLogGroupByAttributes": { "default": [], "description": "Group by attributes to use when writing logs to Datadog browser intake.Defaults to [\"http.useragent\", \"network.client.ip\"].", "items": { "type": "string" }, "type": "array" }, "hostFieldNames": { "default": [], "description": "Top-level JSON field names to write the host to. Datadog only maps one of these onto the log's host if the name is in the destination organization's \"Preprocessing for JSON logs -> Host attributes\" list, so an organization that has removed the default entry needs this overridden. Defaults to [\"hostname\"].", "items": { "type": "string" }, "type": "array" }, "integrationId": { "description": "The Datadog integration id.", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Writes processed events to Datadog.", "enum": [ "datadog-log-sink" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "DatadogMetricsSink": { "properties": { "additionalTags": { "default": [], "description": "Additional tags to add to the logs when writing to Datadog. Gets combined with the integration's additionalTags.", "items": { "type": "string" }, "type": "array" }, "integrationId": { "description": "The Datadog integration id.", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Writes processed metrics to Datadog.", "enum": [ "datadog-metrics-sink" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "DatadogQueryPredicate": { "properties": { "query": { "default": "", "description": "The datadog query used by the predicate. See https://docs.datadoghq.com/tracing/trace_explorer/query_syntax", "type": "string" }, "type": { "description": "A predicate that checks if an event matches a datadog query.", "enum": [ "datadog-query" ], "type": "string" } }, "required": [ "query", "type" ], "type": "object" }, "DatadogStatsSink": { "description": "Forwards Datadog stats payloads to the Datadog platform for accurate RED metrics. Stats are pre-computed by the Datadog agent and bypass all processing.", "properties": { "additionalTags": { "additionalProperties": { "description": "Additional tags to add to stats when writing to Datadog. Gets combined with the integration's and global additionalTags.", "type": "string" }, "default": {}, "description": "Additional tags to add to stats when writing to Datadog. Gets combined with the integration's and global additionalTags.", "type": "object" }, "integrationId": { "description": "Integration ID for Datadog connection", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Writes Datadog stats payloads to Datadog for accurate RED metrics.", "enum": [ "datadog-stats-sink" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "DatadogTraceAgentSource": { "properties": { "discardStats": { "default": false, "description": "Whether stats should be discarded instead of being forwarded to Datadog", "type": "boolean" }, "integrationId": { "description": "The integration id for the observability vendor.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offsetResetStrategy": { "default": "LATEST", "description": "Strategy for resetting Kafka consumer offset when no committed offset exists or has expired. EARLIEST reads from oldest available offset (prevents data loss on restart after retention period). LATEST skips to newest offset (current behavior).", "enum": [ "EARLIEST", "LATEST", "NONE" ], "type": "string" }, "type": { "description": "Reads dd_trace protos from Datadog Agent. This is used to process traces from Datadog.", "enum": [ "datadog-trace-agent-source" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "DatadogTraceSink": { "description": "Converts CompleteSpan objects to Datadog's native trace format and sends them to the Datadog platform.", "properties": { "additionalAttributes": { "additionalProperties": { "description": "Additional attributes to add to traces when writing to Datadog. Gets combined with the integration's additionalAttributes.", "type": "string" }, "default": {}, "description": "Additional attributes to add to traces when writing to Datadog. Gets combined with the integration's additionalAttributes.", "type": "object" }, "integrationId": { "description": "Integration ID for Datadog connection", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Writes processed traces to Datadog in native format.", "enum": [ "datadog-trace-sink" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "DiscardingSink": { "description": "Sink that discards all of its input.", "properties": { "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Sink that discards all of its input.", "enum": [ "discarding-sink" ], "type": "string" } }, "required": [ "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "DropRule": { "description": "Drops matching series outright.", "properties": { "attributeFilters": { "additionalProperties": { "description": "Level-prefixed attribute key → glob pattern. All entries must match.", "type": "string" }, "default": {}, "description": "Level-prefixed attribute key → glob pattern. All entries must match.", "type": "object" }, "metricName": { "$ref": "#/$defs/MetricNameFilter" } }, "type": "object" }, "ErrorDetails": { "properties": { "exception": { "type": "string" }, "message": { "type": "string" } }, "type": "object" }, "EventAction": { "description": "Base class of all Event Actions", "oneOf": [ { "$ref": "#/$defs/TagAction" }, { "$ref": "#/$defs/RemoveKeyAttributeAction" }, { "$ref": "#/$defs/MergeMapAttributeAction" }, { "$ref": "#/$defs/AddToListAttributeAction" } ], "properties": { "order": { "format": "int32", "type": "integer" } }, "type": "object" }, "EventActionRule": { "properties": { "actionPredicate": { "$ref": "#/$defs/EventPredicate" }, "actions": { "default": [], "description": "Actions to take on a matching event.", "items": { "$ref": "#/$defs/EventAction" }, "type": "array", "uniqueItems": true }, "type": { "description": "This takes event actions on events that match the actionPredicate when this rule is triggered.", "enum": [ "event-rule" ], "type": "string" } }, "required": [ "actionPredicate", "actions", "type" ], "type": "object" }, "EventDedupIcebergTableSink": { "properties": { "datasetId": { "description": "The id of the dataset to write to", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Writes event IDs to an Iceberg table to keep track of which events have been sent to a particular sink.", "enum": [ "event-dedup-iceberg-table-sink" ], "type": "string" }, "vendorSinkId": { "pattern": "[a-z0-9]{1,13}", "type": "string" } }, "required": [ "datasetId", "name", "type", "vendorSinkId" ], "type": "object", "x-tags": [ "Sinks" ] }, "EventPredicate": { "description": "Predicate applied to rows before analytical aggregation.", "oneOf": [ { "$ref": "#/$defs/AndEventPredicate" }, { "$ref": "#/$defs/DatadogQueryPredicate" }, { "$ref": "#/$defs/MetricEventPredicate" }, { "$ref": "#/$defs/NewRelicQueryPredicate" }, { "$ref": "#/$defs/NrqlQueryPredicate" } ], "properties": { "query": { "type": "string" }, "type": { "type": "string" } }, "required": [ "type" ], "type": "object" }, "EventPredicateTrigger": { "properties": { "conditionIds": { "default": [], "description": "The ids for the conditions that are activated by this trigger.", "items": { "description": "The ids for the conditions that are activated by this trigger.", "type": "string" }, "type": "array", "uniqueItems": true }, "duration": { "description": "How long the conditions this trigger activates stay active. A condition expires at the trigger's time plus this duration. For an event-predicate trigger, that time is the processing time at which it matches an event. For an external-source trigger, it's the notification's timestamp. A firing that carries the same variables, with the same values, as the firing that started an active condition doesn't start another one, whatever its __timestamp: the active condition keeps the later of the two expiries, and its job actions don't run again. An event-predicate trigger adds __severity to each firing from a log event, so a firing from an event of another severity starts another condition, which runs the job actions again. The rule engine applies a condition's event actions only to events whose timestamp is before the expiry. Once processing time passes a condition's expiry, a cleanup retires it. The cleanup runs while the rule engine handles events and notifications, at most once a second, so until it runs, a late event stamped before the expiry still gets the condition's event actions. A retired condition applies to no event, whatever its timestamp, and the trigger firing after that starts a new condition, which runs its job actions again.", "format": "ISO-8601", "type": "string" }, "predicate": { "$ref": "#/$defs/EventPredicate" }, "type": { "description": "This is triggered by an event matching the given predicate.", "enum": [ "event-predicate" ], "type": "string" }, "variables": { "additionalProperties": { "description": "Map from variable names to paths for variables to extract from a matching event. If starting with '@', the path indicates an attribute. Otherwise, it's a tag. The variable names must start with '__' and be unique. Note that __timestamp (and __severity for logs) variable is automatically extracted from the respective top level fields of the matching event.", "type": "string" }, "default": {}, "description": "Map from variable names to paths for variables to extract from a matching event. If starting with '@', the path indicates an attribute. Otherwise, it's a tag. The variable names must start with '__' and be unique. Note that __timestamp (and __severity for logs) variable is automatically extracted from the respective top level fields of the matching event.", "type": "object" } }, "required": [ "conditionIds", "duration", "predicate", "type", "variables" ], "type": "object", "x-tags": [ "Triggers" ] }, "ExactAttributesMergeStrategy": { "properties": { "type": { "description": "ExactAttributesMergeStrategy: If target is empty, incoming value is used. If target is already wildcard, it remains wildcard. If target and incoming are deeply equal, target remains unchanged. If target and incoming are different, target becomes the WILDCARD.", "enum": [ "exact" ], "type": "string" } }, "required": [ "type" ], "type": "object" }, "ExternalSourceTrigger": { "properties": { "conditionIds": { "default": [], "description": "The ids for the conditions that are activated by this trigger.", "items": { "description": "The ids for the conditions that are activated by this trigger.", "type": "string" }, "type": "array", "uniqueItems": true }, "duration": { "description": "How long the conditions this trigger activates stay active. A condition expires at the trigger's time plus this duration. For an event-predicate trigger, that time is the processing time at which it matches an event. For an external-source trigger, it's the notification's timestamp. A firing that carries the same variables, with the same values, as the firing that started an active condition doesn't start another one, whatever its __timestamp: the active condition keeps the later of the two expiries, and its job actions don't run again. An event-predicate trigger adds __severity to each firing from a log event, so a firing from an event of another severity starts another condition, which runs the job actions again. The rule engine applies a condition's event actions only to events whose timestamp is before the expiry. Once processing time passes a condition's expiry, a cleanup retires it. The cleanup runs while the rule engine handles events and notifications, at most once a second, so until it runs, a late event stamped before the expiry still gets the condition's event actions. A retired condition applies to no event, whatever its timestamp, and the trigger firing after that starts a new condition, which runs its job actions again.", "format": "ISO-8601", "type": "string" }, "type": { "description": "This trigger is activated by an external source, for eg: an API call from an observability tool.", "enum": [ "event-predicate" ], "type": "string" } }, "required": [ "conditionIds", "duration", "type" ], "type": "object", "x-tags": [ "Triggers" ] }, "FileFormat": { "description": "Describes the file format to read from.", "properties": { "mapper": { "$ref": "#/$defs/LogEventMapper" }, "type": { "type": "string" } }, "required": [ "type" ], "type": "object" }, "FileReadingStrategy": { "default": "latest", "description": "The file reading strategy will determine how files are enumerated. Timestamp reading strategy will only read files created after the specified timestamp. Latest reading strategy will only read files created after the job start time.", "properties": { "type": { "type": "string" } }, "required": [ "type" ], "type": "object" }, "FilterPrimitive": { "description": "Combined metric-name + attribute-value filter.", "properties": { "attributeFilters": { "additionalProperties": { "description": "Level-prefixed attribute key → glob pattern. All entries must match.", "type": "string" }, "default": {}, "description": "Level-prefixed attribute key → glob pattern. All entries must match.", "type": "object" }, "metricName": { "$ref": "#/$defs/MetricNameFilter" } }, "type": "object" }, "GreprJobGraph": { "properties": { "edges": { "default": [], "description": "Edges that connect the vertices of the Grepr job graph", "items": { "description": "Edges that connect the vertices of the Grepr job graph", "type": "string" }, "type": "array" }, "vertices": { "default": [], "description": "Operations that make up the vertices of the Grepr job graph", "items": { "$ref": "#/$defs/Operation" }, "type": "array" } }, "required": [ "edges", "vertices" ], "type": "object" }, "GreprMetricsSource": { "properties": { "additionalTags": { "additionalProperties": { "default": {}, "description": "Additional tags to add to the metrics while loading.", "items": { "default": "{}", "description": "Additional tags to add to the metrics while loading.", "type": "string" }, "type": "array", "uniqueItems": true }, "default": {}, "description": "Additional tags to add to the metrics while loading.", "type": "object" }, "metrics": { "default": [], "description": "The list of metrics to load. Will load all possible metrics if nothing is specified", "items": { "enum": [ "table_totalBytes", "job_operator_numRecordsIn", "job_operator_numRecordsOut", "job_operator_numRecordsInPerSecond", "job_operator_numRecordsOutPerSecond", "job_operator_numRecordsSend" ], "type": "string" }, "type": "array", "uniqueItems": true }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Reads metric events from Grepr for processing.", "enum": [ "grepr-metrics-source" ], "type": "string" } }, "required": [ "name", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "GreprPipeLogSink": { "description": "Writes log events into a Grepr pipe integration.", "properties": { "integrationId": { "description": "Destination Grepr pipe integration in the pipeline's organization.", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "enum": [ "grepr-pipe-log-sink" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "GreprPipeLogSource": { "properties": { "integrationId": { "description": "The integration id for the observability vendor.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offsetResetStrategy": { "default": "LATEST", "description": "Strategy for resetting Kafka consumer offset when no committed offset exists or has expired. EARLIEST reads from oldest available offset (prevents data loss on restart after retention period). LATEST skips to newest offset (current behavior).", "enum": [ "EARLIEST", "LATEST", "NONE" ], "type": "string" }, "type": { "description": "Reads log events that other pipelines write into a Grepr pipe.", "enum": [ "grepr-pipe-log-source" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "GreprRawLogsSource": { "properties": { "datasetId": { "description": "The ID of the dataset to read data from.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "end": { "description": "End of time interval to query data for.", "format": "date-time", "type": "string" }, "limit": { "default": 2500, "description": "The maximum number of rows to process", "format": "int32", "type": "integer" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offset": { "default": 0, "description": "Offset on the number of rows to process", "format": "int32", "minimum": 0, "type": "integer" }, "query": { "$ref": "#/$defs/query" }, "sortOrder": { "default": "ASCENDING", "description": "The order in which the rows should be sorted by", "enum": [ "ASCENDING", "DESCENDING", "UNSORTED" ], "type": "string" }, "start": { "description": "Start of time interval to query data for.", "format": "date-time", "type": "string" }, "type": { "description": "Reads raw log events using Grepr's internal query system from an Iceberg Table without pattern enrichment.", "enum": [ "grepr-raw-log-source" ], "type": "string" }, "variables": { "additionalProperties": { "$ref": "#/$defs/Any" }, "default": {}, "description": "Variables that can be used to modify the query while parsed", "type": "object" } }, "required": [ "datasetId", "end", "name", "query", "start", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "GreprRawSpanSource": { "properties": { "datasetId": { "description": "The ID of the dataset to read data from.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "end": { "description": "End of time interval to query data for.", "format": "date-time", "type": "string" }, "limit": { "default": 2500, "description": "The maximum number of rows to process", "format": "int32", "type": "integer" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offset": { "default": 0, "description": "Offset on the number of rows to process", "format": "int32", "minimum": 0, "type": "integer" }, "query": { "$ref": "#/$defs/query" }, "sortOrder": { "default": "ASCENDING", "description": "The order in which the rows should be sorted by", "enum": [ "ASCENDING", "DESCENDING", "UNSORTED" ], "type": "string" }, "start": { "description": "Start of time interval to query data for.", "format": "date-time", "type": "string" }, "type": { "description": "Reads spans using Grepr's internal query system out of an Iceberg Table for processing.", "enum": [ "grepr-raw-span-source" ], "type": "string" }, "variables": { "additionalProperties": { "$ref": "#/$defs/Any" }, "default": {}, "description": "Variables that can be used to modify the query while parsed", "type": "object" } }, "required": [ "datasetId", "end", "name", "query", "start", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "GreprReducerLogSource": { "properties": { "datasetId": { "description": "The ID of the dataset to read data from.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "end": { "description": "End of time interval to query data for.", "format": "date-time", "type": "string" }, "limit": { "default": 2500, "description": "The maximum number of rows to process", "format": "int32", "type": "integer" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offset": { "default": 0, "description": "Offset on the number of rows to process", "format": "int32", "minimum": 0, "type": "integer" }, "processedLogsTableName": { "description": "The name of the table containing processed logs.", "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "query": { "$ref": "#/$defs/query" }, "reductionInterval": { "default": "PT2M", "description": "The interval used by the Log Reducer for the query. Uses ISO 8601 format for intervals.", "format": "ISO-8601", "type": "string" }, "sortOrder": { "default": "ASCENDING", "description": "The order in which the rows should be sorted by", "enum": [ "ASCENDING", "DESCENDING", "UNSORTED" ], "type": "string" }, "start": { "description": "Start of time interval to query data for.", "format": "date-time", "type": "string" }, "type": { "description": "Reads events using Grepr's internal query system out of an Iceberg Table for processing.", "enum": [ "grepr-reducer-log-source" ], "type": "string" }, "variables": { "additionalProperties": { "$ref": "#/$defs/Any" }, "default": {}, "description": "Variables that can be used to modify the query while parsed", "type": "object" } }, "required": [ "datasetId", "end", "name", "query", "reductionInterval", "start", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "GreprUploadedLogFileSource": { "properties": { "format": { "$ref": "#/$defs/FileFormat" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Reads log files uploaded to Grepr using environment credentials. Intended for file uploads in draft mode.", "enum": [ "grepr-uploaded-log-file-source" ], "type": "string" }, "uploadId": { "description": "Unique identifier for the upload. The full S3 path will be constructed as uploaded_files/{organizationId}/{uploadId} to ensure customers can only access their own uploads. Use the uploadId returned by the file upload endpoint.", "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}", "type": "string" } }, "required": [ "format", "name", "type", "uploadId" ], "type": "object", "x-tags": [ "Sources" ] }, "GreprVendorSource": { "properties": { "integrationId": { "description": "The integration id for the observability vendor.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" } }, "required": [ "integrationId", "name" ], "type": "object" }, "GrokParser": { "properties": { "extractAttribute": { "description": "Optional attribute to extract. Does nothing if it does not refer to a string attribute. A dotted string, or an array of literal keys.", "oneOf": [ { "type": "string" }, { "items": { "type": "string" }, "type": "array" } ] }, "grokHelperRules": { "default": [], "items": { "type": "string" }, "type": "array" }, "grokParsingRules": { "default": [], "description": "The Grok parser enriches log events by parsing unstructured text into structured attributes.", "items": { "description": "The Grok parser enriches log events by parsing unstructured text into structured attributes.", "type": "string" }, "type": "array" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "predicate": { "$ref": "#/$defs/EventPredicate" }, "type": { "description": "Processes unstructured logs and extracts fields from them using Grok patterns.", "enum": [ "grok-parser" ], "type": "string" } }, "required": [ "name", "type" ], "type": "object", "x-tags": [ "Transforms" ] }, "HeadSamplingFilter": { "description": "Predicate that determines whether a span matches a head sampling rule.", "properties": { "type": { "type": "string" } }, "required": [ "type" ], "type": "object" }, "HostMetadataReporting": { "description": "Keep a vendor's host inventory in sync with the metric reduction.", "properties": { "aggregateCohortHosts": { "default": false, "description": "Collapse each cohort's real hosts into a single virtual cohort host.", "type": "boolean" }, "integrationIds": { "default": [], "description": "Datadog integration IDs that receive the reported host metadata.", "items": { "description": "Datadog integration IDs that receive the reported host metadata.", "type": "string" }, "maxItems": 2147483647, "minItems": 1, "type": "array", "uniqueItems": true }, "rehydrateAnomalousHosts": { "default": false, "description": "While an object is anomalous, re-report its real host to Datadog.", "type": "boolean" } }, "required": [ "integrationIds" ], "type": "object" }, "IcebergLogsReplaySource": { "properties": { "datasetId": { "description": "The ID of the dataset to read data from.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "end": { "description": "End of time interval to query data for.", "format": "date-time", "type": "string" }, "limit": { "default": 2500, "description": "The maximum number of rows to process", "format": "int32", "type": "integer" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offset": { "default": 0, "description": "Offset on the number of rows to process", "format": "int32", "minimum": 0, "type": "integer" }, "query": { "$ref": "#/$defs/query" }, "sortOrder": { "default": "ASCENDING", "description": "The order in which the rows should be sorted by", "enum": [ "ASCENDING", "DESCENDING", "UNSORTED" ], "type": "string" }, "start": { "description": "Start of time interval to query data for.", "format": "date-time", "type": "string" }, "type": { "description": "Replays log events from an Iceberg table at their original ingestion rate using receivedTimestamp for timing.", "enum": [ "logs-iceberg-replay-source" ], "type": "string" }, "variables": { "additionalProperties": { "$ref": "#/$defs/Any" }, "default": {}, "description": "Variables that can be used to modify the query while parsed", "type": "object" } }, "required": [ "datasetId", "end", "name", "query", "start", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "IgnoreAttributesMergeStrategy": { "properties": { "type": { "description": "IgnoreAttributesMergeStrategy: Does nothing during merge - leaves the current value unchanged. Used internally for suffixed keys managed by CompositeAttributesMergeStrategy.", "enum": [ "ignore" ], "type": "string" } }, "required": [ "type" ], "type": "object" }, "IntegrationExceptionConfig": { "properties": { "autoSync": { "default": false, "description": "When enabled, the exceptions list will be updated automatically based on the integration's exceptions.", "title": "Automatically sync Exceptions from Integration", "type": "boolean" }, "autosyncPassthroughRateThreshold": { "description": "Maximum impact percentage threshold for autosync (0.0 to 100.0). When set, only exceptions with impact percentage <= threshold are auto-included.", "format": "double", "maximum": 100, "minimum": 0, "type": "number" }, "datasetId": { "description": "Dataset against which the auto-sync impact threshold is evaluated. Required for threshold filtering to apply; when null, no exceptions bypass via auto-sync.", "title": "Dataset ID for auto-sync threshold", "type": "string" }, "ids": { "default": [], "items": { "description": "This is a list of exception IDs to include or exclude from the imported exceptions. If autoSync is true, this list will be used to exclude exceptions, otherwise it will be used to include exceptions, from the exceptions in the associated integration.", "title": "Inclusion/Exclusion list of exceptions", "type": "string" }, "type": "array" }, "integrationId": { "description": "The ID of the integration associated with this exception configuration.", "title": "Integration ID", "type": "string" } }, "required": [ "integrationId" ], "type": "object" }, "JobAction": { "description": "Base class of all Job Actions", "oneOf": [ { "$ref": "#/$defs/BackfillJobAction" } ], "properties": { "name": { "type": "string" }, "order": { "format": "int32", "type": "integer" } }, "type": "object" }, "JobActionRule": { "properties": { "actions": { "default": [], "items": { "$ref": "#/$defs/JobAction" }, "type": "array", "uniqueItems": true }, "type": { "description": "This takes job actions when the rule is triggered.", "enum": [ "job-rule" ], "type": "string" } }, "required": [ "type" ], "type": "object" }, "JsonFileFormat": { "description": "JSON file format.", "properties": { "charset": { "default": "UTF-8", "description": "Character set name such as UTF-8, UTF-16, etc.", "type": "string" }, "mapper": { "$ref": "#/$defs/JsonLogEventMapper" }, "recordsPath": { "default": [ "items" ], "description": "Path to the list of log records.", "items": { "default": "[\"items\"]", "description": "Path to the list of log records.", "type": "string" }, "type": "array" }, "streamFormat": { "$ref": "#/$defs/StreamFormatAny" } }, "type": "object" }, "JsonLogEventMapper": { "description": "JSON-to-LogEvent mapper.", "type": "object" }, "JsonLogProcessor": { "properties": { "liftFieldNames": { "default": [], "description": "Object-valued JSON fields whose children are lifted into the containing parsed object. An empty list disables lifting. Lifting repeats recursively when a lifted object contains another configured field. Colliding maps are merged recursively. For leaf values and all other type combinations, the lifted child replaces the existing value; arrays are not combined. If multiple configured fields contain the same child, the later field wins according to these rules.", "items": { "default": "[]", "description": "Object-valued JSON fields whose children are lifted into the containing parsed object. An empty list disables lifting. Lifting repeats recursively when a lifted object contains another configured field. Colliding maps are merged recursively. For leaf values and all other type combinations, the lifted child replaces the existing value; arrays are not combined. If multiple configured fields contain the same child, the later field wins according to these rules.", "type": "string" }, "type": "array" }, "maxNestedDepthForFields": { "default": 3, "format": "int32", "maximum": 10, "minimum": 1, "type": "integer" }, "maxNestedJsonIterations": { "default": 5, "description": "Maximum number of iterations to perform when resolving nested JSON fields.", "format": "int32", "maximum": 20, "minimum": 1, "type": "integer" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "preserveJsonMessageField": { "default": false, "description": "The processor tries to deserialize the string in the 'message' field as JSON, putting all values into the 'attributes' field. If this is enabled, the processor will keep the JSON string in 'message'. When disabled, the string will be cleared.", "type": "boolean" }, "resolveNestedJsonFields": { "default": [ [ "message" ], [ "msg" ], [ "log" ] ], "description": "If you have JSON that is double serialized, e.g. '{\"field\": \"{\\\"nested\\\": \\\"value\\\"}\"}', you might want to deserialize the nested JSON fields as well. This option allows you to specify the paths within the attributes where we should look for nested JSON fields. All the paths are tried in every iteration, and the deserialized fields are added to the root of attributes. Use this for singly serialized JSON attribute fields as well.", "items": { "default": [ [ "message" ], [ "msg" ], [ "log" ] ], "description": "If you have JSON that is double serialized, e.g. '{\"field\": \"{\\\"nested\\\": \\\"value\\\"}\"}', you might want to deserialize the nested JSON fields as well. This option allows you to specify the paths within the attributes where we should look for nested JSON fields. All the paths are tried in every iteration, and the deserialized fields are added to the root of attributes. Use this for singly serialized JSON attribute fields as well.", "items": { "default": "[[\"message\"],[\"msg\"],[\"log\"]]", "description": "If you have JSON that is double serialized, e.g. '{\"field\": \"{\\\"nested\\\": \\\"value\\\"}\"}', you might want to deserialize the nested JSON fields as well. This option allows you to specify the paths within the attributes where we should look for nested JSON fields. All the paths are tried in every iteration, and the deserialized fields are added to the root of attributes. Use this for singly serialized JSON attribute fields as well.", "type": "string" }, "type": "array" }, "type": "array" }, "type": { "description": "Deserializes the 'message' field as JSON merging the result into the 'attributes' map. Can also deserialize attributes that contain JSON strings.", "enum": [ "json-log-processor" ], "type": "string" } }, "required": [ "name", "type" ], "type": "object", "x-tags": [ "Transforms" ] }, "LegacyDatadogMetricsSink": { "properties": { "additionalTags": { "default": [], "description": "Additional tags to add to the metrics when writing to Datadog. Gets combined with the integration's additionalTags.", "items": { "type": "string" }, "type": "array" }, "integrationId": { "description": "The Datadog integration id.", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Writes processed metrics (flat MetricDatapoint model) to Datadog. Transitional; use datadog-metrics-sink for new pipelines.", "enum": [ "legacy-datadog-metrics-sink" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "LogAttributesRemapper": { "properties": { "attributeRemappingRules": { "default": [], "description": "List of attribute-to-attribute remapping rules. Each rule moves the value from a source attribute path to a target attribute path, removing the source unless the rule's preserveSource flag is set. An optional predicate filter controls when each rule is applied.", "items": { "$ref": "#/$defs/AttributeRemappingRule" }, "type": "array" }, "hostPreserveSource": { "default": true, "description": "When true, preserves the source host attribute after remapping instead of removing it. Defaults to true (source is preserved).", "type": "boolean" }, "hostReservedAttributePaths": { "default": [ [ "_resource", "host.name" ] ], "description": "Paths to search for host values", "items": { "default": [ [ "_resource", "host.name" ] ], "description": "Paths to search for host values", "items": { "default": "[[\"_resource\",\"host.name\"]]", "description": "Paths to search for host values", "type": "string" }, "type": "array" }, "type": "array" }, "hostReservedAttributes": { "default": [ "host", "hostname", "syslog.hostname", "kubernetes.host", "sourceIPAddress" ], "description": "Attributes to search for host values", "items": { "default": "[\"@host\",\"hostname\",\"syslog.hostname\"]", "description": "Attributes to search for host values", "type": "string" }, "type": "array" }, "messagePreserveSource": { "default": false, "description": "When true, preserves the source message attribute after remapping instead of removing it. Defaults to false (source is removed after remapping).", "type": "boolean" }, "messageReservedAttributePaths": { "default": [], "description": "Paths to search for message values", "items": { "default": [], "description": "Paths to search for message values", "items": { "default": "[]", "description": "Paths to search for message values", "type": "string" }, "type": "array" }, "type": "array" }, "messageReservedAttributes": { "default": [ "message", "msg", "log", "M", "Message" ], "description": "Attributes to search for message values. The used attribute will be removed once remapped.", "items": { "default": "[\"message\",\"msg\",\"log\",\"M\",\"Message\"]", "description": "Attributes to search for message values. The used attribute will be removed once remapped.", "type": "string" }, "type": "array" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "servicePreserveSource": { "default": true, "description": "When true, preserves the source service attribute after remapping instead of removing it. Defaults to true (source is preserved).", "type": "boolean" }, "serviceReservedAttributePaths": { "default": [ [ "_resource", "service.name" ], [ "kubernetes", "labels", "app.kubernetes.io/name" ], [ "labels", "app.kubernetes.io/name" ] ], "description": "Paths to search for service values", "items": { "default": [ [ "_resource", "service.name" ], [ "kubernetes", "labels", "app.kubernetes.io/name" ], [ "labels", "app.kubernetes.io/name" ] ], "description": "Paths to search for service values", "items": { "default": "[[\"_resource\",\"service.name\"],[\"kubernetes\",\"labels\",\"app.kubernetes.io/name\"],[\"labels\",\"app.kubernetes.io/name\"]]", "description": "Paths to search for service values", "type": "string" }, "type": "array" }, "type": "array" }, "serviceReservedAttributes": { "default": [ "service", "syslog.appname", "dd.service", "kubernetes.labels.app", "labels.app", "kubernetes.labels.k8s-app", "labels.k8s-app", "eventSource" ], "description": "Attributes to search for service values", "items": { "default": "[\"service\",\"syslog.appname\",\"dd.service\",\"kubernetes.labels.app\",\"labels.app\",\"kubernetes.labels.k8s-app\",\"labels.k8s-app\"]", "description": "Attributes to search for service values", "type": "string" }, "type": "array" }, "statusMapping": { "$ref": "#/$defs/StatusMapping" }, "statusPreserveSource": { "default": true, "description": "When true, preserves the source status attribute after remapping instead of removing it. Defaults to true (source is preserved).", "type": "boolean" }, "statusReservedAttributePaths": { "default": [], "description": "Attributes to search for status values", "items": { "default": [], "description": "Attributes to search for status values", "items": { "default": "[]", "description": "Attributes to search for status values", "type": "string" }, "type": "array" }, "type": "array" }, "statusReservedAttributes": { "default": [ "log.level", "level", "status", "severity", "syslog.severity", "L" ], "description": "Attributes to search for status values", "items": { "default": "[\"log.level\",\"level\",\"status\",\"severity\",\"syslog.severity\",\"L\"]", "description": "Attributes to search for status values", "type": "string" }, "type": "array" }, "tagMappingPaths": { "additionalProperties": { "description": "Map from tag key to an ordered list of attribute paths to search for values. All paths will be tried, and all found values will be added. If no value is found, the tag will not be changed. The attribute paths are a list of paths. This does not remove existing tag values.", "items": { "description": "Map from tag key to an ordered list of attribute paths to search for values. All paths will be tried, and all found values will be added. If no value is found, the tag will not be changed. The attribute paths are a list of paths. This does not remove existing tag values.", "items": { "description": "Map from tag key to an ordered list of attribute paths to search for values. All paths will be tried, and all found values will be added. If no value is found, the tag will not be changed. The attribute paths are a list of paths. This does not remove existing tag values.", "type": "string" }, "type": "array" }, "type": "array" }, "default": {}, "description": "Map from tag key to an ordered list of attribute paths to search for values. All paths will be tried, and all found values will be added. If no value is found, the tag will not be changed. The attribute paths are a list of paths. This does not remove existing tag values.", "type": "object" }, "tagMappings": { "additionalProperties": { "description": "Map from tag key to an ordered list of attribute paths to search for values. All paths will be tried, and all found values will be added. If no value is found, the tag will not be changed. The attribute paths are dot-separated. This does not remove existing tag values.", "items": { "description": "Map from tag key to an ordered list of attribute paths to search for values. All paths will be tried, and all found values will be added. If no value is found, the tag will not be changed. The attribute paths are dot-separated. This does not remove existing tag values.", "type": "string" }, "type": "array" }, "default": {}, "description": "Map from tag key to an ordered list of attribute paths to search for values. All paths will be tried, and all found values will be added. If no value is found, the tag will not be changed. The attribute paths are dot-separated. This does not remove existing tag values.", "type": "object" }, "tagMappingsLocationPaths": { "default": [], "description": "Possible locations of a map of string to string or to collection of strings that has tags. Added to tags, without replacement.", "items": { "description": "Possible locations of a map of string to string or to collection of strings that has tags. Added to tags, without replacement.", "items": { "description": "Possible locations of a map of string to string or to collection of strings that has tags. Added to tags, without replacement.", "type": "string" }, "type": "array" }, "type": "array" }, "tagMappingsLocationPreserveSource": { "default": false, "description": "When true, preserves the source tag map location attributes after remapping instead of removing them. Defaults to false (source is removed after remapping).", "type": "boolean" }, "tagMappingsLocations": { "default": [], "description": "Possible locations of a map of string to string or to collection of strings that has tags. Added to tags, without replacement.", "items": { "description": "Possible locations of a map of string to string or to collection of strings that has tags. Added to tags, without replacement.", "type": "string" }, "type": "array" }, "tagMappingsPreserveSource": { "default": false, "description": "When true, preserves the source tag mappings attributes after remapping instead of removing them. Defaults to false (source is removed).", "type": "boolean" }, "timestampPreserveSource": { "default": true, "description": "When true, preserves the source timestamp attribute after remapping instead of removing it. Defaults to true (source is preserved).", "type": "boolean" }, "timestampReservedAttributePaths": { "default": [], "description": "Paths to search for timestamp values", "items": { "default": [], "description": "Paths to search for timestamp values", "items": { "default": "[]", "description": "Paths to search for timestamp values", "type": "string" }, "type": "array" }, "type": "array" }, "timestampReservedAttributes": { "default": [ "@timestamp", "timestamp", "_timestamp", "Timestamp", "eventTime", "date", "published_date", "syslog.timestamp", "T" ], "description": "Attributes to search for timestamp values", "items": { "default": "[\"@timestamp\",\"timestamp\",\"_timestamp\",\"Timestamp\",\"eventTime\",\"date\",\"published_date\",\"syslog.timestamp\",\"T\"]", "description": "Attributes to search for timestamp values", "type": "string" }, "type": "array" }, "traceIdPreserveSource": { "default": true, "description": "When true, preserves the source traceId attribute after remapping instead of removing it. Defaults to true (source is preserved).", "type": "boolean" }, "traceIdReservedAttributePaths": { "default": [], "description": "Paths to search for traceId values", "items": { "default": [], "description": "Paths to search for traceId values", "items": { "default": "[]", "description": "Paths to search for traceId values", "type": "string" }, "type": "array" }, "type": "array" }, "traceIdReservedAttributes": { "default": [ "dd.trace_id", "contextMap.dd.trace_id", "otelTraceID" ], "description": "Attributes to search for traceId values", "items": { "default": "[\"dd.trace_id\",\"contextMap.dd.trace_id\"]", "description": "Attributes to search for traceId values", "type": "string" }, "type": "array" }, "type": { "description": "Maps attributes to top-level fields and tags.", "enum": [ "log-attributes-remapper" ], "type": "string" } }, "required": [ "name", "type" ], "type": "object", "x-tags": [ "Transforms" ] }, "LogEvent": { "description": "A log event.", "properties": { "attributes": { "additionalProperties": { "$ref": "#/$defs/Any" }, "description": "Attributes associated with the event, a map from attribute name to attribute value, which may be a nested map or list.", "type": "object" }, "eventTimestamp": { "description": "Event timestamp that is in the record. Milliseconds from epoch.", "format": "int64", "type": "integer" }, "id": { "description": "Id of the event.", "type": "string" }, "message": { "description": "The log message.", "type": "string" }, "receivedTimestamp": { "description": "Timestamp when the event was received by Grepr. Milliseconds from epoch.", "format": "int64", "type": "integer" }, "severity": { "description": "The log severity. Higher numbers mean higher severity, following the OTel format 1-24.", "format": "int32", "type": "integer" }, "tags": { "additionalProperties": { "description": "Tags associated with the event, a map from tag name to set of tag values.", "items": { "description": "Tags associated with the event, a map from tag name to set of tag values.", "type": "string" }, "type": "array", "uniqueItems": true }, "description": "Tags associated with the event, a map from tag name to set of tag values.", "type": "object" } }, "required": [ "eventTimestamp", "id", "receivedTimestamp" ], "type": "object" }, "LogEventMapper": { "description": "Selects the mapper used to decode raw file records into LogEvents.", "properties": { "type": { "type": "string" } }, "required": [ "type" ], "type": "object" }, "LogReducer": { "properties": { "attributeMergeStrategyEntries": { "default": [], "description": "List of attribute paths and their corresponding merge strategies. If no strategy is defined for a path, the terminal merge strategy will be used.", "items": { "$ref": "#/$defs/AttributesMergeStrategyEntry" }, "title": "Attributes merge strategy entries", "type": "array" }, "attributeTokenization": { "default": "KEYS_AND_VALUES", "description": "Use attribute shape only, or shape and whole-value similarity tokens.", "enum": [ "KEYS_ONLY", "KEYS_AND_VALUES" ], "type": "string" }, "dedupThreshold": { "default": 4, "description": "Number of duplicates we send for a pattern before we start deduplication.", "format": "int32", "minimum": 1, "title": "Deduplication threshold", "type": "integer" }, "defaultAttributesMergeStrategy": { "$ref": "#/$defs/AttributesMergeStrategy" }, "delimiters": { "default": [ ":", "#", "[", "]", "(", ")", "{", "}", "|", ",", ";", "\"", "'", " ", "\t", "\n", "\r", "&", "=", "?", "!", "+", "*", "/", "<", ">", "%", "^", "~", "`" ], "description": "Characters to use for splitting tokens. Default is missing '@' to avoid splitting email addresses. Also missing '.' to avoid splitting identifiers using it.", "items": { "description": "Characters to use for splitting tokens. Default is missing '@' to avoid splitting email addresses. Also missing '.' to avoid splitting identifiers using it.", "title": "Token delimiters", "type": "string" }, "title": "Token delimiters", "type": "array" }, "emitNewPatternSignals": { "default": false, "description": "Whether this operation may emit LogPatternSignal events to the agent-service when new patterns are detected or replayed. Must be enabled before an agent can subscribe to this pipeline.", "title": "Emit new-pattern signals", "type": "boolean" }, "enabledMasks": { "default": [ "ipport", "timestamp", "uuid", "number" ], "description": "Masks that are enabled for tokenizing messages. These are specified as the names of the masks to use. The default enabled masks are: ipport, timestamp, uuid, number.", "items": { "description": "Masks that are enabled for tokenizing messages. These are specified as the names of the masks to use. The default enabled masks are: ipport, timestamp, uuid, number.", "title": "Enabled masks", "type": "string" }, "title": "Enabled masks", "type": "array" }, "excludedAttributePrefixes": { "default": [], "description": "Excluded attribute prefixes as arrays of literal key segments. Does not affect partition-by values or output attributes.", "items": { "description": "Excluded attribute prefixes as arrays of literal key segments. Does not affect partition-by values or output attributes.", "items": { "description": "Excluded attribute prefixes as arrays of literal key segments. Does not affect partition-by values or output attributes.", "type": "string" }, "type": "array" }, "type": "array" }, "includedAttributePrefixes": { "default": [], "description": "Included attribute prefixes as arrays of literal key segments. Empty selects all. Array elements are traversed without indices.", "items": { "description": "Included attribute prefixes as arrays of literal key segments. Empty selects all. Array elements are traversed without indices.", "items": { "description": "Included attribute prefixes as arrays of literal key segments. Empty selects all. Array elements are traversed without indices.", "type": "string" }, "type": "array" }, "type": "array" }, "integrationExceptionConfigs": { "default": [], "description": "Exception configs that define which exceptions to use from the ones imported from the observability vendor integrations.", "items": { "$ref": "#/$defs/IntegrationExceptionConfig" }, "title": "Vendor imported exceptions", "type": "array" }, "logReducerExceptions": { "default": [], "description": "Predicate for skipping events. Logs matching these predicates won't be aggregated.", "items": { "$ref": "#/$defs/EventPredicate" }, "title": "Event predicate", "type": "array" }, "masks": { "default": [ [ "ipport", "(?:\\d{1,3}\\.){3}\\d{1,3}(?::\\d{1,5})?" ], [ "timestamp", "(?:(?:\\d{4}-\\d{2}-\\d{2}(?:T|\\s)\\d{2}:\\d{2}:\\d{2}(?:[.,]\\d{1,12})?(?:Z|(?:[\\+\\-]\\d{2}:?\\d{2})|\\sUTC)?)|(?:\\d{1,4}/\\d{1,2}/\\d{1,4}(,?\\s\\d{1,2}:\\d{2}:\\d{1,2}(?:[.,]\\d{1,12})?(?:\\s?(?:[AP]M))?)?)|(?:\\d{1,2}:\\d{2}:\\d{1,2}(?:[.,]\\d{1,12})?(?:\\s?(?:[AP]M))?)|(?:\\d{2}/[A-Za-z]{3}/\\d{4}(?:[:\\s]\\d{2}:\\d{2}:\\d{2}(?:\\s\\+[0-9]{4})?)?))" ], [ "uuid", "(?:^|(?(?:(?:\\d{1,100})?(?:\\.\\d{1,100})(?:[eE][\\-\\+]?\\d{1,100}))|(?:(?:\\d{1,100})?(?:\\.\\d{1,100}))|(?:\\d{1,100}))))(?:(?!\\w)|$)" ], [ "awsarn", "arn:aws(?:-[a-z]+-[a-z]+)?:[a-zA-Z0-9-]+:(?:[a-z0-9-]+:)?(?:[0-9]{12})?:[a-zA-Z0-9-_./]+(?::[a-zA-Z0-9-_./]+)*" ], [ "awstoken", "(?:IQoJb3JpZ2luX[A-Za-z0-9+/]{10,20})[A-Za-z0-9+/]{800,1100}" ] ], "description": "Set of masks that can be applied to messages before tokenizing them. These masks are specified as pairs of (name, regex). The default masks are: ipport, timestamp, uuid, number, awsarn, awstoken.", "items": { "description": "Set of masks that can be applied to messages before tokenizing them. These masks are specified as pairs of (name, regex). The default masks are: ipport, timestamp, uuid, number, awsarn, awstoken.", "items": { "description": "Set of masks that can be applied to messages before tokenizing them. These masks are specified as pairs of (name, regex). The default masks are: ipport, timestamp, uuid, number, awsarn, awstoken.", "title": "Masks", "type": "string" }, "title": "Masks", "type": "array" }, "title": "Masks", "type": "array" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "partitionByAttributePaths": { "default": [], "description": "Attribute paths as arrays of keys. Use for unambiguous nested vs flat attributes. Example: [[\"user\", \"id\"]] for nested user.id, [[\"user.id\"]] for flat attribute named 'user.id'", "items": { "description": "Attribute paths as arrays of keys. Use for unambiguous nested vs flat attributes. Example: [[\"user\", \"id\"]] for nested user.id, [[\"user.id\"]] for flat attribute named 'user.id'", "items": { "description": "Attribute paths as arrays of keys. Use for unambiguous nested vs flat attributes. Example: [[\"user\", \"id\"]] for nested user.id, [[\"user.id\"]] for flat attribute named 'user.id'", "title": "Grouping by attribute paths (array format)", "type": "string" }, "title": "Grouping by attribute paths (array format)", "type": "array" }, "title": "Grouping by attribute paths (array format)", "type": "array", "uniqueItems": true }, "partitionByAttributes": { "default": [], "items": { "description": "Attributes by which to group logs for aggregation. For example to aggregate logs by an attribute specify `x.y`, which would be interpreted as a JSON path in under attributes. These work like 'GROUP BY' in SQL.", "title": "Grouping by attributes", "type": "string" }, "type": "array" }, "partitionByTags": { "default": [], "items": { "description": "Tag keys by which to group logs for aggregation by. For example to aggregate logs by host specify `host`. These work like 'GROUP BY' in SQL.", "title": "Grouping by tags", "type": "string" }, "type": "array" }, "reductionTimeWindow": { "default": "PT2M", "description": "Time window in which logs are considered for deduplication. Should not be modified without explicit guidance.", "format": "ISO-8601", "type": "string" }, "repeatCountInSummaryMessageEnabled": { "default": true, "description": "Whether to include the repeat count prefix in the summary message. Grepr will add a prefix to the summary message with the number messages aggregated. However, this might break downstream parsing if the message is expected to be in a specific format. If you want to include the repeat count, set this to true.", "title": "Include repeat count in summary message", "type": "boolean" }, "samplingConfig": { "$ref": "#/$defs/SamplingConfig" }, "similarityThreshold": { "default": 70.0, "description": "Controls how close a set of tokens are to a pattern before it is considered a match. Calculated as the percent of matching tokens between a pattern and a message.", "format": "double", "maximum": 100, "minimum": 20, "title": "Similarity threshold", "type": "number" }, "tokenizationInput": { "default": "MESSAGE_ONLY", "description": "Selects message text, attributes, both, or message text with an attributes fallback.", "enum": [ "MESSAGE_ONLY", "ATTRIBUTES_ONLY", "MESSAGE_AND_ATTRIBUTES", "AUTO" ], "type": "string" }, "type": { "description": "Reduces logs by combining messages with similar patterns.", "enum": [ "log-reducer" ], "type": "string" } }, "required": [ "delimiters", "enabledMasks", "masks", "name", "type" ], "type": "object", "x-tags": [ "Transforms" ] }, "LogRulesApplication": { "properties": { "globalRules": { "default": [], "description": "Global rules applied to all log events regardless of pattern (e.g., log-based alert rules).", "items": { "$ref": "#/$defs/PatternRuleConfig" }, "type": "array" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "rules": { "additionalProperties": { "description": "Per-pattern rules keyed by pattern ID (TSID string).", "items": { "$ref": "#/$defs/PatternRuleConfig" }, "type": "array" }, "default": {}, "description": "Per-pattern rules keyed by pattern ID (TSID string).", "type": "object" }, "type": { "description": "Applies per-pattern rules (masking, time-series spike detection) to log events.", "enum": [ "log-rules-application" ], "type": "string" } }, "required": [ "name", "type" ], "type": "object", "x-tags": [ "Transforms" ] }, "LogTransformAction": { "properties": { "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "transforms": { "default": [], "items": { "$ref": "#/$defs/EventAction" }, "type": "array" }, "type": { "description": "Applies transformations to log events.", "enum": [ "log-transform" ], "type": "string" } }, "required": [ "name", "type" ], "type": "object", "x-tags": [ "Transforms" ] }, "LogsBackfillFlinkSource": { "properties": { "datasetId": { "description": "The ID of the dataset to read data from.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "end": { "description": "End of time interval to query data for.", "format": "date-time", "type": "string" }, "limit": { "default": 2500, "description": "The maximum number of rows to process", "format": "int32", "type": "integer" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offset": { "default": 0, "description": "Offset on the number of rows to process", "format": "int32", "minimum": 0, "type": "integer" }, "query": { "$ref": "#/$defs/query" }, "sortOrder": { "default": "ASCENDING", "description": "The order in which the rows should be sorted by", "enum": [ "ASCENDING", "DESCENDING", "UNSORTED" ], "type": "string" }, "start": { "description": "Start of time interval to query data for.", "format": "date-time", "type": "string" }, "type": { "description": "Backfills events out of an Iceberg Table, returning events with the sinks they have already been sent to.", "enum": [ "logs-backfill-iceberg-table-source" ], "type": "string" }, "variables": { "additionalProperties": { "$ref": "#/$defs/Any" }, "default": {}, "description": "Variables that can be used to modify the query while parsed", "type": "object" }, "vendorSinkIntegrationIds": { "default": [], "items": { "description": "The list of vendor integration IDs, if any, that will consume the data from the source.", "pattern": "[a-z0-9]{1,13}", "title": "Vendor Sink Integration IDs", "type": "string" }, "type": "array" } }, "required": [ "datasetId", "end", "name", "query", "start", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "LogsBranch": { "properties": { "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "predicate": { "$ref": "#/$defs/EventPredicate" }, "type": { "description": "Splits events based on a predicate. Positive matches go to the main output. Negative matches go to the 'else' output.\n", "enum": [ "logs-branch" ], "type": "string" } }, "required": [ "name", "predicate", "type" ], "type": "object", "x-tags": [ "Operations" ] }, "LogsEventSampler": { "properties": { "filter": { "$ref": "#/$defs/EventPredicate" }, "maxAllowedRate": { "default": 10.0, "description": "Max allowed rate in messages per second. The max rate used by the token rate limiter to control the sampling rate of events. The rate is distributed across parallel subtasks.", "format": "double", "title": "Max allowed rate in messages per second", "type": "number" }, "maxBurstLimit": { "default": 2000, "description": "Maximum size of acceptable burst used by the token bucket rate limiter to handle bursty traffic.", "format": "int32", "title": "Max burst limit", "type": "integer" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Samples log events using a token based rate limiter. Throttles log events based on max rate accepting up to max burst limit for bursty traffic. Can selectively sample events matching a filter predicate. Rate limiting is distributed across parallel subtasks.\n", "enum": [ "logs-event-sampler" ], "type": "string" } }, "required": [ "name", "type" ], "type": "object", "x-tags": [ "Transforms" ] }, "LogsFilter": { "properties": { "inverted": { "default": false, "description": "Whether to invert the predicate logic", "type": "boolean" }, "maxLateEventTimestampDelta": { "description": "Maximum allowed time delta between received and event timestamps. Events with a delta exceeding this threshold will be filtered out. ISO-8601 duration format.", "format": "ISO-8601", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "predicate": { "$ref": "#/$defs/EventPredicate" }, "type": { "description": "Filters events based on a predicate.\n", "enum": [ "logs-filter" ], "type": "string" } }, "required": [ "name", "predicate", "type" ], "type": "object", "x-tags": [ "Transforms" ] }, "LogsIcebergTableSink": { "properties": { "datasetId": { "description": "The id of the dataset to write to", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Writes logs to an Iceberg Table.", "enum": [ "logs-iceberg-table-sink" ], "type": "string" } }, "required": [ "datasetId", "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "LogsIcebergTableSource": { "properties": { "datasetId": { "description": "The ID of the dataset to read data from.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "end": { "description": "End of time interval to query data for.", "format": "date-time", "type": "string" }, "limit": { "default": 2500, "description": "The maximum number of rows to process", "format": "int32", "type": "integer" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offset": { "default": 0, "description": "Offset on the number of rows to process", "format": "int32", "minimum": 0, "type": "integer" }, "query": { "$ref": "#/$defs/query" }, "sortOrder": { "default": "ASCENDING", "description": "The order in which the rows should be sorted by", "enum": [ "ASCENDING", "DESCENDING", "UNSORTED" ], "type": "string" }, "start": { "description": "Start of time interval to query data for.", "format": "date-time", "type": "string" }, "type": { "description": "Reads events from an Iceberg table for processing.", "enum": [ "logs-iceberg-table-source" ], "type": "string" }, "variables": { "additionalProperties": { "$ref": "#/$defs/Any" }, "default": {}, "description": "Variables that can be used to modify the query while parsed", "type": "object" } }, "required": [ "datasetId", "end", "name", "query", "start", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "LogsRuleEngine": { "properties": { "conditions": { "additionalProperties": { "$ref": "#/$defs/Condition" }, "default": {}, "description": "Map of condition Id to condition objects. The ids are a unique name for the conditions.", "type": "object" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "triggers": { "additionalProperties": { "$ref": "#/$defs/Trigger" }, "default": {}, "description": "Map of trigger Id to trigger objects. The ids are a unique name for the trigger.", "type": "object" }, "type": { "description": "Describes rules to execute on log events. See the guide for the Rule Engine for more details.", "enum": [ "rule-engine" ], "type": "string" } }, "required": [ "conditions", "name", "triggers", "type" ], "type": "object", "x-tags": [ "Operations" ] }, "LogsSynchronousSink": { "properties": { "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Sink for returning log results to the caller.", "enum": [ "logs-sync-sink" ], "type": "string" } }, "required": [ "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "LogsValuesSource": { "properties": { "loop": { "default": false, "description": "If true, the source will loop over the values indefinitely when processing is STREAMING. In BATCH mode, this flag is ignored.", "type": "boolean" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Generates log events with constant values.", "enum": [ "logs-values-source" ], "type": "string" }, "values": { "default": [], "description": "List of log events to be generated by the source.", "items": { "$ref": "#/$defs/LogEvent" }, "type": "array" } }, "required": [ "name", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "Mask": { "description": "A mask: the regular expression to match, and how to rewrite the match. May also be written as a bare regex string when no replacement or preserved prefix is needed.", "properties": { "preserveThrough": { "description": "Delimiter ending a prefix of the match that is kept verbatim instead of being replaced. The match is split at the first occurrence of this text, so a regex matching \"?token=abc123\" with a delimiter of \"=\" keeps \"?token=\" and rewrites only the value. When the delimiter does not occur in the match, the whole match is replaced.", "maxLength": 16, "minLength": 1, "type": "string" }, "regex": { "description": "Regular expression whose matches are rewritten. Must be compatible with Hyperscan syntax: no lookbehind and no backreferences. Prefer unbounded repeats (`+`, `*`) over bounded ones (`{1,50}`) — a bounded repeat is expanded into that many copies of the pattern and can exceed the compiler's size limit.", "type": "string" }, "replacement": { "description": "Text substituted for the match. Defaults to the mask's label in square brackets, e.g. a mask labeled \"email\" becomes \"[email]\".", "maxLength": 64, "minLength": 0, "type": "string" } }, "required": [ "regex" ], "type": "object" }, "MaskingOperator": { "properties": { "attributeMasks": { "default": [], "description": "Masks to apply to attribute values. Each entry names an attribute path (as a list of segments) and the masks to apply to the value at that path. Only string values at the exact path are masked; missing or non-string attributes are skipped. Paths must be unique. The same matching rules as messageMasks apply.", "items": { "$ref": "#/$defs/AttributeMask" }, "type": "array" }, "messageMasks": { "additionalProperties": { "$ref": "#/$defs/Mask" }, "default": {}, "description": "Masks to apply to the log message, as a map of label to mask. A mask may be written as a bare regex string, in which case each match is replaced with the label in square brackets — a match of the regex labeled \"email\" becomes \"[email]\". Labels may be up to 64 characters. Overlapping matches resolve to the leftmost match first, then the longest; declaration order breaks remaining ties, so declare more specific patterns first.", "type": "object" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "predicate": { "$ref": "#/$defs/EventPredicate" }, "type": { "description": "Masks sensitive substrings in log events by replacing regex matches with decorated labels.", "enum": [ "masking-operator" ], "type": "string" } }, "required": [ "attributeMasks", "messageMasks", "name", "type" ], "type": "object", "x-tags": [ "Transforms" ] }, "MaxAttributesMergeStrategy": { "properties": { "type": { "description": "MaxAttributesMergeStrategy: Keeps the maximum numeric attribute value.", "enum": [ "max" ], "type": "string" } }, "required": [ "type" ], "type": "object" }, "MergeMapAttributeAction": { "properties": { "order": { "default": 0, "description": "Action order. Lower is applied first.", "format": "int32", "type": "integer" }, "targetPath": { "description": "The path to the attribute to merge into.", "type": "string" }, "type": { "description": "Merge value into a map in a event attributes. If the target map is not present or the target is not a map, it is a no-op. If values for the keys already exist, they are overwritten.", "enum": [ "attribute-merge-action" ], "type": "string" }, "value": { "additionalProperties": { "$ref": "#/$defs/Any" }, "description": "The value to merge.", "type": "object" } }, "required": [ "targetPath", "type", "value" ], "type": "object" }, "MetricAggSpec": { "description": "The metrics aggregation to apply to the source data.", "properties": { "groupByTags": { "default": [], "description": "The tags to group the results by. If unspecified, all series are grouped together. Only applicable when spaceAggregation is set.", "items": { "description": "The tags to group the results by. If unspecified, all series are grouped together. Only applicable when spaceAggregation is set.", "type": "string" }, "type": "array" }, "spaceAggregation": { "description": "The space aggregation to use for the query. If null, no grouping is done and the timeseries are returned with full tags.", "enum": [ "LATEST", "SUM", "AVG", "MAX" ], "type": "string" }, "timeAggregation": { "description": "The time aggregation to use for the query. If this is set, timeGranularity must also be provided. If null, no time aggregation is done and the raw datapoints are returned.", "enum": [ "LATEST", "SUM", "AVG", "MAX" ], "type": "string" }, "timeGranularity": { "description": "The time granularity to use for the query. Only applicable when timeAggregation is set.", "format": "ISO-8601", "type": "string" } }, "type": "object" }, "MetricAggregation": { "description": "One aggregation declaration inside an anomaly rule.", "properties": { "aggregations": { "default": [], "description": "Aggregations to emit. Null = dimension view.", "items": { "$ref": "#/$defs/AggregationDecl" }, "type": "array" }, "filters": { "$ref": "#/$defs/FilterPrimitive" }, "groupBy": { "default": [], "description": "Group-by tokens: 'object', 'cohort', 'series', or a level-prefixed attribute path. Empty list = global aggregation.", "items": { "description": "Group-by tokens: 'object', 'cohort', 'series', or a level-prefixed attribute path. Empty list = global aggregation.", "type": "string" }, "type": "array" }, "source": { "description": "Exact metric name or nested-aggregation alias. Mutually exclusive with filters.metricName. Null for dimension views (when filters is also unset).", "type": "string" }, "window": { "description": "Aggregation window. Defaults to timeGranularity.duration.", "format": "ISO-8601", "type": "string" } }, "required": [ "groupBy" ], "type": "object" }, "MetricDataRawIcebergTableSink": { "properties": { "datasetId": { "description": "The id of the dataset to write to", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Writes MetricData (one row per datapoint, attributes auto-flattened to columns) to an Iceberg table.", "enum": [ "metricdata-raw-iceberg-table-sink" ], "type": "string" } }, "required": [ "datasetId", "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "MetricEventPredicate": { "properties": { "filterTags": { "additionalProperties": { "default": {}, "description": "The set of tags to query for. If unspecified, all tags are queried.", "items": { "default": "{}", "description": "The set of tags to query for. If unspecified, all tags are queried.", "type": "string" }, "type": "array", "uniqueItems": true }, "default": {}, "description": "The set of tags to query for. If unspecified, all tags are queried.", "type": "object" }, "metricNames": { "default": [], "description": "The names of the metrics to query. Must not be empty.", "items": { "description": "The names of the metrics to query. Must not be empty.", "type": "string" }, "maxItems": 2147483647, "minItems": 1, "type": "array" }, "query": { "type": "string" }, "type": { "description": "A predicate that checks if an event matches a metrics query.", "enum": [ "metric-predicate" ], "type": "string" } }, "required": [ "metricNames", "query", "type" ], "type": "object" }, "MetricNameFilter": { "description": "Glob-pattern filter on metric names.", "properties": { "empty": { "type": "boolean" }, "excludes": { "default": [], "description": "Glob patterns to exclude. Precedence over includes.", "items": { "description": "Glob patterns to exclude. Precedence over includes.", "type": "string" }, "type": "array" }, "includes": { "default": [], "description": "Glob patterns to include. Empty list matches all.", "items": { "description": "Glob patterns to include. Empty list matches all.", "type": "string" }, "type": "array" } }, "type": "object" }, "MetricReducer": { "description": "Reduces metric volume by aggregating per-object time series into per-cohort summaries while preserving the original signal when anomaly rules fire. Series that don't belong to a monitored object flow through unchanged; series matching a drop rule are discarded.", "properties": { "anomalies": { "default": [], "description": "Anomaly rules.", "items": { "$ref": "#/$defs/AnomalyConfig" }, "type": "array" }, "anomalyActions": { "$ref": "#/$defs/AnomalyActions" }, "cohorts": { "$ref": "#/$defs/CohortsConfig" }, "dropRules": { "default": [], "description": "Drop rules — matching series are discarded outright.", "items": { "$ref": "#/$defs/DropRule" }, "type": "array" }, "emitInterval": { "default": "PT20S", "description": "How often the reducer flushes cohort-level output.", "format": "ISO-8601", "type": "string" }, "hostMetadata": { "$ref": "#/$defs/HostMetadataReporting" }, "lateArrivalWaitDuration": { "default": "PT10S", "description": "Watermark delay applied to give late-arriving data a chance to be aggregated.", "format": "ISO-8601", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "objects": { "$ref": "#/$defs/ObjectsConfig" }, "spaceAggOverrides": { "additionalProperties": { "$ref": "#/$defs/AggType" }, "default": {}, "description": "Per-metric-name overrides for space (cross-object) aggregation.", "type": "object" }, "timeGranularity": { "$ref": "#/$defs/TimeGranularity" }, "type": { "description": "Metric reducer.", "enum": [ "metric-reducer" ], "type": "string" } }, "required": [ "emitInterval", "lateArrivalWaitDuration", "name", "objects", "timeGranularity", "type" ], "type": "object", "x-tags": [ "Transforms" ] }, "MetricsIcebergTableSink": { "properties": { "datasetId": { "description": "The id of the dataset to write to", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Writes metrics to an Iceberg table.", "enum": [ "metrics-iceberg-table-sink" ], "type": "string" } }, "required": [ "datasetId", "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "MetricsIcebergTableSource": { "properties": { "aggSpec": { "$ref": "#/$defs/MetricAggSpec" }, "datasetId": { "description": "The ID of the dataset to read data from.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "end": { "description": "End of time interval to query data for.", "format": "date-time", "type": "string" }, "limit": { "default": 2500, "description": "The maximum number of rows to process", "format": "int32", "type": "integer" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offset": { "default": 0, "description": "Offset on the number of rows to process", "format": "int32", "minimum": 0, "type": "integer" }, "query": { "$ref": "#/$defs/query" }, "sortOrder": { "default": "ASCENDING", "description": "The order in which the rows should be sorted by", "enum": [ "ASCENDING", "DESCENDING", "UNSORTED" ], "type": "string" }, "start": { "description": "Start of time interval to query data for.", "format": "date-time", "type": "string" }, "type": { "description": "Reads metrics out of an Iceberg Table for processing.", "enum": [ "metrics-iceberg-table-source" ], "type": "string" }, "variables": { "additionalProperties": { "$ref": "#/$defs/Any" }, "default": {}, "description": "Variables that can be used to modify the query while parsed", "type": "object" } }, "required": [ "aggSpec", "datasetId", "end", "name", "query", "start", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "MetricsSynchronousSink": { "properties": { "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Sink for returning metric results to the caller.", "enum": [ "metrics-sync-sink" ], "type": "string" } }, "required": [ "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "MinAttributesMergeStrategy": { "properties": { "type": { "description": "MinAttributesMergeStrategy: Keeps the minimum numeric attribute value.", "enum": [ "min" ], "type": "string" } }, "required": [ "type" ], "type": "object" }, "MultiGrokParser": { "properties": { "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "ruleSets": { "default": [], "description": "Ordered list of grok rule sets. Each rule set has its own predicate, optional extract attribute, parsing rules, and helper rules. Rule sets extracting from enriched attributes should be ordered after rule sets that populate those attributes.", "items": { "$ref": "#/$defs/MultiGrokRuleSet" }, "type": "array" }, "type": { "description": "Processes unstructured logs and extracts fields from them using Grok patterns.", "enum": [ "multi-grok-parser" ], "type": "string" } }, "required": [ "name", "type" ], "type": "object", "x-tags": [ "Transforms" ] }, "MultiGrokRuleSet": { "description": "Ordered list of grok rule sets. Each rule set has its own predicate, optional extract attribute, parsing rules, and helper rules. Rule sets extracting from enriched attributes should be ordered after rule sets that populate those attributes.", "properties": { "extractAttribute": { "description": "Optional attribute to extract from. If null, extracts from the log message. Rules that extract from enriched attributes should be ordered after rules that populate those attributes. A dotted string, or an array of literal keys.", "oneOf": [ { "type": "string" }, { "items": { "type": "string" }, "type": "array" } ] }, "grokHelperRules": { "default": [], "description": "Helper rules scoped to this rule set", "items": { "description": "Helper rules scoped to this rule set", "type": "string" }, "type": "array" }, "grokParsingRules": { "default": [], "description": "Grok parsing rules for this rule set", "items": { "description": "Grok parsing rules for this rule set", "type": "string" }, "type": "array" }, "predicate": { "$ref": "#/$defs/EventPredicate" } }, "type": "object" }, "NewRelicLogAgentSource": { "properties": { "integrationId": { "description": "The integration id for the observability vendor.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offsetResetStrategy": { "default": "LATEST", "description": "Strategy for resetting Kafka consumer offset when no committed offset exists or has expired. EARLIEST reads from oldest available offset (prevents data loss on restart after retention period). LATEST skips to newest offset (current behavior).", "enum": [ "EARLIEST", "LATEST", "NONE" ], "type": "string" }, "type": { "description": "Reads log events from Grepr's New Relic collection agent. This is used to pre-process logs before being sent to New Relic.", "enum": [ "newrelic-log-agent-source" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "NewRelicLogSink": { "properties": { "additionalAttributes": { "additionalProperties": { "description": "Additional attributes to add to the logs when writing to New Relic. Gets combined with the integration's additionalAttributes.", "type": "string" }, "default": {}, "description": "Additional attributes to add to the logs when writing to New Relic. Gets combined with the integration's additionalAttributes.", "type": "object" }, "integrationId": { "description": "The New Relic integration id.", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Writes logs to NewRelic.", "enum": [ "newrelic-log-sink" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "NewRelicQueryPredicate": { "properties": { "query": { "default": "", "description": "The New Relic query used by the predicate. See https://docs.newrelic.com/docs/logs/ui-data/query-syntax-logs/ ", "type": "string" }, "type": { "description": "A predicate that checks if an event matches a New Relic query.", "enum": [ "newrelic-query" ], "type": "string" } }, "required": [ "query", "type" ], "type": "object" }, "NrqlQueryPredicate": { "properties": { "query": { "default": "", "description": "The Nrql query used by the predicate. See https://docs.newrelic.com/docs/nrql", "type": "string" }, "strict": { "default": true, "description": "Whether the query should be parsed in strict mode.", "type": "boolean" }, "type": { "description": "A predicate that checks if an event matches an NRQL query.", "enum": [ "nrql-query" ], "type": "string" } }, "required": [ "query", "type" ], "type": "object" }, "ObjectMetricsPassthrough": { "description": "When an object is anomalous, de-aggregate its raw datapoints alongside the per-cohort aggregate output, under a suffixed metric name.", "properties": { "enabled": { "default": true, "description": "Whether anomalous objects are de-aggregated (passed through).", "type": "boolean" }, "metricSuffix": { "default": ".detail", "description": "Suffix appended to passthrough emits' metric names (e.g. 'cpu.usage' becomes 'cpu.usage.detail'). May be empty to keep the original metric name. Must not collide with any aggregation 'as' suffix on the same cohort calc.", "type": "string" } }, "required": [ "metricSuffix" ], "type": "object" }, "ObjectsConfig": { "description": "Object-identity configuration.", "properties": { "identifyingAttributes": { "default": [], "description": "Level-prefixed attribute keys that identify an object. Each key must have a 'resource.', 'scope.', or 'series.' prefix.", "items": { "description": "Level-prefixed attribute keys that identify an object. Each key must have a 'resource.', 'scope.', or 'series.' prefix.", "type": "string" }, "maxItems": 2147483647, "minItems": 1, "type": "array", "uniqueItems": true }, "metadataAttributes": { "default": [], "description": "Level-prefixed attribute keys that describe an object but may change.", "items": { "description": "Level-prefixed attribute keys that describe an object but may change.", "type": "string" }, "type": "array", "uniqueItems": true }, "metricsFilter": { "$ref": "#/$defs/FilterPrimitive" } }, "required": [ "identifyingAttributes" ], "type": "object" }, "Operation": { "description": "Base class of all Operations", "oneOf": [ { "$ref": "#/$defs/LogsEventSampler" }, { "$ref": "#/$defs/LogsBranch" }, { "$ref": "#/$defs/LogsFilter" }, { "$ref": "#/$defs/GrokParser" }, { "$ref": "#/$defs/JsonLogProcessor" }, { "$ref": "#/$defs/LogAttributesRemapper" }, { "$ref": "#/$defs/LogReducer" }, { "$ref": "#/$defs/LogTransformAction" }, { "$ref": "#/$defs/MaskingOperator" }, { "$ref": "#/$defs/PatternMatcher" }, { "$ref": "#/$defs/LogsIcebergTableSink" }, { "$ref": "#/$defs/PatternLookupIcebergTableSink" }, { "$ref": "#/$defs/EventDedupIcebergTableSink" }, { "$ref": "#/$defs/VendorLogEventDedupIcebergTableSink" }, { "$ref": "#/$defs/SpanDedupIcebergTableSink" }, { "$ref": "#/$defs/SpansIcebergTableSink" }, { "$ref": "#/$defs/LogsIcebergTableSource" }, { "$ref": "#/$defs/AgentSessionsIcebergTableSource" }, { "$ref": "#/$defs/AgentSessionEventsIcebergTableSource" }, { "$ref": "#/$defs/MetricsIcebergTableSource" }, { "$ref": "#/$defs/TracesIcebergTableSource" }, { "$ref": "#/$defs/SpansBackfillIcebergTableSource" }, { "$ref": "#/$defs/MetricsIcebergTableSink" }, { "$ref": "#/$defs/MetricDataRawIcebergTableSink" }, { "$ref": "#/$defs/DatadogLogCloudSource" }, { "$ref": "#/$defs/DatadogLogAgentSource" }, { "$ref": "#/$defs/DatadogTraceAgentSource" }, { "$ref": "#/$defs/GreprVendorSource" }, { "$ref": "#/$defs/GreprMetricsSource" }, { "$ref": "#/$defs/DatadogLogSink" }, { "$ref": "#/$defs/DatadogTraceSink" }, { "$ref": "#/$defs/NewRelicLogSink" }, { "$ref": "#/$defs/SplunkLogSink" }, { "$ref": "#/$defs/SumoLogSource" }, { "$ref": "#/$defs/SumoLogSink" }, { "$ref": "#/$defs/OtlpLogSink" }, { "$ref": "#/$defs/OtlpTraceSink" }, { "$ref": "#/$defs/IcebergLogsReplaySource" }, { "$ref": "#/$defs/LogsBackfillFlinkSource" }, { "$ref": "#/$defs/LogsRuleEngine" }, { "$ref": "#/$defs/ReducerLogsQuerySource" }, { "$ref": "#/$defs/LogsSynchronousSink" }, { "$ref": "#/$defs/AgentSessionsSynchronousSink" }, { "$ref": "#/$defs/MetricsSynchronousSink" }, { "$ref": "#/$defs/VariantSynchronousSink" }, { "$ref": "#/$defs/SpansSynchronousSink" }, { "$ref": "#/$defs/QuerySink" }, { "$ref": "#/$defs/AgentSignalSink" }, { "$ref": "#/$defs/DiscardingSink" }, { "$ref": "#/$defs/GreprPipeLogSource" }, { "$ref": "#/$defs/GreprPipeLogSink" }, { "$ref": "#/$defs/DatadogMetricsSink" }, { "$ref": "#/$defs/LegacyDatadogMetricsSink" }, { "$ref": "#/$defs/AthenaAnalyticsSource" }, { "$ref": "#/$defs/GreprReducerLogSource" }, { "$ref": "#/$defs/AthenaAgentSessionsSource" }, { "$ref": "#/$defs/GreprRawLogsSource" }, { "$ref": "#/$defs/GreprRawSpanSource" }, { "$ref": "#/$defs/TrinoAnalyticsSource" }, { "$ref": "#/$defs/TrinoReducerLogSource" }, { "$ref": "#/$defs/TrinoRawLogsSource" }, { "$ref": "#/$defs/TrinoRawSpanSource" }, { "$ref": "#/$defs/SplunkLogAgentSource" }, { "$ref": "#/$defs/SplunkLogHttpSource" }, { "$ref": "#/$defs/NewRelicLogAgentSource" }, { "$ref": "#/$defs/OtlpLogAgentSource" }, { "$ref": "#/$defs/OtlpTraceAgentSource" }, { "$ref": "#/$defs/TraceSampler" }, { "$ref": "#/$defs/SpanTagger" }, { "$ref": "#/$defs/S3LogsFileSource" }, { "$ref": "#/$defs/CloudTrailLogsFileSource" }, { "$ref": "#/$defs/GreprUploadedLogFileSource" }, { "$ref": "#/$defs/TemplateOperation" }, { "$ref": "#/$defs/SqlOperation" }, { "$ref": "#/$defs/TraceReducer" }, { "$ref": "#/$defs/MetricReducer" }, { "$ref": "#/$defs/DatadogStatsSink" }, { "$ref": "#/$defs/LogsValuesSource" }, { "$ref": "#/$defs/LogRulesApplication" }, { "$ref": "#/$defs/TriggerActionOp" }, { "$ref": "#/$defs/MultiGrokParser" }, { "$ref": "#/$defs/AgentSessionAnalytics" }, { "$ref": "#/$defs/AgentLogProcessor" }, { "$ref": "#/$defs/AgentSpanProcessor" } ], "properties": { "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "type": "string" } }, "required": [ "name", "type" ], "type": "object", "x-tags": [ "Operations" ] }, "OtlpLogAgentSource": { "properties": { "integrationId": { "description": "The integration id for the observability vendor.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offsetResetStrategy": { "default": "LATEST", "description": "Strategy for resetting Kafka consumer offset when no committed offset exists or has expired. EARLIEST reads from oldest available offset (prevents data loss on restart after retention period). LATEST skips to newest offset (current behavior).", "enum": [ "EARLIEST", "LATEST", "NONE" ], "type": "string" }, "type": { "description": "Reads log events from Open Telemetry collector. This is used to pre-process logs before being sent to an Otel sink.", "enum": [ "otlp-log-agent-source" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "OtlpLogSink": { "properties": { "additionalAttributes": { "additionalProperties": { "description": "Additional attributes to add to the logs when writing to OTLP destination. Gets combined with the integration's additionalAttributes.", "type": "string" }, "default": {}, "description": "Additional attributes to add to the logs when writing to OTLP destination. Gets combined with the integration's additionalAttributes.", "type": "object" }, "integrationId": { "description": "The OTLP integration id.", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Writes processed logs to any OTLP-compatible destination.", "enum": [ "otlp-log-sink" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "OtlpTraceAgentSource": { "properties": { "integrationId": { "description": "The integration id for the observability vendor.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offsetResetStrategy": { "default": "LATEST", "description": "Strategy for resetting Kafka consumer offset when no committed offset exists or has expired. EARLIEST reads from oldest available offset (prevents data loss on restart after retention period). LATEST skips to newest offset (current behavior).", "enum": [ "EARLIEST", "LATEST", "NONE" ], "type": "string" }, "type": { "description": "Reads trace events from an OpenTelemetry collector. This is used to process traces from OTLP trace ingestion.", "enum": [ "otlp-trace-agent-source" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "OtlpTraceSink": { "properties": { "additionalAttributes": { "additionalProperties": { "description": "Additional attributes to add to the logs when writing to OTLP destination. Gets combined with the integration's additionalAttributes.", "type": "string" }, "default": {}, "description": "Additional attributes to add to the logs when writing to OTLP destination. Gets combined with the integration's additionalAttributes.", "type": "object" }, "integrationId": { "description": "The OTLP integration id.", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Writes processed logs to any OTLP-compatible destination.", "enum": [ "otlp-trace-sink" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "PatternLookupIcebergTableSink": { "properties": { "datasetId": { "description": "The id of the dataset to write to", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Writes event id to pattern id mappings to an Iceberg Table.", "enum": [ "pattern-lookup-iceberg-table-sink" ], "type": "string" } }, "required": [ "datasetId", "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "PatternMatcher": { "properties": { "attributeTokenization": { "default": "KEYS_AND_VALUES", "description": "Use attribute shape only, or shape and whole-value similarity tokens.", "enum": [ "KEYS_ONLY", "KEYS_AND_VALUES" ], "type": "string" }, "delimiters": { "default": [ ":", "#", "[", "]", "(", ")", "{", "}", "|", ",", ";", "\"", "'", " ", "\t", "\n", "\r", "&", "=", "?", "!", "+", "*", "/", "<", ">", "%", "^", "~", "`" ], "description": "Characters to use for splitting tokens.", "items": { "description": "Characters to use for splitting tokens.", "title": "Token delimiters", "type": "string" }, "title": "Token delimiters", "type": "array" }, "emitNewPatternSignals": { "default": false, "description": "Whether this operation may emit LogPatternSignal events to the agent-service when new patterns are detected or replayed. Must be enabled before an agent can subscribe to this pipeline.", "title": "Emit new-pattern signals", "type": "boolean" }, "enabledMasks": { "default": [ "ipport", "timestamp", "uuid", "number" ], "description": "Masks that are enabled for tokenizing messages.", "items": { "default": "[\"ipport\",\"timestamp\",\"uuid\",\"number\"]", "description": "Masks that are enabled for tokenizing messages.", "title": "Enabled masks", "type": "string" }, "title": "Enabled masks", "type": "array" }, "excludedAttributePrefixes": { "default": [], "description": "Excluded attribute prefixes as arrays of literal key segments. Does not affect partition-by values or output attributes.", "items": { "description": "Excluded attribute prefixes as arrays of literal key segments. Does not affect partition-by values or output attributes.", "items": { "description": "Excluded attribute prefixes as arrays of literal key segments. Does not affect partition-by values or output attributes.", "type": "string" }, "type": "array" }, "type": "array" }, "includedAttributePrefixes": { "default": [], "description": "Included attribute prefixes as arrays of literal key segments. Empty selects all. Array elements are traversed without indices.", "items": { "description": "Included attribute prefixes as arrays of literal key segments. Empty selects all. Array elements are traversed without indices.", "items": { "description": "Included attribute prefixes as arrays of literal key segments. Empty selects all. Array elements are traversed without indices.", "type": "string" }, "type": "array" }, "type": "array" }, "masks": { "default": [ [ "ipport", "(?:\\d{1,3}\\.){3}\\d{1,3}(?::\\d{1,5})?" ], [ "timestamp", "(?:(?:\\d{4}-\\d{2}-\\d{2}(?:T|\\s)\\d{2}:\\d{2}:\\d{2}(?:[.,]\\d{1,12})?(?:Z|(?:[\\+\\-]\\d{2}:?\\d{2})|\\sUTC)?)|(?:\\d{1,4}/\\d{1,2}/\\d{1,4}(,?\\s\\d{1,2}:\\d{2}:\\d{1,2}(?:[.,]\\d{1,12})?(?:\\s?(?:[AP]M))?)?)|(?:\\d{1,2}:\\d{2}:\\d{1,2}(?:[.,]\\d{1,12})?(?:\\s?(?:[AP]M))?)|(?:\\d{2}/[A-Za-z]{3}/\\d{4}(?:[:\\s]\\d{2}:\\d{2}:\\d{2}(?:\\s\\+[0-9]{4})?)?))" ], [ "uuid", "(?:^|(?(?:(?:\\d{1,100})?(?:\\.\\d{1,100})(?:[eE][\\-\\+]?\\d{1,100}))|(?:(?:\\d{1,100})?(?:\\.\\d{1,100}))|(?:\\d{1,100}))))(?:(?!\\w)|$)" ], [ "awsarn", "arn:aws(?:-[a-z]+-[a-z]+)?:[a-zA-Z0-9-]+:(?:[a-z0-9-]+:)?(?:[0-9]{12})?:[a-zA-Z0-9-_./]+(?::[a-zA-Z0-9-_./]+)*" ], [ "awstoken", "(?:IQoJb3JpZ2luX[A-Za-z0-9+/]{10,20})[A-Za-z0-9+/]{800,1100}" ] ], "description": "Set of masks that can be applied to messages before tokenizing them. These masks are specified as pairs of (name, regex).", "items": { "default": "[[\"ipport\", \"(?:\\d{1,3}\\.){3}\\d{1,3}(?::\\d{1,5})?\"],[\"timestamp\", \"(?:(?:\\d{4}-\\d{2}-\\d{2}(?:T|\\s)\\d{2}:\\d{2}:\\d{2}(?:[.,]\\d{1,12})?(?:Z|(?:[\\+\\-]\\d{2}:?\\d{2})|\\sUTC)?)|(?:\\d{1,4}/\\d{1,2}/\\d{1,4}(,?\\s\\d{1,2}:\\d{2}:\\d{1,2}(?:[.,]\\d{1,12})?(?:\\s?(?:[AP]M))?)?)|(?:\\d{1,2}:\\d{2}:\\d{1,2}(?:[.,]\\d{1,12})?(?:\\s?(?:[AP]M))?)|(?:\\d{2}/[A-Za-z]{3}/\\d{4}(?:[:\\s]\\d{2}:\\d{2}:\\d{2}(?:\\s\\+[0-9]{4})?)?))\"],[\"uuid\", \"(?:^|(?(?:(?:\\d{1,100})?(?:\\.\\d{1,100})(?:[eE][\\-\\+]?\\d{1,100}))|(?:(?:\\d{1,100})?(?:\\.\\d{1,100}))|(?:\\d{1,100}))))(?:(?!\\w)|$)\"],[\"awsarn\", \"arn:aws(?:-[a-z]+-[a-z]+)?:[a-zA-Z0-9-]+:(?:[a-z0-9-]+:)?(?:[0-9]{12})?:[a-zA-Z0-9-_./]+(?::[a-zA-Z0-9-_./]+)*\"],[\"awstoken\", \"(?:IQoJb3JpZ2luX[A-Za-z0-9+/]{10,20})[A-Za-z0-9+/]{800,1100}\"]]", "description": "Set of masks that can be applied to messages before tokenizing them. These masks are specified as pairs of (name, regex).", "items": { "default": "[[\"ipport\", \"(?:\\d{1,3}\\.){3}\\d{1,3}(?::\\d{1,5})?\"],[\"timestamp\", \"(?:(?:\\d{4}-\\d{2}-\\d{2}(?:T|\\s)\\d{2}:\\d{2}:\\d{2}(?:[.,]\\d{1,12})?(?:Z|(?:[\\+\\-]\\d{2}:?\\d{2})|\\sUTC)?)|(?:\\d{1,4}/\\d{1,2}/\\d{1,4}(,?\\s\\d{1,2}:\\d{2}:\\d{1,2}(?:[.,]\\d{1,12})?(?:\\s?(?:[AP]M))?)?)|(?:\\d{1,2}:\\d{2}:\\d{1,2}(?:[.,]\\d{1,12})?(?:\\s?(?:[AP]M))?)|(?:\\d{2}/[A-Za-z]{3}/\\d{4}(?:[:\\s]\\d{2}:\\d{2}:\\d{2}(?:\\s\\+[0-9]{4})?)?))\"],[\"uuid\", \"(?:^|(?(?:(?:\\d{1,100})?(?:\\.\\d{1,100})(?:[eE][\\-\\+]?\\d{1,100}))|(?:(?:\\d{1,100})?(?:\\.\\d{1,100}))|(?:\\d{1,100}))))(?:(?!\\w)|$)\"],[\"awsarn\", \"arn:aws(?:-[a-z]+-[a-z]+)?:[a-zA-Z0-9-]+:(?:[a-z0-9-]+:)?(?:[0-9]{12})?:[a-zA-Z0-9-_./]+(?::[a-zA-Z0-9-_./]+)*\"],[\"awstoken\", \"(?:IQoJb3JpZ2luX[A-Za-z0-9+/]{10,20})[A-Za-z0-9+/]{800,1100}\"]]", "description": "Set of masks that can be applied to messages before tokenizing them. These masks are specified as pairs of (name, regex).", "title": "Masks", "type": "string" }, "title": "Masks", "type": "array" }, "title": "Masks", "type": "array" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "partitionByAttributePaths": { "default": [], "description": "Attribute paths as arrays of keys. Use for unambiguous nested vs flat attributes. Example: [[\"user\", \"id\"]] for nested user.id, [[\"user.id\"]] for flat attribute named 'user.id'", "items": { "items": { "type": "string" }, "type": "array" }, "title": "Partition by attribute paths (array format)", "type": "array", "uniqueItems": true }, "partitionByAttributes": { "default": [], "items": { "description": "Attributes by which to group logs for pattern matching. For example, to match patterns separately by an attribute, specify `x.y`, which would be interpreted as a JSON path under attributes. These work like 'GROUP BY' in SQL.", "title": "Partition by attributes", "type": "string" }, "type": "array" }, "partitionByTags": { "default": [], "items": { "description": "Tag keys by which to group logs for pattern matching. For example, to match patterns separately per host, specify `host`. These work like 'GROUP BY' in SQL.", "title": "Partition by tags", "type": "string" }, "type": "array" }, "similarityThreshold": { "default": 70.0, "description": "Controls how close a set of tokens are to a pattern before it is considered a match. Calculated as the percent of matching tokens between a pattern and a message.", "format": "double", "maximum": 100, "minimum": 20, "title": "Similarity threshold", "type": "number" }, "tokenizationInput": { "default": "MESSAGE_ONLY", "description": "Selects message text, attributes, both, or message text with an attributes fallback.", "enum": [ "MESSAGE_ONLY", "ATTRIBUTES_ONLY", "MESSAGE_AND_ATTRIBUTES", "AUTO" ], "type": "string" }, "type": { "description": "Matches log patterns using an iterative feedback loop. Events with known patterns skip the global reducer for improved efficiency.", "enum": [ "pattern-matcher" ], "type": "string" } }, "required": [ "delimiters", "enabledMasks", "masks", "name", "type" ], "type": "object", "x-tags": [ "Transforms" ] }, "PatternRuleConfig": { "description": "Configuration for a pattern rule.", "properties": { "enabled": { "type": "boolean" }, "order": { "format": "int32", "type": "integer" } }, "type": "object" }, "PipelineStatus": { "description": "Current operational status and health of the pipeline", "properties": { "error": { "$ref": "#/$defs/ErrorDetails" }, "health": { "enum": [ "HEALTHY", "STABILIZING", "UNHEALTHY", "UNKNOWN" ], "type": "string" }, "isRolledBack": { "type": "boolean" }, "message": { "type": "string" } }, "type": "object" }, "PreserveAllAttributesMergeStrategy": { "properties": { "limit": { "format": "int32", "minimum": 1, "type": "integer" }, "type": { "description": "PreserveAllAttributesMergeStrategy: Collects all incoming values/objects into a collection. If an incoming value is a collection, its elements are unpacked and added individually. The 'limit' field defines when an attribute size will trigger a cluster overflow emission. The 'unique' flag determines if the collection behaves like a Set or a List.", "enum": [ "preserve" ], "type": "string" }, "unique": { "type": "boolean" } }, "required": [ "type" ], "type": "object" }, "QuantileSamplingTier": { "description": "List of quantile sampling tiers for performance-based sampling. Each tier defines a percentile threshold, sampling rate, and label. Traces ABOVE each quantile get the corresponding sampling rate and are labeled with the tier's label. Evaluated in descending quantile order. A tier at quantile 0.0 is a catch-all that matches unconditionally, giving the fastest traces a baseline rate; without one, traces below the lowest configured quantile are dropped.", "properties": { "label": { "description": "Human-readable label for this tier, used as the percentile bucket value in the enriched span data. This allows you to categorize traces into named buckets for querying and analysis.", "title": "Tier Label", "type": "string" }, "quantile": { "description": "The percentile threshold for this tier (0.0 = 0th percentile, 0.5 = 50th percentile, 0.99 = 99th percentile). Traces with duration ABOVE this percentile will be evaluated for this sampling rate.", "exclusiveMaximum": false, "exclusiveMinimum": false, "format": "double", "maximum": 1.0, "minimum": 0.0, "title": "Quantile Threshold", "type": "number" }, "samplingRate": { "description": "The sampling rate to apply for traces that exceed this quantile threshold. 0.0 = 0% (no sampling), 1.0 = 100% (always sample).", "exclusiveMaximum": false, "exclusiveMinimum": false, "format": "double", "maximum": 1.0, "minimum": 0.0, "title": "Sampling Rate", "type": "number" } }, "required": [ "label", "quantile", "samplingRate" ], "title": "Quantile Sampling Tiers", "type": "object" }, "QuerySink": { "properties": { "columns": { "default": [], "description": "Ordered CSV column names; required only for CSV artifacts", "items": { "description": "Ordered CSV column names; required only for CSV artifacts", "type": "string" }, "type": "array" }, "format": { "default": "COMPRESSED_JSON", "description": "Artifact serialization format", "enum": [ "COMPRESSED_JSON", "JSON_LINES", "CSV" ], "type": "string" }, "integrationId": { "description": "The integration to use for writing to the file", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "path": { "description": "Destination path relative to the selected warehouse root", "type": "string" }, "type": { "description": "Write a bounded artifact to a warehouse provided by the given integration id.", "enum": [ "query-sink" ], "type": "string" } }, "required": [ "format", "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "ReducerLogsQuerySource": { "properties": { "datasetId": { "description": "The ID of the dataset to read data from.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "end": { "description": "End of time interval to query data for.", "format": "date-time", "type": "string" }, "limit": { "default": 2500, "description": "The maximum number of rows to process", "format": "int32", "type": "integer" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offset": { "default": 0, "description": "Offset on the number of rows to process", "format": "int32", "minimum": 0, "type": "integer" }, "processedLogsTableName": { "description": "The name of the table containing processed logs.", "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "query": { "$ref": "#/$defs/query" }, "reductionInterval": { "default": "PT2M", "description": "The interval used by the Log Reducer for the query. Uses ISO 8601 format for intervals.", "format": "ISO-8601", "type": "string" }, "sortOrder": { "default": "ASCENDING", "description": "The order in which the rows should be sorted by", "enum": [ "ASCENDING", "DESCENDING", "UNSORTED" ], "type": "string" }, "start": { "description": "Start of time interval to query data for.", "format": "date-time", "type": "string" }, "type": { "description": "Queries raw and processed logs from a reducer pipeline.", "enum": [ "reducer-logs-iceberg-table-source" ], "type": "string" }, "variables": { "additionalProperties": { "$ref": "#/$defs/Any" }, "default": {}, "description": "Variables that can be used to modify the query while parsed", "type": "object" } }, "required": [ "datasetId", "end", "name", "query", "reductionInterval", "start", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "RemoveKeyAttributeAction": { "properties": { "order": { "default": 0, "description": "Action order. Lower is applied first.", "format": "int32", "type": "integer" }, "targetPath": { "description": "The path to the attribute to modify.", "type": "string" }, "type": { "description": "Removes keys from event attributes. If the target is not present or is not a map, it's a no-op.", "enum": [ "attribute-remove-action" ], "type": "string" }, "values": { "description": "The keys to remove.", "items": { "description": "The keys to remove.", "type": "string" }, "type": "array", "uniqueItems": true } }, "required": [ "targetPath", "type", "values" ], "type": "object" }, "S3LogsFileSource": { "properties": { "fileReadingStrategy": { "$ref": "#/$defs/FileReadingStrategy" }, "format": { "$ref": "#/$defs/FileFormat" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "pathPrefix": { "default": "", "description": "The s3 path under the provided bucket to monitor. Optional.In the case of CloudTrail logs, this is the path to the AWSLogs/ directory.", "type": "string" }, "s3IntegrationId": { "description": "Integration ID for the S3 bucket where Grepr will be reading data. This corresponds to the 's3-data-warehouse' integration type.", "type": "string" }, "streamingPollInterval": { "default": "PT5S", "description": "The interval at which Grepr will check for new files in the S3 bucket. This is only applicable in streaming mode.", "format": "ISO-8601", "type": "string" }, "type": { "description": "Reads generic data from an S3 path. Each record will need to be mapped to the Grepr data model before being usable.", "enum": [ "s3-file-source" ], "type": "string" } }, "required": [ "format", "name", "s3IntegrationId", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "SamplingAttributesMergeStrategy": { "properties": { "limit": { "format": "int32", "minimum": 1, "type": "integer" }, "type": { "description": "SamplingAttributesMergeStrategy: Collects up to 'limit' samples. The 'unique' flag determines if samples must be distinct.", "enum": [ "sample" ], "type": "string" }, "unique": { "type": "boolean" } }, "required": [ "type" ], "type": "object" }, "SamplingConfig": { "default": { "type": "constant-sampling" }, "description": "Determines how often samples should be emitted", "oneOf": [ { "$ref": "#/$defs/ConstantSampling" }, { "$ref": "#/$defs/WindowBasedLogarithmicSampling" } ], "title": "Sampling Algorithm", "type": "object" }, "SiblingMergeRule": { "description": "Merges sibling spans that share an identical subtree signature and match a CompleteSpan SQL predicate. The earliest-start match is kept (with its children); the other matching same-signature siblings are removed and counted under grepr.merged_siblings.", "properties": { "predicate": { "description": "Boolean SQL expression evaluated per span over the CompleteSpan schema. Uses the same fields and functions as head sampling predicates: top-level columns such as servicename, nested fields such as span.operationName, and VARIANT_VALUE(...) for span/resource attributes.", "type": "string" } }, "required": [ "predicate" ], "title": "Sibling Merge Rules", "type": "object" }, "SpanDedupIcebergTableSink": { "properties": { "datasetId": { "description": "The id of the dataset to write to", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Writes span identity tuples to an Iceberg table to keep track of which spans have been sent to a particular vendor sink.", "enum": [ "spans-dedup-iceberg-table-sink" ], "type": "string" }, "vendorSinkId": { "pattern": "[a-z0-9]{1,13}", "type": "string" } }, "required": [ "datasetId", "name", "type", "vendorSinkId" ], "type": "object", "x-tags": [ "Sinks" ] }, "SpanDropRule": { "description": "Drops spans matching a CompleteSpan SQL predicate, along with their descendants.", "properties": { "predicate": { "description": "Boolean SQL expression evaluated per span over the CompleteSpan schema. Uses the same fields and functions as head sampling predicates: top-level columns such as servicename, nested fields such as span.operationName, and VARIANT_VALUE(...) for span/resource attributes.", "type": "string" } }, "required": [ "predicate" ], "title": "Span Drop Rules", "type": "object" }, "SpanHeadSamplingRule": { "description": "Head sampling rule evaluated per span. Matched spans are retained.", "properties": { "filter": { "$ref": "#/$defs/HeadSamplingFilter" }, "rate": { "description": "Fraction of matching spans/traces to retain, in [0.0, 1.0].", "exclusiveMaximum": false, "exclusiveMinimum": false, "format": "double", "maximum": 1.0, "minimum": 0.0, "type": "number" } }, "required": [ "rate" ], "title": "Span Head Sampling Rules", "type": "object" }, "SpanTagger": { "description": "Overlays a fixed set of attributes onto every span passing through this operation. Used by the trace draft pipeline to stamp stage tags on previewed spans.", "properties": { "attributes": { "additionalProperties": { "description": "Attributes to overlay onto each span's attributes map.", "title": "Attributes", "type": "string" }, "description": "Attributes to overlay onto each span's attributes map.", "title": "Attributes", "type": "object" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Overlays a fixed set of attributes onto every span passing through.", "enum": [ "span-tagger" ], "type": "string" } }, "required": [ "attributes", "name", "type" ], "type": "object", "x-tags": [ "Transforms" ] }, "SpansBackfillIcebergTableSource": { "properties": { "datasetId": { "description": "The ID of the dataset to read data from.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "end": { "description": "End of time interval to query data for.", "format": "date-time", "type": "string" }, "limit": { "default": 2500, "description": "The maximum number of rows to process", "format": "int32", "type": "integer" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offset": { "default": 0, "description": "Offset on the number of rows to process", "format": "int32", "minimum": 0, "type": "integer" }, "query": { "$ref": "#/$defs/query" }, "sortOrder": { "default": "ASCENDING", "description": "The order in which the rows should be sorted by", "enum": [ "ASCENDING", "DESCENDING", "UNSORTED" ], "type": "string" }, "start": { "description": "Start of time interval to query data for.", "format": "date-time", "type": "string" }, "type": { "description": "Reads spans from an Iceberg table for backfill, skipping spans already sent to the given vendor sinks (idempotent backfill source).", "enum": [ "spans-backfill-iceberg-table-source" ], "type": "string" }, "variables": { "additionalProperties": { "$ref": "#/$defs/Any" }, "default": {}, "description": "Variables that can be used to modify the query while parsed", "type": "object" }, "vendorSinkIntegrationIds": { "default": [], "items": { "description": "The list of vendor integration IDs, if any, that will consume the data from the source.", "pattern": "[a-z0-9]{1,13}", "title": "Vendor Sink Integration IDs", "type": "string" }, "type": "array" } }, "required": [ "datasetId", "end", "name", "query", "start", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "SpansIcebergTableSink": { "properties": { "datasetId": { "description": "The id of the dataset to write to", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Writes individual spans to the raw spans Iceberg table.", "enum": [ "spans-iceberg-table-sink" ], "type": "string" } }, "required": [ "datasetId", "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "SpansSynchronousSink": { "properties": { "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Sink for returning results to the caller.", "enum": [ "spans-sync-sink" ], "type": "string" } }, "required": [ "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "SplunkLogAgentSource": { "properties": { "integrationId": { "description": "The integration id for the observability vendor.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offsetResetStrategy": { "default": "LATEST", "description": "Strategy for resetting Kafka consumer offset when no committed offset exists or has expired. EARLIEST reads from oldest available offset (prevents data loss on restart after retention period). LATEST skips to newest offset (current behavior).", "enum": [ "EARLIEST", "LATEST", "NONE" ], "type": "string" }, "type": { "description": "Reads log events from Splunk HEC collector. This is used to pre-process logs before being sent to Splunk.", "enum": [ "splunk-log-agent-source" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "SplunkLogHttpSource": { "properties": { "filterQuery": { "default": "", "description": "The Splunk query filter to use when reading logs from Splunk. This is concatenated with the one from the integration.", "maxLength": 1024, "minLength": 0, "type": "string" }, "integrationId": { "description": "The Splunk integration id.", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Pulls log events from Splunk server for processing using a specified query.", "enum": [ "splunk-log-http-source" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "SplunkLogSink": { "properties": { "additionalTags": { "default": [], "description": "Additional tags to add to the logs when writing to Splunk. Gets combined with the integration's additionalTags.", "items": { "type": "string" }, "type": "array" }, "defaultIndex": { "description": "Default index to be set when writing to Splunk if no index is set.", "type": "string" }, "indexOverride": { "description": "Override index to be set when writing to Splunk", "type": "string" }, "integrationId": { "description": "The Splunk integration id.", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Writes processed events to splunk.", "enum": [ "splunk-log-sink" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "SqlExecutable": { "description": "Base class for SQL statements", "oneOf": [ { "$ref": "#/$defs/SqlViewStatement" }, { "$ref": "#/$defs/SqlOutputStatement" }, { "$ref": "#/$defs/SqlIoStatement" } ], "properties": { "eventTimeAttribute": { "type": "string" }, "materialized": { "type": "boolean" }, "type": { "type": "string" } }, "required": [ "type" ], "type": "object" }, "SqlIoStatement": { "description": "SQL statement that performs side effects like INSERT INTO", "properties": { "eventTimeAttribute": { "type": "string" }, "materialized": { "type": "boolean" }, "sqlQuery": { "description": "The SQL query to execute. Can reference tables created by previous statements by their tableName, as well as the 'traces' input table and available datasets.", "type": "string" } }, "required": [ "sqlQuery" ], "type": "object" }, "SqlOperation": { "description": "Processes data through a sequence of SQL statements executed in order. Supports VIEW statements that create temporary tables, OUTPUT statements that produce DataStream results, and IO statements that perform side effects.", "properties": { "availableDatasets": { "default": [], "description": "IDs of datasets whose tables can be referenced in SQL statements. These will be registered as queryable tables in the SQL environment. The tables from each dataset will appear in a separate namespace based on the dataset name.", "items": { "description": "IDs of datasets whose tables can be referenced in SQL statements. These will be registered as queryable tables in the SQL environment. The tables from each dataset will appear in a separate namespace based on the dataset name.", "type": "string" }, "type": "array", "uniqueItems": true }, "globalStateTtl": { "default": "PT2M", "description": "Global time-to-live for operation state. When calculating aggregations or joins in streaming mode, Grepr pipelines will keep track of some state (such as the count and sum of values for an averaging aggregation). To prevent the size of the state from growing indefinitely, Grepr will set a default time-to-live value for any state. If state does not receive updates after this TTL, it will be considered idle and the state will be cleared. Aggregations for will be reset for the idle group for example.", "format": "ISO-8601", "type": "string" }, "inputs": { "additionalProperties": { "description": "Data types that are acceptable as inputs and outputs to SQL operations. See [SQL transform supported data types](/transforms/sql-transform/data-types) for the SQL row schemas. The `COMPLETE_SPAN` SQL row schema uses SQL field names that differ from the REST JSON property names documented in [CompleteSpan](/apis/api-spec#schema/CompleteSpan).", "enum": [ "VARIANT", "LOG_EVENT", "COMPLETE_SPAN", "METRIC_DATA", "WIDE_METRIC_DATA" ], "type": "string" }, "default": {}, "description": "Input table names that can be referenced in SQL statements. Each input table corresponds to an input stream that is connected to this operation in the job graph. All connected input types must be compatible with the SQL operations. Each type specifies what the schema of the resulting table that is available for the SQL statements looks like. For `COMPLETE_SPAN`, the table schema uses SQL row field names, which differ from the REST JSON property names in the `CompleteSpan` schema.", "type": "object" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "statements": { "default": [], "description": "List of SQL statements to execute in order. Each statement can reference tables created by previous statements, the input tables, and any tables from the available datasets.", "items": { "$ref": "#/$defs/SqlExecutable" }, "maxItems": 2147483647, "minItems": 1, "type": "array" }, "type": { "description": "Processes data through a sequence of SQL statements.", "enum": [ "sql-operation" ], "type": "string" }, "watermarkDelay": { "default": "PT5S", "description": "Delay for watermark generation. Default is 5 seconds. Watermarks are used to track event time progress in streaming jobs. The watermark is usually the maximum event time seen by a processing task minus this delay. Watermarks are used to trigger time-based operations like windowing. This delay defines how far behind the system can be in processing events before it considers the event time to be 'late'. Late events would not be included in windowing operations that might have already been closed (ie where the data is already sent). This also means that the results of windowing operations will be delayed by this delay, as the system waits for the watermark to catch up. For more information, see the Flink documentation on watermarks.", "format": "ISO-8601", "type": "string" } }, "required": [ "name", "statements", "type" ], "type": "object", "x-tags": [ "Transforms" ] }, "SqlOutputStatement": { "description": "SQL statement that produces a DataStream output", "properties": { "eventTimeAttribute": { "type": "string" }, "materialized": { "type": "boolean" }, "outputName": { "description": "Name of the output stream that this statement produces. Used to identify the output DataStream in the SqlStatementsExecutor results. Must be unique across all OUTPUT statements within the operation.", "pattern": "^(?=.*_)[a-zA-Z_][a-zA-Z0-9_]*$", "type": "string" }, "outputType": { "description": "Data types that are acceptable as inputs and outputs to SQL operations. See [SQL transform supported data types](/transforms/sql-transform/data-types) for the SQL row schemas. The `COMPLETE_SPAN` SQL row schema uses SQL field names that differ from the REST JSON property names documented in [CompleteSpan](/apis/api-spec#schema/CompleteSpan).", "enum": [ "VARIANT", "LOG_EVENT", "COMPLETE_SPAN", "METRIC_DATA", "WIDE_METRIC_DATA" ], "type": "string" }, "sqlQuery": { "description": "The SQL query to execute. Can reference tables created by previous statements by their tableName, as well as the 'traces' input table and available datasets.", "type": "string" } }, "required": [ "outputName", "outputType", "sqlQuery" ], "type": "object" }, "SqlViewStatement": { "description": "SQL statement that creates a queryable temporary view", "properties": { "eventTimeAttribute": { "description": "Event time attribute column name for watermark re-establishment after materialization.", "type": "string" }, "materialized": { "type": "boolean" }, "sqlQuery": { "description": "The SQL query to execute. Can reference tables created by previous statements by their tableName, as well as the 'traces' input table and available datasets.", "type": "string" }, "tableName": { "description": "Name of the output table that this statement produces. Subsequent statements can reference this table name directly in their SQL. Must be unique within the operation.", "pattern": "^[a-zA-Z_][a-zA-Z0-9_]*$", "type": "string" } }, "required": [ "sqlQuery", "tableName" ], "type": "object" }, "StatusMapping": { "description": "Maps raw status values to severities.", "properties": { "debug": { "$ref": "#/$defs/StatusValues" }, "error": { "$ref": "#/$defs/StatusValues" }, "fatal": { "$ref": "#/$defs/StatusValues" }, "info": { "$ref": "#/$defs/StatusValues" }, "numberRanges": { "default": [], "description": "Inclusive ranges mapping numeric status values to severities.", "items": { "$ref": "#/$defs/StatusNumberRange" }, "type": "array" }, "trace": { "$ref": "#/$defs/StatusValues" }, "warn": { "$ref": "#/$defs/StatusValues" } }, "type": "object" }, "StatusNumberRange": { "description": "Maps numeric status values within an inclusive range to a severity.", "properties": { "max": { "description": "Inclusive upper bound.", "format": "int64", "type": "integer" }, "min": { "description": "Inclusive lower bound.", "format": "int64", "type": "integer" }, "severity": { "description": "Severity assigned to numbers in a status number range.", "enum": [ "TRACE", "DEBUG", "INFO", "WARN", "ERROR", "FATAL", "KEEP_NUMBER" ], "type": "string" } }, "required": [ "max", "min", "severity" ], "type": "object" }, "StatusValues": { "description": "Raw status strings that map to one severity. Matching is case-sensitive.", "properties": { "exact": { "default": [], "description": "Status strings that map to this severity when equal to the value.", "items": { "type": "string" }, "type": "array" }, "prefixes": { "default": [], "description": "Status strings that map to this severity when the value starts with them. An exact match wins over any prefix, and the longest matching prefix wins.", "items": { "type": "string" }, "type": "array" } }, "type": "object" }, "StreamFormatAny": { "properties": { "producedType": { "$ref": "#/$defs/TypeInformationAny" }, "splittable": { "type": "boolean" } }, "type": "object" }, "StructuredAnalyticsQuery": { "properties": { "end": { "description": "End of the time interval to query.", "format": "date-time", "type": "string" }, "from": { "description": "Logical table alias to query.", "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "groupBy": { "default": [], "description": "Grepr SQL expressions or projection aliases used for grouping. An expression may reference projection aliases.", "items": { "default": "[]", "description": "Grepr SQL expressions or projection aliases used for grouping. An expression may reference projection aliases.", "maxLength": 4096, "minLength": 0, "type": "string" }, "maxItems": 64, "minItems": 0, "type": "array" }, "having": { "description": "Optional Grepr SQL expression applied after aggregation. The expression may reference projection aliases.", "maxLength": 4096, "minLength": 0, "type": "string" }, "limit": { "default": 2500, "description": "Maximum number of result rows.", "format": "int32", "minimum": 1, "type": "integer" }, "orderBy": { "default": [], "description": "Ordering applied to the analytical results.", "items": { "$ref": "#/$defs/AnalyticsOrderBy" }, "maxItems": 64, "minItems": 0, "type": "array" }, "predicate": { "$ref": "#/$defs/EventPredicate" }, "select": { "description": "Expressions returned by the query.", "items": { "$ref": "#/$defs/AnalyticsProjection" }, "maxItems": 128, "minItems": 1, "type": "array" }, "start": { "description": "Start of the time interval to query.", "format": "date-time", "type": "string" }, "variables": { "additionalProperties": { "$ref": "#/$defs/Any" }, "default": {}, "description": "Variables available while parsing the predicate.", "type": "object" }, "window": { "$ref": "#/$defs/AnalyticsTimeWindow" } }, "required": [ "end", "from", "predicate", "select", "start" ], "type": "object" }, "SumAttributesMergeStrategy": { "properties": { "type": { "description": "SumAttributesMergeStrategy: Sums numeric attribute values.", "enum": [ "sum" ], "type": "string" } }, "required": [ "type" ], "type": "object" }, "SumoLogSink": { "properties": { "additionalAttributes": { "additionalProperties": { "description": "Additional attributes to add to the logs when writing to SumoLogic. Gets combined with the integration's additionalAttributes.", "type": "string" }, "default": {}, "description": "Additional attributes to add to the logs when writing to SumoLogic. Gets combined with the integration's additionalAttributes.", "type": "object" }, "integrationId": { "description": "The New Relic integration id.", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Writes processed logs to Sumo Logic.", "enum": [ "sumologic-log-sink" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "SumoLogSource": { "properties": { "integrationId": { "description": "The integration id for the observability vendor.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offsetResetStrategy": { "default": "LATEST", "description": "Strategy for resetting Kafka consumer offset when no committed offset exists or has expired. EARLIEST reads from oldest available offset (prevents data loss on restart after retention period). LATEST skips to newest offset (current behavior).", "enum": [ "EARLIEST", "LATEST", "NONE" ], "type": "string" }, "type": { "description": "Reads log events from SumoLogic HTTP Source collector. This is used to pre-process logs before being sent to SumoLogic.", "enum": [ "sumologic-log-agent-source" ], "type": "string" } }, "required": [ "integrationId", "name", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "TagAction": { "properties": { "modification": { "description": "Modification actions on tag values.", "enum": [ "ADD", "REMOVE", "SET", "DELETE" ], "type": "string" }, "order": { "default": 0, "description": "Action order. Lower is applied first.", "format": "int32", "type": "integer" }, "tagKey": { "description": "The key of the tag to add.", "type": "string" }, "type": { "description": "Modifies event tag values.", "enum": [ "tag-action" ], "type": "string" }, "values": { "default": [], "description": "The values of the tag to modify.", "items": { "description": "The values of the tag to modify.", "type": "string" }, "type": "array", "uniqueItems": true } }, "required": [ "modification", "tagKey", "type", "values" ], "type": "object" }, "TailSamplingConfig": { "description": "Optional configuration for histogram-based tail sampling. When provided, enables intelligent sampling based on trace duration percentiles calculated over sliding windows. Uses hierarchical trace signatures to group similar traces and applies configurable sampling rates based on performance tiers (fast, medium, slow, outliers).", "properties": { "bootstrapThreshold": { "default": 40, "description": "Number of traces to sample during bootstrap period before applying percentile-based sampling rules. This allows the system to gather initial data on trace durations before applying more complex sampling logic. This number will be multiplied by the parallelism of the pipeline, so the bootstrap traces may be higher as the pipeline expands for new trace signatures.", "format": "int32", "title": "Bootstrap Threshold", "type": "integer" }, "errorSamplingRate": { "default": 0.75, "description": "Sampling rate for traces that contain errors or failures. Error traces are often the most important for debugging and should typically have high sampling rates. Applied before quantile-based sampling.", "exclusiveMaximum": false, "exclusiveMinimum": false, "format": "double", "maximum": 1.0, "minimum": 0.0, "title": "Error Sampling Rate", "type": "number" }, "incompleteSamplingRate": { "default": 0.5, "description": "Sampling rate for incomplete/partial traces. Partial traces occur when some spans are missing, which can indicate data loss or system issues. Applied before quantile-based sampling.", "exclusiveMaximum": false, "exclusiveMinimum": false, "format": "double", "maximum": 1.0, "minimum": 0.0, "title": "Incomplete Sampling Rate", "type": "number" }, "keyAttributePaths": { "default": [ [ "service.name" ], [ "http.method" ] ], "description": "Array of attribute paths to extract key attributes from spans for hierarchical signature generation. Each inner array represents a sequence of keys to search for in the attributes map. These attributes are used to group traces by their structural patterns.", "items": { "default": [ [ "service.name" ], [ "http.method" ] ], "description": "Array of attribute paths to extract key attributes from spans for hierarchical signature generation. Each inner array represents a sequence of keys to search for in the attributes map. These attributes are used to group traces by their structural patterns.", "items": { "default": "[[\"service.name\"],[\"http.method\"]]", "description": "Array of attribute paths to extract key attributes from spans for hierarchical signature generation. Each inner array represents a sequence of keys to search for in the attributes map. These attributes are used to group traces by their structural patterns.", "title": "Key Attribute Paths", "type": "string" }, "title": "Key Attribute Paths", "type": "array" }, "title": "Key Attribute Paths", "type": "array" }, "longRunningTraceSamplingRate": { "default": 0.0, "description": "Sampling rate for traces force-emitted because they exceeded the configured maxSessionLength. Routed through a dedicated 'long_running' percentile bucket — distinct from the structural 'incomplete' bucket — so operators can monitor and tune separately.", "exclusiveMaximum": false, "exclusiveMinimum": false, "format": "double", "maximum": 1.0, "minimum": 0.0, "title": "Long-Running Trace Sampling Rate", "type": "number" }, "maxSessionLength": { "default": "PT1M", "description": "Upper bound on how long a single trace assembly session may accumulate spans in memory before being force-emitted. Protects against long-running traces that would otherwise hold spans in the assembly buffer indefinitely. When the cap is hit, the trace is classified as long-running and later spans form a new session. Must be strictly greater than maxTraceDelay.", "format": "ISO-8601", "type": "string" }, "maxTraceDelay": { "default": "PT20S", "description": "The maximum time to wait for all spans of a trace to arrive before assembling the trace. This determines the size of the tumbling window used for trace assembly. Traces that span longer than this duration may be assembled as partial traces. Should be set based on the expected maximum trace duration in your system. Large values may lead to memory issues if traces are too long and will delay sending traces to the sink by that amount. The pipeline may also fail if configured too high.", "format": "ISO-8601", "type": "string" }, "quantileSamplingTiers": { "default": [ { "label": "very_slow", "quantile": 0.99, "samplingRate": 0.8 }, { "label": "slow", "quantile": 0.95, "samplingRate": 0.1 }, { "label": "medium", "quantile": 0.5, "samplingRate": 0.05 }, { "label": "fast", "quantile": 0.0, "samplingRate": 0.01 } ], "description": "List of quantile sampling tiers for performance-based sampling. Each tier defines a percentile threshold, sampling rate, and label. Traces ABOVE each quantile get the corresponding sampling rate and are labeled with the tier's label. Evaluated in descending quantile order. A tier at quantile 0.0 is a catch-all that matches unconditionally, giving the fastest traces a baseline rate; without one, traces below the lowest configured quantile are dropped.", "items": { "$ref": "#/$defs/QuantileSamplingTier" }, "title": "Quantile Sampling Tiers", "type": "array" } }, "title": "Tail Sampling Configuration", "type": "object" }, "TemplateOperation": { "properties": { "draftMode": { "default": false, "description": "Set as a variable in the script scope, this input tells the script to run in 'draft' mode, which should enable additional outputs from various parts of the built pipeline, according to the Template's defined draft outputs.", "type": "boolean" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "templateId": { "description": "The ID of the template to use for this operation.", "type": "string" }, "templateInputs": { "additionalProperties": { "description": "Inputs to the template. Each entry in the map is added to the scope of the template javascript as a variable and can be accessed directly. In addition to the inputs, a 'user' object is also bound providing information about the current user.", "type": "object" }, "default": {}, "description": "Inputs to the template. Each entry in the map is added to the scope of the template javascript as a variable and can be accessed directly. In addition to the inputs, a 'user' object is also bound providing information about the current user.", "type": "object" }, "templateVersion": { "description": "The version of the template to use for this operation. Note that whether templates are forward- or backward-compatible are dependent on the template script, so updating or downgrading versions may result in an error in the job depending on the script.", "format": "int32", "type": "integer" }, "type": { "description": "Runs a template script to generate a subgraph running in place of the operation in the parent graph.", "enum": [ "template-operation" ], "type": "string" } }, "required": [ "name", "templateId", "templateVersion", "type" ], "type": "object", "x-tags": [ "Operations" ] }, "TimeGranularity": { "description": "Time-aggregation window and per-metric agg-fn overrides.", "properties": { "aggFnOverrides": { "additionalProperties": { "$ref": "#/$defs/AggType" }, "default": {}, "description": "Per-metric-name overrides for time aggregation.", "type": "object" }, "duration": { "default": "PT20S", "description": "Time-aggregation window; also the slide interval used by every aggregation.", "format": "ISO-8601", "type": "string" } }, "required": [ "duration" ], "type": "object" }, "TraceAction": { "description": "Base class for trace actions. Actions execute on traces matching SQL predicates after sampling decisions have been made.", "properties": { "actionId": { "description": "Unique identifier for this action within the TraceReducer. Must be alphanumeric with hyphens and underscores only.", "pattern": "^[a-zA-Z0-9_-]+$", "type": "string" }, "type": { "type": "string" } }, "required": [ "actionId", "type" ], "type": "object" }, "TraceHeadSamplingRule": { "deprecated": true, "description": "Deprecated. Head sampling rule evaluated per trace. Use traceHeadSamplingRate on TraceReducer instead.", "properties": { "filter": { "$ref": "#/$defs/HeadSamplingFilter" }, "rate": { "description": "Fraction of matching spans/traces to retain, in [0.0, 1.0].", "exclusiveMaximum": false, "exclusiveMinimum": false, "format": "double", "maximum": 1.0, "minimum": 0.0, "type": "number" } }, "required": [ "rate" ], "title": "Trace Head Sampling Rules (Deprecated)", "type": "object" }, "TraceReducer": { "description": "Reduces trace volume by applying a uniform trace head sampling rate and configurable span head sampling rules with optional tail sampling, then emits the retained spans.", "properties": { "actions": { "default": [], "description": "Actions to execute on traces. Actions process spans after sampling decisions have been made and can trigger operations like logs backfill.", "items": { "$ref": "#/$defs/TraceAction" }, "type": "array" }, "criticalPathAnalysis": { "$ref": "#/$defs/CriticalPathAnalysisConfig" }, "datasetId": { "description": "Dataset ID used for naming the Iceberg table (traces_raw_{datasetId}). If not provided, traces will not be persisted to Iceberg.", "pattern": "[a-z0-9]{1,13}", "title": "Iceberg Dataset ID", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "siblingMergeRules": { "default": [], "description": "Rules that merge same-signature sibling spans matching a predicate, after tail sampling decisions. The earliest-start match is kept with its children; the other matching same-signature siblings are removed and counted under grepr.merged_siblings. Requires tail sampling to be configured.", "items": { "$ref": "#/$defs/SiblingMergeRule" }, "title": "Sibling Merge Rules", "type": "array" }, "spanDropRules": { "default": [], "description": "Rules that drop matching spans and their descendants after tail sampling decisions. Requires tail sampling to be configured.", "items": { "$ref": "#/$defs/SpanDropRule" }, "title": "Span Drop Rules", "type": "array" }, "spanHeadSamplingRules": { "default": [], "description": "Span head sampling rules. Matched spans are retained as SPAN_HEAD_SAMPLED. If tail sampling is configured, matched spans participate in trace assembly before output; otherwise, matched spans are emitted directly. Order is significant; first match wins for metric attribution. Trace head sampling wins when both match the same span.", "items": { "$ref": "#/$defs/SpanHeadSamplingRule" }, "title": "Span Head Sampling Rules", "type": "array" }, "tailSampling": { "$ref": "#/$defs/TailSamplingConfig" }, "traceHeadSamplingRate": { "description": "Uniform trace head sampling rate in [0.0, 1.0]. When set, all spans sharing a traceId are retained together as HEAD_SAMPLED at this probability. Mutually exclusive with traceHeadSamplingRules (scalar wins when both present).", "exclusiveMaximum": false, "exclusiveMinimum": false, "format": "double", "maximum": 1.0, "minimum": 0.0, "title": "Trace Head Sampling Rate", "type": "number" }, "traceHeadSamplingRules": { "default": [], "deprecated": true, "description": "Deprecated: use traceHeadSamplingRate instead. Kept for backwards compatibility with stored configurations. When traceHeadSamplingRate is absent, the effective rate is max(rate) over this list (filters are ignored).", "items": { "$ref": "#/$defs/TraceHeadSamplingRule" }, "title": "Trace Head Sampling Rules (Deprecated)", "type": "array" }, "type": { "description": "Reduces trace volume by sampling CompleteSpan instances. Combines a uniform trace head sampling rate (whole-trace retention) and per-span head sampling rules with optional quantile-based tail sampling.", "enum": [ "trace-reducer" ], "type": "string" } }, "required": [ "name", "type" ], "type": "object", "x-tags": [ "Transforms" ] }, "TraceSampler": { "properties": { "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "sampleDurationMillis": { "default": 4000, "description": "How long (in milliseconds) a sampled trace ID remains marked for as sampled without new messages before being declared expired. After this duration with no more events for trace, subsequent events for the same trace will be re-evaluated for sampling if seen again.", "format": "int64", "minimum": 100, "title": "Sample Duration (ms)", "type": "integer" }, "sampleRate": { "description": "The probability (0.0 to 1.0) of sampling a newly seen trace ID.", "exclusiveMaximum": false, "exclusiveMinimum": false, "format": "double", "maximum": 1.0, "minimum": 0.0, "title": "Sample Rate", "type": "number" }, "selector": { "$ref": "#/$defs/EventPredicate" }, "traceIdAttributePaths": { "default": [], "description": "List of attribute paths (each path is a list of segments) to extract trace IDs from. The first non-null value found will be used as the trace ID.", "items": { "description": "List of attribute paths (each path is a list of segments) to extract trace IDs from. The first non-null value found will be used as the trace ID.", "items": { "description": "List of attribute paths (each path is a list of segments) to extract trace IDs from. The first non-null value found will be used as the trace ID.", "title": "Trace ID Attribute Paths", "type": "string" }, "title": "Trace ID Attribute Paths", "type": "array" }, "title": "Trace ID Attribute Paths", "type": "array" }, "traceIdTagKeys": { "default": [], "description": "List of tag keys to extract trace IDs from. The first non-null value found will be used as the trace ID (checked after attribute paths).", "items": { "description": "List of tag keys to extract trace IDs from. The first non-null value found will be used as the trace ID (checked after attribute paths).", "title": "Trace ID Tag Keys", "type": "string" }, "title": "Trace ID Tag Keys", "type": "array" }, "traceSamplerTagKey": { "default": "grepr.tracesampler", "description": "The key for the tag added to events of sampled traces to signal downstream operations differentiated processing.", "title": "Sampled Trace Marker Tag Key", "type": "string" }, "traceSamplerTagValue": { "default": "sampled", "description": "The value for the tag added to events of sampled traces to signal downstream operations differentiated processing.", "title": "Sampled Trace Marker Tag Value", "type": "string" }, "type": { "default": "trace-sampler", "description": "Samples traces based on their ID and marks associated events that are part of the selected traces. This can be used to bypass downstream processing such as message reduction, ensuring complete unmodified logs for those selected traces. This operation can add some overhead since it might require an additional shuffle in the pipeline. Messages that have trace IDs will be output on the \"traced\" output, while messages that do not have any trace IDs be output on the \"untraced\" output.", "enum": [ "trace-sampler" ], "type": "string" } }, "required": [ "name", "sampleRate", "type" ], "type": "object", "x-tags": [ "Transforms" ] }, "TracesIcebergTableSource": { "properties": { "datasetId": { "description": "The ID of the dataset to read data from.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "end": { "description": "End of time interval to query data for.", "format": "date-time", "type": "string" }, "hasError": { "description": "Filter by error status", "type": "boolean" }, "isRootSpan": { "description": "Filter by parent span ID (null for root spans only)", "type": "boolean" }, "limit": { "default": 2500, "description": "The maximum number of rows to process", "format": "int32", "type": "integer" }, "maxDuration": { "description": "Filter by maximum duration in nanoseconds", "format": "int64", "minimum": 0, "type": "integer" }, "minDuration": { "description": "Filter by minimum duration in nanoseconds", "format": "int64", "minimum": 0, "type": "integer" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offset": { "default": 0, "description": "Offset on the number of rows to process", "format": "int32", "minimum": 0, "type": "integer" }, "operationNames": { "default": [], "description": "Filter by operation names (exact match)", "items": { "description": "Filter by operation names (exact match)", "type": "string" }, "type": "array" }, "query": { "$ref": "#/$defs/query" }, "serviceNames": { "default": [], "description": "Filter by service names (exact match)", "items": { "description": "Filter by service names (exact match)", "type": "string" }, "type": "array" }, "sortOrder": { "default": "ASCENDING", "description": "The order in which the rows should be sorted by", "enum": [ "ASCENDING", "DESCENDING", "UNSORTED" ], "type": "string" }, "start": { "description": "Start of time interval to query data for.", "format": "date-time", "type": "string" }, "traceIds": { "default": [], "description": "Filter by trace IDs (32-character hex format)", "items": { "description": "Filter by trace IDs (32-character hex format)", "type": "string" }, "type": "array" }, "traceSignatureIds": { "default": [], "description": "Filter by trace signature ids (exact match)", "items": { "description": "Filter by trace signature ids (exact match)", "type": "string" }, "type": "array" }, "traceSignatures": { "default": [], "description": "Filter by trace signature text (supports wildcards with *)", "items": { "description": "Filter by trace signature text (supports wildcards with *)", "type": "string" }, "type": "array" }, "type": { "description": "Reads traces out of an Iceberg Table for processing.", "enum": [ "traces-iceberg-table-source" ], "type": "string" }, "variables": { "additionalProperties": { "$ref": "#/$defs/Any" }, "default": {}, "description": "Variables that can be used to modify the query while parsed", "type": "object" } }, "required": [ "datasetId", "end", "name", "query", "start", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "Trigger": { "description": "Base class of all Triggers", "oneOf": [ { "$ref": "#/$defs/EventPredicateTrigger" }, { "$ref": "#/$defs/ExternalSourceTrigger" } ], "properties": { "conditionIds": { "items": { "type": "string" }, "type": "array", "uniqueItems": true }, "duration": { "description": "How long the conditions this trigger activates stay active. A condition expires at the trigger's time plus this duration. For an event-predicate trigger, that time is the processing time at which it matches an event. For an external-source trigger, it's the notification's timestamp. A firing that carries the same variables, with the same values, as the firing that started an active condition doesn't start another one, whatever its __timestamp: the active condition keeps the later of the two expiries, and its job actions don't run again. An event-predicate trigger adds __severity to each firing from a log event, so a firing from an event of another severity starts another condition, which runs the job actions again. The rule engine applies a condition's event actions only to events whose timestamp is before the expiry. Once processing time passes a condition's expiry, a cleanup retires it. The cleanup runs while the rule engine handles events and notifications, at most once a second, so until it runs, a late event stamped before the expiry still gets the condition's event actions. A retired condition applies to no event, whatever its timestamp, and the trigger firing after that starts a new condition, which runs its job actions again.", "format": "ISO-8601", "type": "string" } }, "required": [ "conditionIds", "duration" ], "type": "object" }, "TriggerActionOp": { "properties": { "capacity": { "default": 50, "description": "Maximum number of concurrent trigger handler calls.", "format": "int32", "type": "integer" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "timeoutSeconds": { "default": 60, "description": "Timeout for trigger handler execution in seconds.", "format": "int32", "type": "integer" }, "type": { "description": "Dispatches trigger actions to rule-type-specific handlers.", "enum": [ "trigger-action" ], "type": "string" } }, "required": [ "name", "type" ], "type": "object", "x-tags": [ "Transforms" ] }, "TrinoAnalyticsSource": { "properties": { "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "query": { "$ref": "#/$defs/AnalyticsQuery" }, "scanBudgetBytes": { "default": 107374182400, "description": "Maximum number of bytes this query may process.", "format": "int64", "minimum": 1, "type": "integer" }, "tables": { "description": "Dataset tables available to the query under logical aliases.", "items": { "$ref": "#/$defs/AnalyticsTableBinding" }, "maxItems": 2147483647, "minItems": 1, "type": "array" }, "type": { "description": "Executes an analytical query using a Trino query engine.", "enum": [ "trino-analytics-source" ], "type": "string" } }, "required": [ "name", "query", "tables", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "TrinoRawLogsSource": { "properties": { "datasetId": { "description": "The ID of the dataset to read data from.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "end": { "description": "End of time interval to query data for.", "format": "date-time", "type": "string" }, "limit": { "default": 2500, "description": "The maximum number of rows to process", "format": "int32", "type": "integer" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offset": { "default": 0, "description": "Offset on the number of rows to process", "format": "int32", "minimum": 0, "type": "integer" }, "query": { "$ref": "#/$defs/query" }, "sortOrder": { "default": "ASCENDING", "description": "The order in which the rows should be sorted by", "enum": [ "ASCENDING", "DESCENDING", "UNSORTED" ], "type": "string" }, "start": { "description": "Start of time interval to query data for.", "format": "date-time", "type": "string" }, "type": { "description": "Reads raw log events out of an Iceberg Table without pattern enrichment, executed against a Trino query engine.", "enum": [ "trino-raw-log-source" ], "type": "string" }, "variables": { "additionalProperties": { "$ref": "#/$defs/Any" }, "default": {}, "description": "Variables that can be used to modify the query while parsed", "type": "object" } }, "required": [ "datasetId", "end", "name", "query", "start", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "TrinoRawSpanSource": { "properties": { "datasetId": { "description": "The ID of the dataset to read data from.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "end": { "description": "End of time interval to query data for.", "format": "date-time", "type": "string" }, "limit": { "default": 2500, "description": "The maximum number of rows to process", "format": "int32", "type": "integer" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offset": { "default": 0, "description": "Offset on the number of rows to process", "format": "int32", "minimum": 0, "type": "integer" }, "query": { "$ref": "#/$defs/query" }, "sortOrder": { "default": "ASCENDING", "description": "The order in which the rows should be sorted by", "enum": [ "ASCENDING", "DESCENDING", "UNSORTED" ], "type": "string" }, "start": { "description": "Start of time interval to query data for.", "format": "date-time", "type": "string" }, "type": { "description": "Reads spans using Grepr's internal query system out of an Iceberg Table for processing, executed against a Trino query engine.", "enum": [ "trino-raw-span-source" ], "type": "string" }, "variables": { "additionalProperties": { "$ref": "#/$defs/Any" }, "default": {}, "description": "Variables that can be used to modify the query while parsed", "type": "object" } }, "required": [ "datasetId", "end", "name", "query", "start", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "TrinoReducerLogSource": { "properties": { "datasetId": { "description": "The ID of the dataset to read data from.", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "end": { "description": "End of time interval to query data for.", "format": "date-time", "type": "string" }, "limit": { "default": 2500, "description": "The maximum number of rows to process", "format": "int32", "type": "integer" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "offset": { "default": 0, "description": "Offset on the number of rows to process", "format": "int32", "minimum": 0, "type": "integer" }, "processedLogsTableName": { "description": "The name of the table containing processed logs.", "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "query": { "$ref": "#/$defs/query" }, "reductionInterval": { "default": "PT2M", "description": "The interval used by the Log Reducer for the query. Uses ISO 8601 format for intervals.", "format": "ISO-8601", "type": "string" }, "sortOrder": { "default": "ASCENDING", "description": "The order in which the rows should be sorted by", "enum": [ "ASCENDING", "DESCENDING", "UNSORTED" ], "type": "string" }, "start": { "description": "Start of time interval to query data for.", "format": "date-time", "type": "string" }, "type": { "description": "Reads events using Grepr's internal query system out of an Iceberg Table for processing, executed against a Trino query engine.", "enum": [ "trino-reducer-log-source" ], "type": "string" }, "variables": { "additionalProperties": { "$ref": "#/$defs/Any" }, "default": {}, "description": "Variables that can be used to modify the query while parsed", "type": "object" } }, "required": [ "datasetId", "end", "name", "query", "reductionInterval", "start", "type" ], "type": "object", "x-tags": [ "Sources" ] }, "TypeInformationAny": { "properties": { "arity": { "format": "int32", "type": "integer" }, "basicType": { "type": "boolean" }, "genericParameters": { "additionalProperties": { "$ref": "#/$defs/TypeInformationObject" }, "type": "object" }, "keyType": { "type": "boolean" }, "sortKeyType": { "type": "boolean" }, "totalFields": { "format": "int32", "type": "integer" }, "tupleType": { "type": "boolean" } }, "type": "object" }, "TypeInformationObject": { "properties": { "arity": { "format": "int32", "type": "integer" }, "basicType": { "type": "boolean" }, "keyType": { "type": "boolean" }, "sortKeyType": { "type": "boolean" }, "totalFields": { "format": "int32", "type": "integer" }, "tupleType": { "type": "boolean" } }, "type": "object" }, "VariantSynchronousSink": { "properties": { "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Sink for returning arbitrary JSON results to the caller.", "enum": [ "variant-sync-sink" ], "type": "string" } }, "required": [ "name", "type" ], "type": "object", "x-tags": [ "Sinks" ] }, "VendorLogEventDedupIcebergTableSink": { "properties": { "datasetId": { "description": "The id of the dataset to write to", "pattern": "[a-z0-9]{1,13}", "type": "string" }, "name": { "pattern": "[a-z0-9_]{1,128}", "type": "string" }, "type": { "description": "Writes confirmed-delivered event IDs to an Iceberg table to keep track of which events have actually been sent to a particular sink.", "enum": [ "vendorlog-event-dedup-iceberg-table-sink" ], "type": "string" }, "vendorSinkId": { "pattern": "[a-z0-9]{1,13}", "type": "string" } }, "required": [ "datasetId", "name", "type", "vendorSinkId" ], "type": "object", "x-tags": [ "Sinks" ] }, "WindowBasedLogarithmicSampling": { "properties": { "logarithmBase": { "default": 2, "description": "Logarithm base used by sampling algorithm", "format": "int32", "type": "integer" }, "type": { "description": "A logarithmic sampler that reduces the log volume per reduction window", "enum": [ "window-based-logarithmic-sampling" ], "type": "string" } }, "required": [ "type" ], "type": "object" }, "backfillQuery": { "description": "The query to use for the backfill. This scopes the data that will be backfilled into the sink. It can also refer to variables generated by a trigger. Variables use __ (a double underscore) at the beginning and they are specified as part of the trigger description.", "oneOf": [ { "$ref": "#/$defs/AndEventPredicate" }, { "$ref": "#/$defs/DatadogQueryPredicate" }, { "$ref": "#/$defs/MetricEventPredicate" }, { "$ref": "#/$defs/NewRelicQueryPredicate" }, { "$ref": "#/$defs/NrqlQueryPredicate" } ], "properties": { "query": { "type": "string" }, "type": { "type": "string" } }, "required": [ "type" ], "type": "object" }, "query": { "description": "A query predicate that will be used to filter rows", "oneOf": [ { "$ref": "#/$defs/AndEventPredicate" }, { "$ref": "#/$defs/DatadogQueryPredicate" }, { "$ref": "#/$defs/MetricEventPredicate" }, { "$ref": "#/$defs/NewRelicQueryPredicate" }, { "$ref": "#/$defs/NrqlQueryPredicate" } ], "properties": { "query": { "type": "string" }, "type": { "type": "string" } }, "required": [ "type" ], "type": "object" } } }