diff --git a/.generator/schemas/v1/openapi.yaml b/.generator/schemas/v1/openapi.yaml index c84d61cfe74..416eca61272 100644 --- a/.generator/schemas/v1/openapi.yaml +++ b/.generator/schemas/v1/openapi.yaml @@ -6331,6 +6331,7 @@ components: - $ref: '#/components/schemas/LogsSpanRemapper' - $ref: '#/components/schemas/LogsArrayProcessor' - $ref: '#/components/schemas/LogsDecoderProcessor' + - $ref: '#/components/schemas/LogsSchemaProcessor' LogsQueryCompute: description: Define computation for a log query. properties: @@ -6392,6 +6393,243 @@ components: periods. type: string type: object + LogsSchemaCategoryMapper: + description: "Use the Schema Category Mapper to categorize log event into enum + fields.\nIn the case of OCSF, they can be used to map sibling fields which + are composed of an ID and a name.\n\n**Notes**:\n\n- The syntax of the query + is the one of Logs Explorer search bar.\n The query can be done on any log + attribute or tag, whether it is a facet or not.\n Wildcards can also be used + inside your query.\n- Categories are executed in order and processing stops + at the first match.\n Make sure categories are properly ordered in case a + log could match multiple queries.\n- Sibling fields always have a numerical + ID field and a human-readable string name.\n- A fallback section handles cases + where the name or ID value matches a specific value.\n If the name matches + \"Other\" or the ID matches 99, the value of the sibling name field will be + pulled from a source field from the original log." + properties: + categories: + description: 'Array of filters to match or not a log and their + + corresponding `name` to assign a custom value to the log.' + example: + - filter: + query: '@eventName:(ConsoleLogin OR ExternalIdPDirectoryLogin OR UserAuthentication + OR Authenticate)' + id: 1 + name: Logon + - filter: + query: '@eventName:*' + id: 99 + name: Other + items: + $ref: '#/components/schemas/LogsSchemaCategoryMapperCategory' + type: array + fallback: + $ref: '#/components/schemas/LogsSchemaCategoryMapperFallback' + name: + description: Name of the logs schema category mapper. + example: activity_id and activity_name + type: string + targets: + $ref: '#/components/schemas/LogsSchemaCategoryMapperTargets' + type: + $ref: '#/components/schemas/LogsSchemaCategoryMapperType' + required: + - categories + - targets + - type + - name + type: object + LogsSchemaCategoryMapperCategory: + description: Object describing the logs filter with corresponding category ID + and name assignment. + properties: + filter: + $ref: '#/components/schemas/LogsFilter' + id: + description: ID to inject into the category. + example: 1 + format: int64 + type: integer + name: + description: Value to assign to target schema field. + example: Password Change + type: string + required: + - filter + - id + - name + type: object + LogsSchemaCategoryMapperFallback: + description: Used to override hardcoded category values with a value pulled + from a source attribute on the log. + properties: + sources: + additionalProperties: + items: + type: string + type: array + description: Fallback sources used to populate value of field. + example: {} + type: object + values: + additionalProperties: + type: string + description: Values that define when the fallback is used. + example: {} + type: object + type: object + LogsSchemaCategoryMapperTargets: + description: Name of the target attributes which value is defined by the matching + category. + properties: + id: + description: ID of the field to map log attributes to. + example: ocsf.activity_id + type: string + name: + description: Name of the field to map log attributes to. + example: ocsf.activity_name + type: string + type: object + LogsSchemaCategoryMapperType: + description: Type of logs schema category mapper. + enum: + - schema-category-mapper + example: schema-category-mapper + type: string + x-enum-varnames: + - SCHEMA_CATEGORY_MAPPER + LogsSchemaData: + description: Configuration of the schema data to use. + properties: + class_name: + description: Class name of the schema to use. + example: Account Change + type: string + class_uid: + description: Class UID of the schema to use. + example: 3001 + format: int64 + type: integer + profiles: + description: Optional list of profiles to modify the schema. + example: + - security_control + - host + items: + type: string + type: array + schema_type: + description: Type of schema to use. + example: ocsf + type: string + version: + description: Version of the schema to use. + example: 1.5.0 + type: string + required: + - schema_type + - version + - class_uid + - class_name + type: object + LogsSchemaMapper: + description: Configuration of the schema processor mapper to use. + oneOf: + - $ref: '#/components/schemas/LogsSchemaRemapper' + - $ref: '#/components/schemas/LogsSchemaCategoryMapper' + LogsSchemaProcessor: + description: A processor that has additional validations and checks for a given + schema. Currently supported schema types include OCSF. + properties: + is_enabled: + default: false + description: Whether or not the processor is enabled. + type: boolean + mappers: + description: The `LogsSchemaProcessor` `mappers`. + example: + - name: Map userIdentity to ocsf.user.uid + sources: + - userIdentity.principalId + target: ocsf.user.uid + type: schema-remapper + items: + $ref: '#/components/schemas/LogsSchemaMapper' + type: array + name: + description: Name of the processor. + example: Map additionalEventData.LoginTo to ocsf.dst_endpoint.svc_name + type: string + schema: + $ref: '#/components/schemas/LogsSchemaData' + type: + $ref: '#/components/schemas/LogsSchemaProcessorType' + required: + - name + - mappers + - type + - schema + type: object + LogsSchemaProcessorType: + default: schema-processor + description: Type of logs schema processor. + enum: + - schema-processor + example: schema-processor + type: string + x-enum-varnames: + - SCHEMA_PROCESSOR + LogsSchemaRemapper: + description: The schema remapper maps source log fields to their correct fields. + properties: + name: + description: Name of the logs schema remapper. + example: Map userIdentity.principalId, responseElements.role.roleId, responseElements.user.userId + to ocsf.user.uid + type: string + override_on_conflict: + default: false + description: Override or not the target element if already set. + type: boolean + preserve_source: + default: false + description: Remove or preserve the remapped source element. + type: boolean + sources: + description: Array of source attributes. + example: + - userIdentity.principalId + - responseElements.role.roleId + - responseElements.user.userId + items: + description: Attribute used as a source to remap its value to the target + attribute. + type: string + type: array + target: + description: Target field to map log source field to. + example: ocsf.user.uid + type: string + target_format: + $ref: '#/components/schemas/TargetFormatType' + type: + $ref: '#/components/schemas/LogsSchemaRemapperType' + required: + - name + - sources + - target + - type + type: object + LogsSchemaRemapperType: + description: Type of logs schema remapper. + enum: + - schema-remapper + example: schema-remapper + type: string + x-enum-varnames: + - SCHEMA_REMAPPER LogsServiceRemapper: description: 'Use this processor if you want to assign one or more attributes as the official service. diff --git a/api/datadogV1/model_logs_processor.go b/api/datadogV1/model_logs_processor.go index c4ab83987b4..a9ae203005e 100644 --- a/api/datadogV1/model_logs_processor.go +++ b/api/datadogV1/model_logs_processor.go @@ -29,6 +29,7 @@ type LogsProcessor struct { LogsSpanRemapper *LogsSpanRemapper LogsArrayProcessor *LogsArrayProcessor LogsDecoderProcessor *LogsDecoderProcessor + LogsSchemaProcessor *LogsSchemaProcessor // UnparsedObject contains the raw value of the object if there was an error when deserializing into the struct UnparsedObject interface{} @@ -129,6 +130,11 @@ func LogsDecoderProcessorAsLogsProcessor(v *LogsDecoderProcessor) LogsProcessor return LogsProcessor{LogsDecoderProcessor: v} } +// LogsSchemaProcessorAsLogsProcessor is a convenience function that returns LogsSchemaProcessor wrapped in LogsProcessor. +func LogsSchemaProcessorAsLogsProcessor(v *LogsSchemaProcessor) LogsProcessor { + return LogsProcessor{LogsSchemaProcessor: v} +} + // UnmarshalJSON turns data into one of the pointers in the struct. func (obj *LogsProcessor) UnmarshalJSON(data []byte) error { var err error @@ -456,6 +462,23 @@ func (obj *LogsProcessor) UnmarshalJSON(data []byte) error { obj.LogsDecoderProcessor = nil } + // try to unmarshal data into LogsSchemaProcessor + err = datadog.Unmarshal(data, &obj.LogsSchemaProcessor) + if err == nil { + if obj.LogsSchemaProcessor != nil && obj.LogsSchemaProcessor.UnparsedObject == nil { + jsonLogsSchemaProcessor, _ := datadog.Marshal(obj.LogsSchemaProcessor) + if string(jsonLogsSchemaProcessor) == "{}" { // empty struct + obj.LogsSchemaProcessor = nil + } else { + match++ + } + } else { + obj.LogsSchemaProcessor = nil + } + } else { + obj.LogsSchemaProcessor = nil + } + if match != 1 { // more than 1 match // reset to nil obj.LogsGrokParser = nil @@ -477,6 +500,7 @@ func (obj *LogsProcessor) UnmarshalJSON(data []byte) error { obj.LogsSpanRemapper = nil obj.LogsArrayProcessor = nil obj.LogsDecoderProcessor = nil + obj.LogsSchemaProcessor = nil return datadog.Unmarshal(data, &obj.UnparsedObject) } return nil // exactly one match @@ -560,6 +584,10 @@ func (obj LogsProcessor) MarshalJSON() ([]byte, error) { return datadog.Marshal(&obj.LogsDecoderProcessor) } + if obj.LogsSchemaProcessor != nil { + return datadog.Marshal(&obj.LogsSchemaProcessor) + } + if obj.UnparsedObject != nil { return datadog.Marshal(obj.UnparsedObject) } @@ -644,6 +672,10 @@ func (obj *LogsProcessor) GetActualInstance() interface{} { return obj.LogsDecoderProcessor } + if obj.LogsSchemaProcessor != nil { + return obj.LogsSchemaProcessor + } + // all schemas are nil return nil } diff --git a/api/datadogV1/model_logs_schema_category_mapper.go b/api/datadogV1/model_logs_schema_category_mapper.go new file mode 100644 index 00000000000..a7c2ef8033e --- /dev/null +++ b/api/datadogV1/model_logs_schema_category_mapper.go @@ -0,0 +1,261 @@ +// Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +// This product includes software developed at Datadog (https://www.datadoghq.com/). +// Copyright 2019-Present Datadog, Inc. + +package datadogV1 + +import ( + "fmt" + + "github.com/DataDog/datadog-api-client-go/v2/api/datadog" +) + +// LogsSchemaCategoryMapper Use the Schema Category Mapper to categorize log event into enum fields. +// In the case of OCSF, they can be used to map sibling fields which are composed of an ID and a name. +// +// **Notes**: +// +// - The syntax of the query is the one of Logs Explorer search bar. +// The query can be done on any log attribute or tag, whether it is a facet or not. +// Wildcards can also be used inside your query. +// - Categories are executed in order and processing stops at the first match. +// Make sure categories are properly ordered in case a log could match multiple queries. +// - Sibling fields always have a numerical ID field and a human-readable string name. +// - A fallback section handles cases where the name or ID value matches a specific value. +// If the name matches "Other" or the ID matches 99, the value of the sibling name field will be pulled from a source field from the original log. +type LogsSchemaCategoryMapper struct { + // Array of filters to match or not a log and their + // corresponding `name` to assign a custom value to the log. + Categories []LogsSchemaCategoryMapperCategory `json:"categories"` + // Used to override hardcoded category values with a value pulled from a source attribute on the log. + Fallback *LogsSchemaCategoryMapperFallback `json:"fallback,omitempty"` + // Name of the logs schema category mapper. + Name string `json:"name"` + // Name of the target attributes which value is defined by the matching category. + Targets LogsSchemaCategoryMapperTargets `json:"targets"` + // Type of logs schema category mapper. + Type LogsSchemaCategoryMapperType `json:"type"` + // UnparsedObject contains the raw value of the object if there was an error when deserializing into the struct + UnparsedObject map[string]interface{} `json:"-"` + AdditionalProperties map[string]interface{} `json:"-"` +} + +// NewLogsSchemaCategoryMapper instantiates a new LogsSchemaCategoryMapper object. +// This constructor will assign default values to properties that have it defined, +// and makes sure properties required by API are set, but the set of arguments +// will change when the set of required properties is changed. +func NewLogsSchemaCategoryMapper(categories []LogsSchemaCategoryMapperCategory, name string, targets LogsSchemaCategoryMapperTargets, typeVar LogsSchemaCategoryMapperType) *LogsSchemaCategoryMapper { + this := LogsSchemaCategoryMapper{} + this.Categories = categories + this.Name = name + this.Targets = targets + this.Type = typeVar + return &this +} + +// NewLogsSchemaCategoryMapperWithDefaults instantiates a new LogsSchemaCategoryMapper object. +// This constructor will only assign default values to properties that have it defined, +// but it doesn't guarantee that properties required by API are set. +func NewLogsSchemaCategoryMapperWithDefaults() *LogsSchemaCategoryMapper { + this := LogsSchemaCategoryMapper{} + return &this +} + +// GetCategories returns the Categories field value. +func (o *LogsSchemaCategoryMapper) GetCategories() []LogsSchemaCategoryMapperCategory { + if o == nil { + var ret []LogsSchemaCategoryMapperCategory + return ret + } + return o.Categories +} + +// GetCategoriesOk returns a tuple with the Categories field value +// and a boolean to check if the value has been set. +func (o *LogsSchemaCategoryMapper) GetCategoriesOk() (*[]LogsSchemaCategoryMapperCategory, bool) { + if o == nil { + return nil, false + } + return &o.Categories, true +} + +// SetCategories sets field value. +func (o *LogsSchemaCategoryMapper) SetCategories(v []LogsSchemaCategoryMapperCategory) { + o.Categories = v +} + +// GetFallback returns the Fallback field value if set, zero value otherwise. +func (o *LogsSchemaCategoryMapper) GetFallback() LogsSchemaCategoryMapperFallback { + if o == nil || o.Fallback == nil { + var ret LogsSchemaCategoryMapperFallback + return ret + } + return *o.Fallback +} + +// GetFallbackOk returns a tuple with the Fallback field value if set, nil otherwise +// and a boolean to check if the value has been set. +func (o *LogsSchemaCategoryMapper) GetFallbackOk() (*LogsSchemaCategoryMapperFallback, bool) { + if o == nil || o.Fallback == nil { + return nil, false + } + return o.Fallback, true +} + +// HasFallback returns a boolean if a field has been set. +func (o *LogsSchemaCategoryMapper) HasFallback() bool { + return o != nil && o.Fallback != nil +} + +// SetFallback gets a reference to the given LogsSchemaCategoryMapperFallback and assigns it to the Fallback field. +func (o *LogsSchemaCategoryMapper) SetFallback(v LogsSchemaCategoryMapperFallback) { + o.Fallback = &v +} + +// GetName returns the Name field value. +func (o *LogsSchemaCategoryMapper) GetName() string { + if o == nil { + var ret string + return ret + } + return o.Name +} + +// GetNameOk returns a tuple with the Name field value +// and a boolean to check if the value has been set. +func (o *LogsSchemaCategoryMapper) GetNameOk() (*string, bool) { + if o == nil { + return nil, false + } + return &o.Name, true +} + +// SetName sets field value. +func (o *LogsSchemaCategoryMapper) SetName(v string) { + o.Name = v +} + +// GetTargets returns the Targets field value. +func (o *LogsSchemaCategoryMapper) GetTargets() LogsSchemaCategoryMapperTargets { + if o == nil { + var ret LogsSchemaCategoryMapperTargets + return ret + } + return o.Targets +} + +// GetTargetsOk returns a tuple with the Targets field value +// and a boolean to check if the value has been set. +func (o *LogsSchemaCategoryMapper) GetTargetsOk() (*LogsSchemaCategoryMapperTargets, bool) { + if o == nil { + return nil, false + } + return &o.Targets, true +} + +// SetTargets sets field value. +func (o *LogsSchemaCategoryMapper) SetTargets(v LogsSchemaCategoryMapperTargets) { + o.Targets = v +} + +// GetType returns the Type field value. +func (o *LogsSchemaCategoryMapper) GetType() LogsSchemaCategoryMapperType { + if o == nil { + var ret LogsSchemaCategoryMapperType + return ret + } + return o.Type +} + +// GetTypeOk returns a tuple with the Type field value +// and a boolean to check if the value has been set. +func (o *LogsSchemaCategoryMapper) GetTypeOk() (*LogsSchemaCategoryMapperType, bool) { + if o == nil { + return nil, false + } + return &o.Type, true +} + +// SetType sets field value. +func (o *LogsSchemaCategoryMapper) SetType(v LogsSchemaCategoryMapperType) { + o.Type = v +} + +// MarshalJSON serializes the struct using spec logic. +func (o LogsSchemaCategoryMapper) MarshalJSON() ([]byte, error) { + toSerialize := map[string]interface{}{} + if o.UnparsedObject != nil { + return datadog.Marshal(o.UnparsedObject) + } + toSerialize["categories"] = o.Categories + if o.Fallback != nil { + toSerialize["fallback"] = o.Fallback + } + toSerialize["name"] = o.Name + toSerialize["targets"] = o.Targets + toSerialize["type"] = o.Type + + for key, value := range o.AdditionalProperties { + toSerialize[key] = value + } + return datadog.Marshal(toSerialize) +} + +// UnmarshalJSON deserializes the given payload. +func (o *LogsSchemaCategoryMapper) UnmarshalJSON(bytes []byte) (err error) { + all := struct { + Categories *[]LogsSchemaCategoryMapperCategory `json:"categories"` + Fallback *LogsSchemaCategoryMapperFallback `json:"fallback,omitempty"` + Name *string `json:"name"` + Targets *LogsSchemaCategoryMapperTargets `json:"targets"` + Type *LogsSchemaCategoryMapperType `json:"type"` + }{} + if err = datadog.Unmarshal(bytes, &all); err != nil { + return datadog.Unmarshal(bytes, &o.UnparsedObject) + } + if all.Categories == nil { + return fmt.Errorf("required field categories missing") + } + if all.Name == nil { + return fmt.Errorf("required field name missing") + } + if all.Targets == nil { + return fmt.Errorf("required field targets missing") + } + if all.Type == nil { + return fmt.Errorf("required field type missing") + } + additionalProperties := make(map[string]interface{}) + if err = datadog.Unmarshal(bytes, &additionalProperties); err == nil { + datadog.DeleteKeys(additionalProperties, &[]string{"categories", "fallback", "name", "targets", "type"}) + } else { + return err + } + + hasInvalidField := false + o.Categories = *all.Categories + if all.Fallback != nil && all.Fallback.UnparsedObject != nil && o.UnparsedObject == nil { + hasInvalidField = true + } + o.Fallback = all.Fallback + o.Name = *all.Name + if all.Targets.UnparsedObject != nil && o.UnparsedObject == nil { + hasInvalidField = true + } + o.Targets = *all.Targets + if !all.Type.IsValid() { + hasInvalidField = true + } else { + o.Type = *all.Type + } + + if len(additionalProperties) > 0 { + o.AdditionalProperties = additionalProperties + } + + if hasInvalidField { + return datadog.Unmarshal(bytes, &o.UnparsedObject) + } + + return nil +} diff --git a/api/datadogV1/model_logs_schema_category_mapper_category.go b/api/datadogV1/model_logs_schema_category_mapper_category.go new file mode 100644 index 00000000000..8cb5f46de3e --- /dev/null +++ b/api/datadogV1/model_logs_schema_category_mapper_category.go @@ -0,0 +1,174 @@ +// Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +// This product includes software developed at Datadog (https://www.datadoghq.com/). +// Copyright 2019-Present Datadog, Inc. + +package datadogV1 + +import ( + "fmt" + + "github.com/DataDog/datadog-api-client-go/v2/api/datadog" +) + +// LogsSchemaCategoryMapperCategory Object describing the logs filter with corresponding category ID and name assignment. +type LogsSchemaCategoryMapperCategory struct { + // Filter for logs. + Filter LogsFilter `json:"filter"` + // ID to inject into the category. + Id int64 `json:"id"` + // Value to assign to target schema field. + Name string `json:"name"` + // UnparsedObject contains the raw value of the object if there was an error when deserializing into the struct + UnparsedObject map[string]interface{} `json:"-"` + AdditionalProperties map[string]interface{} `json:"-"` +} + +// NewLogsSchemaCategoryMapperCategory instantiates a new LogsSchemaCategoryMapperCategory object. +// This constructor will assign default values to properties that have it defined, +// and makes sure properties required by API are set, but the set of arguments +// will change when the set of required properties is changed. +func NewLogsSchemaCategoryMapperCategory(filter LogsFilter, id int64, name string) *LogsSchemaCategoryMapperCategory { + this := LogsSchemaCategoryMapperCategory{} + this.Filter = filter + this.Id = id + this.Name = name + return &this +} + +// NewLogsSchemaCategoryMapperCategoryWithDefaults instantiates a new LogsSchemaCategoryMapperCategory object. +// This constructor will only assign default values to properties that have it defined, +// but it doesn't guarantee that properties required by API are set. +func NewLogsSchemaCategoryMapperCategoryWithDefaults() *LogsSchemaCategoryMapperCategory { + this := LogsSchemaCategoryMapperCategory{} + return &this +} + +// GetFilter returns the Filter field value. +func (o *LogsSchemaCategoryMapperCategory) GetFilter() LogsFilter { + if o == nil { + var ret LogsFilter + return ret + } + return o.Filter +} + +// GetFilterOk returns a tuple with the Filter field value +// and a boolean to check if the value has been set. +func (o *LogsSchemaCategoryMapperCategory) GetFilterOk() (*LogsFilter, bool) { + if o == nil { + return nil, false + } + return &o.Filter, true +} + +// SetFilter sets field value. +func (o *LogsSchemaCategoryMapperCategory) SetFilter(v LogsFilter) { + o.Filter = v +} + +// GetId returns the Id field value. +func (o *LogsSchemaCategoryMapperCategory) GetId() int64 { + if o == nil { + var ret int64 + return ret + } + return o.Id +} + +// GetIdOk returns a tuple with the Id field value +// and a boolean to check if the value has been set. +func (o *LogsSchemaCategoryMapperCategory) GetIdOk() (*int64, bool) { + if o == nil { + return nil, false + } + return &o.Id, true +} + +// SetId sets field value. +func (o *LogsSchemaCategoryMapperCategory) SetId(v int64) { + o.Id = v +} + +// GetName returns the Name field value. +func (o *LogsSchemaCategoryMapperCategory) GetName() string { + if o == nil { + var ret string + return ret + } + return o.Name +} + +// GetNameOk returns a tuple with the Name field value +// and a boolean to check if the value has been set. +func (o *LogsSchemaCategoryMapperCategory) GetNameOk() (*string, bool) { + if o == nil { + return nil, false + } + return &o.Name, true +} + +// SetName sets field value. +func (o *LogsSchemaCategoryMapperCategory) SetName(v string) { + o.Name = v +} + +// MarshalJSON serializes the struct using spec logic. +func (o LogsSchemaCategoryMapperCategory) MarshalJSON() ([]byte, error) { + toSerialize := map[string]interface{}{} + if o.UnparsedObject != nil { + return datadog.Marshal(o.UnparsedObject) + } + toSerialize["filter"] = o.Filter + toSerialize["id"] = o.Id + toSerialize["name"] = o.Name + + for key, value := range o.AdditionalProperties { + toSerialize[key] = value + } + return datadog.Marshal(toSerialize) +} + +// UnmarshalJSON deserializes the given payload. +func (o *LogsSchemaCategoryMapperCategory) UnmarshalJSON(bytes []byte) (err error) { + all := struct { + Filter *LogsFilter `json:"filter"` + Id *int64 `json:"id"` + Name *string `json:"name"` + }{} + if err = datadog.Unmarshal(bytes, &all); err != nil { + return datadog.Unmarshal(bytes, &o.UnparsedObject) + } + if all.Filter == nil { + return fmt.Errorf("required field filter missing") + } + if all.Id == nil { + return fmt.Errorf("required field id missing") + } + if all.Name == nil { + return fmt.Errorf("required field name missing") + } + additionalProperties := make(map[string]interface{}) + if err = datadog.Unmarshal(bytes, &additionalProperties); err == nil { + datadog.DeleteKeys(additionalProperties, &[]string{"filter", "id", "name"}) + } else { + return err + } + + hasInvalidField := false + if all.Filter.UnparsedObject != nil && o.UnparsedObject == nil { + hasInvalidField = true + } + o.Filter = *all.Filter + o.Id = *all.Id + o.Name = *all.Name + + if len(additionalProperties) > 0 { + o.AdditionalProperties = additionalProperties + } + + if hasInvalidField { + return datadog.Unmarshal(bytes, &o.UnparsedObject) + } + + return nil +} diff --git a/api/datadogV1/model_logs_schema_category_mapper_fallback.go b/api/datadogV1/model_logs_schema_category_mapper_fallback.go new file mode 100644 index 00000000000..f0a98192ce3 --- /dev/null +++ b/api/datadogV1/model_logs_schema_category_mapper_fallback.go @@ -0,0 +1,137 @@ +// Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +// This product includes software developed at Datadog (https://www.datadoghq.com/). +// Copyright 2019-Present Datadog, Inc. + +package datadogV1 + +import ( + "github.com/DataDog/datadog-api-client-go/v2/api/datadog" +) + +// LogsSchemaCategoryMapperFallback Used to override hardcoded category values with a value pulled from a source attribute on the log. +type LogsSchemaCategoryMapperFallback struct { + // Fallback sources used to populate value of field. + Sources map[string][]string `json:"sources,omitempty"` + // Values that define when the fallback is used. + Values map[string]string `json:"values,omitempty"` + // UnparsedObject contains the raw value of the object if there was an error when deserializing into the struct + UnparsedObject map[string]interface{} `json:"-"` + AdditionalProperties map[string]interface{} `json:"-"` +} + +// NewLogsSchemaCategoryMapperFallback instantiates a new LogsSchemaCategoryMapperFallback object. +// This constructor will assign default values to properties that have it defined, +// and makes sure properties required by API are set, but the set of arguments +// will change when the set of required properties is changed. +func NewLogsSchemaCategoryMapperFallback() *LogsSchemaCategoryMapperFallback { + this := LogsSchemaCategoryMapperFallback{} + return &this +} + +// NewLogsSchemaCategoryMapperFallbackWithDefaults instantiates a new LogsSchemaCategoryMapperFallback object. +// This constructor will only assign default values to properties that have it defined, +// but it doesn't guarantee that properties required by API are set. +func NewLogsSchemaCategoryMapperFallbackWithDefaults() *LogsSchemaCategoryMapperFallback { + this := LogsSchemaCategoryMapperFallback{} + return &this +} + +// GetSources returns the Sources field value if set, zero value otherwise. +func (o *LogsSchemaCategoryMapperFallback) GetSources() map[string][]string { + if o == nil || o.Sources == nil { + var ret map[string][]string + return ret + } + return o.Sources +} + +// GetSourcesOk returns a tuple with the Sources field value if set, nil otherwise +// and a boolean to check if the value has been set. +func (o *LogsSchemaCategoryMapperFallback) GetSourcesOk() (*map[string][]string, bool) { + if o == nil || o.Sources == nil { + return nil, false + } + return &o.Sources, true +} + +// HasSources returns a boolean if a field has been set. +func (o *LogsSchemaCategoryMapperFallback) HasSources() bool { + return o != nil && o.Sources != nil +} + +// SetSources gets a reference to the given map[string][]string and assigns it to the Sources field. +func (o *LogsSchemaCategoryMapperFallback) SetSources(v map[string][]string) { + o.Sources = v +} + +// GetValues returns the Values field value if set, zero value otherwise. +func (o *LogsSchemaCategoryMapperFallback) GetValues() map[string]string { + if o == nil || o.Values == nil { + var ret map[string]string + return ret + } + return o.Values +} + +// GetValuesOk returns a tuple with the Values field value if set, nil otherwise +// and a boolean to check if the value has been set. +func (o *LogsSchemaCategoryMapperFallback) GetValuesOk() (*map[string]string, bool) { + if o == nil || o.Values == nil { + return nil, false + } + return &o.Values, true +} + +// HasValues returns a boolean if a field has been set. +func (o *LogsSchemaCategoryMapperFallback) HasValues() bool { + return o != nil && o.Values != nil +} + +// SetValues gets a reference to the given map[string]string and assigns it to the Values field. +func (o *LogsSchemaCategoryMapperFallback) SetValues(v map[string]string) { + o.Values = v +} + +// MarshalJSON serializes the struct using spec logic. +func (o LogsSchemaCategoryMapperFallback) MarshalJSON() ([]byte, error) { + toSerialize := map[string]interface{}{} + if o.UnparsedObject != nil { + return datadog.Marshal(o.UnparsedObject) + } + if o.Sources != nil { + toSerialize["sources"] = o.Sources + } + if o.Values != nil { + toSerialize["values"] = o.Values + } + + for key, value := range o.AdditionalProperties { + toSerialize[key] = value + } + return datadog.Marshal(toSerialize) +} + +// UnmarshalJSON deserializes the given payload. +func (o *LogsSchemaCategoryMapperFallback) UnmarshalJSON(bytes []byte) (err error) { + all := struct { + Sources map[string][]string `json:"sources,omitempty"` + Values map[string]string `json:"values,omitempty"` + }{} + if err = datadog.Unmarshal(bytes, &all); err != nil { + return datadog.Unmarshal(bytes, &o.UnparsedObject) + } + additionalProperties := make(map[string]interface{}) + if err = datadog.Unmarshal(bytes, &additionalProperties); err == nil { + datadog.DeleteKeys(additionalProperties, &[]string{"sources", "values"}) + } else { + return err + } + o.Sources = all.Sources + o.Values = all.Values + + if len(additionalProperties) > 0 { + o.AdditionalProperties = additionalProperties + } + + return nil +} diff --git a/api/datadogV1/model_logs_schema_category_mapper_targets.go b/api/datadogV1/model_logs_schema_category_mapper_targets.go new file mode 100644 index 00000000000..d136da208dc --- /dev/null +++ b/api/datadogV1/model_logs_schema_category_mapper_targets.go @@ -0,0 +1,137 @@ +// Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +// This product includes software developed at Datadog (https://www.datadoghq.com/). +// Copyright 2019-Present Datadog, Inc. + +package datadogV1 + +import ( + "github.com/DataDog/datadog-api-client-go/v2/api/datadog" +) + +// LogsSchemaCategoryMapperTargets Name of the target attributes which value is defined by the matching category. +type LogsSchemaCategoryMapperTargets struct { + // ID of the field to map log attributes to. + Id *string `json:"id,omitempty"` + // Name of the field to map log attributes to. + Name *string `json:"name,omitempty"` + // UnparsedObject contains the raw value of the object if there was an error when deserializing into the struct + UnparsedObject map[string]interface{} `json:"-"` + AdditionalProperties map[string]interface{} `json:"-"` +} + +// NewLogsSchemaCategoryMapperTargets instantiates a new LogsSchemaCategoryMapperTargets object. +// This constructor will assign default values to properties that have it defined, +// and makes sure properties required by API are set, but the set of arguments +// will change when the set of required properties is changed. +func NewLogsSchemaCategoryMapperTargets() *LogsSchemaCategoryMapperTargets { + this := LogsSchemaCategoryMapperTargets{} + return &this +} + +// NewLogsSchemaCategoryMapperTargetsWithDefaults instantiates a new LogsSchemaCategoryMapperTargets object. +// This constructor will only assign default values to properties that have it defined, +// but it doesn't guarantee that properties required by API are set. +func NewLogsSchemaCategoryMapperTargetsWithDefaults() *LogsSchemaCategoryMapperTargets { + this := LogsSchemaCategoryMapperTargets{} + return &this +} + +// GetId returns the Id field value if set, zero value otherwise. +func (o *LogsSchemaCategoryMapperTargets) GetId() string { + if o == nil || o.Id == nil { + var ret string + return ret + } + return *o.Id +} + +// GetIdOk returns a tuple with the Id field value if set, nil otherwise +// and a boolean to check if the value has been set. +func (o *LogsSchemaCategoryMapperTargets) GetIdOk() (*string, bool) { + if o == nil || o.Id == nil { + return nil, false + } + return o.Id, true +} + +// HasId returns a boolean if a field has been set. +func (o *LogsSchemaCategoryMapperTargets) HasId() bool { + return o != nil && o.Id != nil +} + +// SetId gets a reference to the given string and assigns it to the Id field. +func (o *LogsSchemaCategoryMapperTargets) SetId(v string) { + o.Id = &v +} + +// GetName returns the Name field value if set, zero value otherwise. +func (o *LogsSchemaCategoryMapperTargets) GetName() string { + if o == nil || o.Name == nil { + var ret string + return ret + } + return *o.Name +} + +// GetNameOk returns a tuple with the Name field value if set, nil otherwise +// and a boolean to check if the value has been set. +func (o *LogsSchemaCategoryMapperTargets) GetNameOk() (*string, bool) { + if o == nil || o.Name == nil { + return nil, false + } + return o.Name, true +} + +// HasName returns a boolean if a field has been set. +func (o *LogsSchemaCategoryMapperTargets) HasName() bool { + return o != nil && o.Name != nil +} + +// SetName gets a reference to the given string and assigns it to the Name field. +func (o *LogsSchemaCategoryMapperTargets) SetName(v string) { + o.Name = &v +} + +// MarshalJSON serializes the struct using spec logic. +func (o LogsSchemaCategoryMapperTargets) MarshalJSON() ([]byte, error) { + toSerialize := map[string]interface{}{} + if o.UnparsedObject != nil { + return datadog.Marshal(o.UnparsedObject) + } + if o.Id != nil { + toSerialize["id"] = o.Id + } + if o.Name != nil { + toSerialize["name"] = o.Name + } + + for key, value := range o.AdditionalProperties { + toSerialize[key] = value + } + return datadog.Marshal(toSerialize) +} + +// UnmarshalJSON deserializes the given payload. +func (o *LogsSchemaCategoryMapperTargets) UnmarshalJSON(bytes []byte) (err error) { + all := struct { + Id *string `json:"id,omitempty"` + Name *string `json:"name,omitempty"` + }{} + if err = datadog.Unmarshal(bytes, &all); err != nil { + return datadog.Unmarshal(bytes, &o.UnparsedObject) + } + additionalProperties := make(map[string]interface{}) + if err = datadog.Unmarshal(bytes, &additionalProperties); err == nil { + datadog.DeleteKeys(additionalProperties, &[]string{"id", "name"}) + } else { + return err + } + o.Id = all.Id + o.Name = all.Name + + if len(additionalProperties) > 0 { + o.AdditionalProperties = additionalProperties + } + + return nil +} diff --git a/api/datadogV1/model_logs_schema_category_mapper_type.go b/api/datadogV1/model_logs_schema_category_mapper_type.go new file mode 100644 index 00000000000..57c68bd29e1 --- /dev/null +++ b/api/datadogV1/model_logs_schema_category_mapper_type.go @@ -0,0 +1,64 @@ +// Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +// This product includes software developed at Datadog (https://www.datadoghq.com/). +// Copyright 2019-Present Datadog, Inc. + +package datadogV1 + +import ( + "fmt" + + "github.com/DataDog/datadog-api-client-go/v2/api/datadog" +) + +// LogsSchemaCategoryMapperType Type of logs schema category mapper. +type LogsSchemaCategoryMapperType string + +// List of LogsSchemaCategoryMapperType. +const ( + LOGSSCHEMACATEGORYMAPPERTYPE_SCHEMA_CATEGORY_MAPPER LogsSchemaCategoryMapperType = "schema-category-mapper" +) + +var allowedLogsSchemaCategoryMapperTypeEnumValues = []LogsSchemaCategoryMapperType{ + LOGSSCHEMACATEGORYMAPPERTYPE_SCHEMA_CATEGORY_MAPPER, +} + +// GetAllowedValues reeturns the list of possible values. +func (v *LogsSchemaCategoryMapperType) GetAllowedValues() []LogsSchemaCategoryMapperType { + return allowedLogsSchemaCategoryMapperTypeEnumValues +} + +// UnmarshalJSON deserializes the given payload. +func (v *LogsSchemaCategoryMapperType) UnmarshalJSON(src []byte) error { + var value string + err := datadog.Unmarshal(src, &value) + if err != nil { + return err + } + *v = LogsSchemaCategoryMapperType(value) + return nil +} + +// NewLogsSchemaCategoryMapperTypeFromValue returns a pointer to a valid LogsSchemaCategoryMapperType +// for the value passed as argument, or an error if the value passed is not allowed by the enum. +func NewLogsSchemaCategoryMapperTypeFromValue(v string) (*LogsSchemaCategoryMapperType, error) { + ev := LogsSchemaCategoryMapperType(v) + if ev.IsValid() { + return &ev, nil + } + return nil, fmt.Errorf("invalid value '%v' for LogsSchemaCategoryMapperType: valid values are %v", v, allowedLogsSchemaCategoryMapperTypeEnumValues) +} + +// IsValid return true if the value is valid for the enum, false otherwise. +func (v LogsSchemaCategoryMapperType) IsValid() bool { + for _, existing := range allowedLogsSchemaCategoryMapperTypeEnumValues { + if existing == v { + return true + } + } + return false +} + +// Ptr returns reference to LogsSchemaCategoryMapperType value. +func (v LogsSchemaCategoryMapperType) Ptr() *LogsSchemaCategoryMapperType { + return &v +} diff --git a/api/datadogV1/model_logs_schema_data.go b/api/datadogV1/model_logs_schema_data.go new file mode 100644 index 00000000000..7b476f594cd --- /dev/null +++ b/api/datadogV1/model_logs_schema_data.go @@ -0,0 +1,232 @@ +// Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +// This product includes software developed at Datadog (https://www.datadoghq.com/). +// Copyright 2019-Present Datadog, Inc. + +package datadogV1 + +import ( + "fmt" + + "github.com/DataDog/datadog-api-client-go/v2/api/datadog" +) + +// LogsSchemaData Configuration of the schema data to use. +type LogsSchemaData struct { + // Class name of the schema to use. + ClassName string `json:"class_name"` + // Class UID of the schema to use. + ClassUid int64 `json:"class_uid"` + // Optional list of profiles to modify the schema. + Profiles []string `json:"profiles,omitempty"` + // Type of schema to use. + SchemaType string `json:"schema_type"` + // Version of the schema to use. + Version string `json:"version"` + // UnparsedObject contains the raw value of the object if there was an error when deserializing into the struct + UnparsedObject map[string]interface{} `json:"-"` + AdditionalProperties map[string]interface{} `json:"-"` +} + +// NewLogsSchemaData instantiates a new LogsSchemaData object. +// This constructor will assign default values to properties that have it defined, +// and makes sure properties required by API are set, but the set of arguments +// will change when the set of required properties is changed. +func NewLogsSchemaData(className string, classUid int64, schemaType string, version string) *LogsSchemaData { + this := LogsSchemaData{} + this.ClassName = className + this.ClassUid = classUid + this.SchemaType = schemaType + this.Version = version + return &this +} + +// NewLogsSchemaDataWithDefaults instantiates a new LogsSchemaData object. +// This constructor will only assign default values to properties that have it defined, +// but it doesn't guarantee that properties required by API are set. +func NewLogsSchemaDataWithDefaults() *LogsSchemaData { + this := LogsSchemaData{} + return &this +} + +// GetClassName returns the ClassName field value. +func (o *LogsSchemaData) GetClassName() string { + if o == nil { + var ret string + return ret + } + return o.ClassName +} + +// GetClassNameOk returns a tuple with the ClassName field value +// and a boolean to check if the value has been set. +func (o *LogsSchemaData) GetClassNameOk() (*string, bool) { + if o == nil { + return nil, false + } + return &o.ClassName, true +} + +// SetClassName sets field value. +func (o *LogsSchemaData) SetClassName(v string) { + o.ClassName = v +} + +// GetClassUid returns the ClassUid field value. +func (o *LogsSchemaData) GetClassUid() int64 { + if o == nil { + var ret int64 + return ret + } + return o.ClassUid +} + +// GetClassUidOk returns a tuple with the ClassUid field value +// and a boolean to check if the value has been set. +func (o *LogsSchemaData) GetClassUidOk() (*int64, bool) { + if o == nil { + return nil, false + } + return &o.ClassUid, true +} + +// SetClassUid sets field value. +func (o *LogsSchemaData) SetClassUid(v int64) { + o.ClassUid = v +} + +// GetProfiles returns the Profiles field value if set, zero value otherwise. +func (o *LogsSchemaData) GetProfiles() []string { + if o == nil || o.Profiles == nil { + var ret []string + return ret + } + return o.Profiles +} + +// GetProfilesOk returns a tuple with the Profiles field value if set, nil otherwise +// and a boolean to check if the value has been set. +func (o *LogsSchemaData) GetProfilesOk() (*[]string, bool) { + if o == nil || o.Profiles == nil { + return nil, false + } + return &o.Profiles, true +} + +// HasProfiles returns a boolean if a field has been set. +func (o *LogsSchemaData) HasProfiles() bool { + return o != nil && o.Profiles != nil +} + +// SetProfiles gets a reference to the given []string and assigns it to the Profiles field. +func (o *LogsSchemaData) SetProfiles(v []string) { + o.Profiles = v +} + +// GetSchemaType returns the SchemaType field value. +func (o *LogsSchemaData) GetSchemaType() string { + if o == nil { + var ret string + return ret + } + return o.SchemaType +} + +// GetSchemaTypeOk returns a tuple with the SchemaType field value +// and a boolean to check if the value has been set. +func (o *LogsSchemaData) GetSchemaTypeOk() (*string, bool) { + if o == nil { + return nil, false + } + return &o.SchemaType, true +} + +// SetSchemaType sets field value. +func (o *LogsSchemaData) SetSchemaType(v string) { + o.SchemaType = v +} + +// GetVersion returns the Version field value. +func (o *LogsSchemaData) GetVersion() string { + if o == nil { + var ret string + return ret + } + return o.Version +} + +// GetVersionOk returns a tuple with the Version field value +// and a boolean to check if the value has been set. +func (o *LogsSchemaData) GetVersionOk() (*string, bool) { + if o == nil { + return nil, false + } + return &o.Version, true +} + +// SetVersion sets field value. +func (o *LogsSchemaData) SetVersion(v string) { + o.Version = v +} + +// MarshalJSON serializes the struct using spec logic. +func (o LogsSchemaData) MarshalJSON() ([]byte, error) { + toSerialize := map[string]interface{}{} + if o.UnparsedObject != nil { + return datadog.Marshal(o.UnparsedObject) + } + toSerialize["class_name"] = o.ClassName + toSerialize["class_uid"] = o.ClassUid + if o.Profiles != nil { + toSerialize["profiles"] = o.Profiles + } + toSerialize["schema_type"] = o.SchemaType + toSerialize["version"] = o.Version + + for key, value := range o.AdditionalProperties { + toSerialize[key] = value + } + return datadog.Marshal(toSerialize) +} + +// UnmarshalJSON deserializes the given payload. +func (o *LogsSchemaData) UnmarshalJSON(bytes []byte) (err error) { + all := struct { + ClassName *string `json:"class_name"` + ClassUid *int64 `json:"class_uid"` + Profiles []string `json:"profiles,omitempty"` + SchemaType *string `json:"schema_type"` + Version *string `json:"version"` + }{} + if err = datadog.Unmarshal(bytes, &all); err != nil { + return datadog.Unmarshal(bytes, &o.UnparsedObject) + } + if all.ClassName == nil { + return fmt.Errorf("required field class_name missing") + } + if all.ClassUid == nil { + return fmt.Errorf("required field class_uid missing") + } + if all.SchemaType == nil { + return fmt.Errorf("required field schema_type missing") + } + if all.Version == nil { + return fmt.Errorf("required field version missing") + } + additionalProperties := make(map[string]interface{}) + if err = datadog.Unmarshal(bytes, &additionalProperties); err == nil { + datadog.DeleteKeys(additionalProperties, &[]string{"class_name", "class_uid", "profiles", "schema_type", "version"}) + } else { + return err + } + o.ClassName = *all.ClassName + o.ClassUid = *all.ClassUid + o.Profiles = all.Profiles + o.SchemaType = *all.SchemaType + o.Version = *all.Version + + if len(additionalProperties) > 0 { + o.AdditionalProperties = additionalProperties + } + + return nil +} diff --git a/api/datadogV1/model_logs_schema_mapper.go b/api/datadogV1/model_logs_schema_mapper.go new file mode 100644 index 00000000000..db0bfddf83c --- /dev/null +++ b/api/datadogV1/model_logs_schema_mapper.go @@ -0,0 +1,105 @@ +// Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +// This product includes software developed at Datadog (https://www.datadoghq.com/). +// Copyright 2019-Present Datadog, Inc. + +package datadogV1 + +import ( + "github.com/DataDog/datadog-api-client-go/v2/api/datadog" +) + +// LogsSchemaMapper - Configuration of the schema processor mapper to use. +type LogsSchemaMapper struct { + LogsSchemaRemapper *LogsSchemaRemapper + LogsSchemaCategoryMapper *LogsSchemaCategoryMapper + + // UnparsedObject contains the raw value of the object if there was an error when deserializing into the struct + UnparsedObject interface{} +} + +// LogsSchemaRemapperAsLogsSchemaMapper is a convenience function that returns LogsSchemaRemapper wrapped in LogsSchemaMapper. +func LogsSchemaRemapperAsLogsSchemaMapper(v *LogsSchemaRemapper) LogsSchemaMapper { + return LogsSchemaMapper{LogsSchemaRemapper: v} +} + +// LogsSchemaCategoryMapperAsLogsSchemaMapper is a convenience function that returns LogsSchemaCategoryMapper wrapped in LogsSchemaMapper. +func LogsSchemaCategoryMapperAsLogsSchemaMapper(v *LogsSchemaCategoryMapper) LogsSchemaMapper { + return LogsSchemaMapper{LogsSchemaCategoryMapper: v} +} + +// UnmarshalJSON turns data into one of the pointers in the struct. +func (obj *LogsSchemaMapper) UnmarshalJSON(data []byte) error { + var err error + match := 0 + // try to unmarshal data into LogsSchemaRemapper + err = datadog.Unmarshal(data, &obj.LogsSchemaRemapper) + if err == nil { + if obj.LogsSchemaRemapper != nil && obj.LogsSchemaRemapper.UnparsedObject == nil { + jsonLogsSchemaRemapper, _ := datadog.Marshal(obj.LogsSchemaRemapper) + if string(jsonLogsSchemaRemapper) == "{}" { // empty struct + obj.LogsSchemaRemapper = nil + } else { + match++ + } + } else { + obj.LogsSchemaRemapper = nil + } + } else { + obj.LogsSchemaRemapper = nil + } + + // try to unmarshal data into LogsSchemaCategoryMapper + err = datadog.Unmarshal(data, &obj.LogsSchemaCategoryMapper) + if err == nil { + if obj.LogsSchemaCategoryMapper != nil && obj.LogsSchemaCategoryMapper.UnparsedObject == nil { + jsonLogsSchemaCategoryMapper, _ := datadog.Marshal(obj.LogsSchemaCategoryMapper) + if string(jsonLogsSchemaCategoryMapper) == "{}" { // empty struct + obj.LogsSchemaCategoryMapper = nil + } else { + match++ + } + } else { + obj.LogsSchemaCategoryMapper = nil + } + } else { + obj.LogsSchemaCategoryMapper = nil + } + + if match != 1 { // more than 1 match + // reset to nil + obj.LogsSchemaRemapper = nil + obj.LogsSchemaCategoryMapper = nil + return datadog.Unmarshal(data, &obj.UnparsedObject) + } + return nil // exactly one match +} + +// MarshalJSON turns data from the first non-nil pointers in the struct to JSON. +func (obj LogsSchemaMapper) MarshalJSON() ([]byte, error) { + if obj.LogsSchemaRemapper != nil { + return datadog.Marshal(&obj.LogsSchemaRemapper) + } + + if obj.LogsSchemaCategoryMapper != nil { + return datadog.Marshal(&obj.LogsSchemaCategoryMapper) + } + + if obj.UnparsedObject != nil { + return datadog.Marshal(obj.UnparsedObject) + } + return nil, nil // no data in oneOf schemas +} + +// GetActualInstance returns the actual instance. +func (obj *LogsSchemaMapper) GetActualInstance() interface{} { + if obj.LogsSchemaRemapper != nil { + return obj.LogsSchemaRemapper + } + + if obj.LogsSchemaCategoryMapper != nil { + return obj.LogsSchemaCategoryMapper + } + + // all schemas are nil + return nil +} diff --git a/api/datadogV1/model_logs_schema_processor.go b/api/datadogV1/model_logs_schema_processor.go new file mode 100644 index 00000000000..77eb910bfa7 --- /dev/null +++ b/api/datadogV1/model_logs_schema_processor.go @@ -0,0 +1,251 @@ +// Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +// This product includes software developed at Datadog (https://www.datadoghq.com/). +// Copyright 2019-Present Datadog, Inc. + +package datadogV1 + +import ( + "fmt" + + "github.com/DataDog/datadog-api-client-go/v2/api/datadog" +) + +// LogsSchemaProcessor A processor that has additional validations and checks for a given schema. Currently supported schema types include OCSF. +type LogsSchemaProcessor struct { + // Whether or not the processor is enabled. + IsEnabled *bool `json:"is_enabled,omitempty"` + // The `LogsSchemaProcessor` `mappers`. + Mappers []LogsSchemaMapper `json:"mappers"` + // Name of the processor. + Name string `json:"name"` + // Configuration of the schema data to use. + Schema LogsSchemaData `json:"schema"` + // Type of logs schema processor. + Type LogsSchemaProcessorType `json:"type"` + // UnparsedObject contains the raw value of the object if there was an error when deserializing into the struct + UnparsedObject map[string]interface{} `json:"-"` + AdditionalProperties map[string]interface{} `json:"-"` +} + +// NewLogsSchemaProcessor instantiates a new LogsSchemaProcessor object. +// This constructor will assign default values to properties that have it defined, +// and makes sure properties required by API are set, but the set of arguments +// will change when the set of required properties is changed. +func NewLogsSchemaProcessor(mappers []LogsSchemaMapper, name string, schema LogsSchemaData, typeVar LogsSchemaProcessorType) *LogsSchemaProcessor { + this := LogsSchemaProcessor{} + var isEnabled bool = false + this.IsEnabled = &isEnabled + this.Mappers = mappers + this.Name = name + this.Schema = schema + this.Type = typeVar + return &this +} + +// NewLogsSchemaProcessorWithDefaults instantiates a new LogsSchemaProcessor object. +// This constructor will only assign default values to properties that have it defined, +// but it doesn't guarantee that properties required by API are set. +func NewLogsSchemaProcessorWithDefaults() *LogsSchemaProcessor { + this := LogsSchemaProcessor{} + var isEnabled bool = false + this.IsEnabled = &isEnabled + var typeVar LogsSchemaProcessorType = LOGSSCHEMAPROCESSORTYPE_SCHEMA_PROCESSOR + this.Type = typeVar + return &this +} + +// GetIsEnabled returns the IsEnabled field value if set, zero value otherwise. +func (o *LogsSchemaProcessor) GetIsEnabled() bool { + if o == nil || o.IsEnabled == nil { + var ret bool + return ret + } + return *o.IsEnabled +} + +// GetIsEnabledOk returns a tuple with the IsEnabled field value if set, nil otherwise +// and a boolean to check if the value has been set. +func (o *LogsSchemaProcessor) GetIsEnabledOk() (*bool, bool) { + if o == nil || o.IsEnabled == nil { + return nil, false + } + return o.IsEnabled, true +} + +// HasIsEnabled returns a boolean if a field has been set. +func (o *LogsSchemaProcessor) HasIsEnabled() bool { + return o != nil && o.IsEnabled != nil +} + +// SetIsEnabled gets a reference to the given bool and assigns it to the IsEnabled field. +func (o *LogsSchemaProcessor) SetIsEnabled(v bool) { + o.IsEnabled = &v +} + +// GetMappers returns the Mappers field value. +func (o *LogsSchemaProcessor) GetMappers() []LogsSchemaMapper { + if o == nil { + var ret []LogsSchemaMapper + return ret + } + return o.Mappers +} + +// GetMappersOk returns a tuple with the Mappers field value +// and a boolean to check if the value has been set. +func (o *LogsSchemaProcessor) GetMappersOk() (*[]LogsSchemaMapper, bool) { + if o == nil { + return nil, false + } + return &o.Mappers, true +} + +// SetMappers sets field value. +func (o *LogsSchemaProcessor) SetMappers(v []LogsSchemaMapper) { + o.Mappers = v +} + +// GetName returns the Name field value. +func (o *LogsSchemaProcessor) GetName() string { + if o == nil { + var ret string + return ret + } + return o.Name +} + +// GetNameOk returns a tuple with the Name field value +// and a boolean to check if the value has been set. +func (o *LogsSchemaProcessor) GetNameOk() (*string, bool) { + if o == nil { + return nil, false + } + return &o.Name, true +} + +// SetName sets field value. +func (o *LogsSchemaProcessor) SetName(v string) { + o.Name = v +} + +// GetSchema returns the Schema field value. +func (o *LogsSchemaProcessor) GetSchema() LogsSchemaData { + if o == nil { + var ret LogsSchemaData + return ret + } + return o.Schema +} + +// GetSchemaOk returns a tuple with the Schema field value +// and a boolean to check if the value has been set. +func (o *LogsSchemaProcessor) GetSchemaOk() (*LogsSchemaData, bool) { + if o == nil { + return nil, false + } + return &o.Schema, true +} + +// SetSchema sets field value. +func (o *LogsSchemaProcessor) SetSchema(v LogsSchemaData) { + o.Schema = v +} + +// GetType returns the Type field value. +func (o *LogsSchemaProcessor) GetType() LogsSchemaProcessorType { + if o == nil { + var ret LogsSchemaProcessorType + return ret + } + return o.Type +} + +// GetTypeOk returns a tuple with the Type field value +// and a boolean to check if the value has been set. +func (o *LogsSchemaProcessor) GetTypeOk() (*LogsSchemaProcessorType, bool) { + if o == nil { + return nil, false + } + return &o.Type, true +} + +// SetType sets field value. +func (o *LogsSchemaProcessor) SetType(v LogsSchemaProcessorType) { + o.Type = v +} + +// MarshalJSON serializes the struct using spec logic. +func (o LogsSchemaProcessor) MarshalJSON() ([]byte, error) { + toSerialize := map[string]interface{}{} + if o.UnparsedObject != nil { + return datadog.Marshal(o.UnparsedObject) + } + if o.IsEnabled != nil { + toSerialize["is_enabled"] = o.IsEnabled + } + toSerialize["mappers"] = o.Mappers + toSerialize["name"] = o.Name + toSerialize["schema"] = o.Schema + toSerialize["type"] = o.Type + + for key, value := range o.AdditionalProperties { + toSerialize[key] = value + } + return datadog.Marshal(toSerialize) +} + +// UnmarshalJSON deserializes the given payload. +func (o *LogsSchemaProcessor) UnmarshalJSON(bytes []byte) (err error) { + all := struct { + IsEnabled *bool `json:"is_enabled,omitempty"` + Mappers *[]LogsSchemaMapper `json:"mappers"` + Name *string `json:"name"` + Schema *LogsSchemaData `json:"schema"` + Type *LogsSchemaProcessorType `json:"type"` + }{} + if err = datadog.Unmarshal(bytes, &all); err != nil { + return datadog.Unmarshal(bytes, &o.UnparsedObject) + } + if all.Mappers == nil { + return fmt.Errorf("required field mappers missing") + } + if all.Name == nil { + return fmt.Errorf("required field name missing") + } + if all.Schema == nil { + return fmt.Errorf("required field schema missing") + } + if all.Type == nil { + return fmt.Errorf("required field type missing") + } + additionalProperties := make(map[string]interface{}) + if err = datadog.Unmarshal(bytes, &additionalProperties); err == nil { + datadog.DeleteKeys(additionalProperties, &[]string{"is_enabled", "mappers", "name", "schema", "type"}) + } else { + return err + } + + hasInvalidField := false + o.IsEnabled = all.IsEnabled + o.Mappers = *all.Mappers + o.Name = *all.Name + if all.Schema.UnparsedObject != nil && o.UnparsedObject == nil { + hasInvalidField = true + } + o.Schema = *all.Schema + if !all.Type.IsValid() { + hasInvalidField = true + } else { + o.Type = *all.Type + } + + if len(additionalProperties) > 0 { + o.AdditionalProperties = additionalProperties + } + + if hasInvalidField { + return datadog.Unmarshal(bytes, &o.UnparsedObject) + } + + return nil +} diff --git a/api/datadogV1/model_logs_schema_processor_type.go b/api/datadogV1/model_logs_schema_processor_type.go new file mode 100644 index 00000000000..62543ae900a --- /dev/null +++ b/api/datadogV1/model_logs_schema_processor_type.go @@ -0,0 +1,64 @@ +// Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +// This product includes software developed at Datadog (https://www.datadoghq.com/). +// Copyright 2019-Present Datadog, Inc. + +package datadogV1 + +import ( + "fmt" + + "github.com/DataDog/datadog-api-client-go/v2/api/datadog" +) + +// LogsSchemaProcessorType Type of logs schema processor. +type LogsSchemaProcessorType string + +// List of LogsSchemaProcessorType. +const ( + LOGSSCHEMAPROCESSORTYPE_SCHEMA_PROCESSOR LogsSchemaProcessorType = "schema-processor" +) + +var allowedLogsSchemaProcessorTypeEnumValues = []LogsSchemaProcessorType{ + LOGSSCHEMAPROCESSORTYPE_SCHEMA_PROCESSOR, +} + +// GetAllowedValues reeturns the list of possible values. +func (v *LogsSchemaProcessorType) GetAllowedValues() []LogsSchemaProcessorType { + return allowedLogsSchemaProcessorTypeEnumValues +} + +// UnmarshalJSON deserializes the given payload. +func (v *LogsSchemaProcessorType) UnmarshalJSON(src []byte) error { + var value string + err := datadog.Unmarshal(src, &value) + if err != nil { + return err + } + *v = LogsSchemaProcessorType(value) + return nil +} + +// NewLogsSchemaProcessorTypeFromValue returns a pointer to a valid LogsSchemaProcessorType +// for the value passed as argument, or an error if the value passed is not allowed by the enum. +func NewLogsSchemaProcessorTypeFromValue(v string) (*LogsSchemaProcessorType, error) { + ev := LogsSchemaProcessorType(v) + if ev.IsValid() { + return &ev, nil + } + return nil, fmt.Errorf("invalid value '%v' for LogsSchemaProcessorType: valid values are %v", v, allowedLogsSchemaProcessorTypeEnumValues) +} + +// IsValid return true if the value is valid for the enum, false otherwise. +func (v LogsSchemaProcessorType) IsValid() bool { + for _, existing := range allowedLogsSchemaProcessorTypeEnumValues { + if existing == v { + return true + } + } + return false +} + +// Ptr returns reference to LogsSchemaProcessorType value. +func (v LogsSchemaProcessorType) Ptr() *LogsSchemaProcessorType { + return &v +} diff --git a/api/datadogV1/model_logs_schema_remapper.go b/api/datadogV1/model_logs_schema_remapper.go new file mode 100644 index 00000000000..6654c075c40 --- /dev/null +++ b/api/datadogV1/model_logs_schema_remapper.go @@ -0,0 +1,326 @@ +// Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +// This product includes software developed at Datadog (https://www.datadoghq.com/). +// Copyright 2019-Present Datadog, Inc. + +package datadogV1 + +import ( + "fmt" + + "github.com/DataDog/datadog-api-client-go/v2/api/datadog" +) + +// LogsSchemaRemapper The schema remapper maps source log fields to their correct fields. +type LogsSchemaRemapper struct { + // Name of the logs schema remapper. + Name string `json:"name"` + // Override or not the target element if already set. + OverrideOnConflict *bool `json:"override_on_conflict,omitempty"` + // Remove or preserve the remapped source element. + PreserveSource *bool `json:"preserve_source,omitempty"` + // Array of source attributes. + Sources []string `json:"sources"` + // Target field to map log source field to. + Target string `json:"target"` + // If the `target_type` of the remapper is `attribute`, try to cast the value to a new specific type. + // If the cast is not possible, the original type is kept. `string`, `integer`, or `double` are the possible types. + // If the `target_type` is `tag`, this parameter may not be specified. + TargetFormat *TargetFormatType `json:"target_format,omitempty"` + // Type of logs schema remapper. + Type LogsSchemaRemapperType `json:"type"` + // UnparsedObject contains the raw value of the object if there was an error when deserializing into the struct + UnparsedObject map[string]interface{} `json:"-"` + AdditionalProperties map[string]interface{} `json:"-"` +} + +// NewLogsSchemaRemapper instantiates a new LogsSchemaRemapper object. +// This constructor will assign default values to properties that have it defined, +// and makes sure properties required by API are set, but the set of arguments +// will change when the set of required properties is changed. +func NewLogsSchemaRemapper(name string, sources []string, target string, typeVar LogsSchemaRemapperType) *LogsSchemaRemapper { + this := LogsSchemaRemapper{} + this.Name = name + var overrideOnConflict bool = false + this.OverrideOnConflict = &overrideOnConflict + var preserveSource bool = false + this.PreserveSource = &preserveSource + this.Sources = sources + this.Target = target + this.Type = typeVar + return &this +} + +// NewLogsSchemaRemapperWithDefaults instantiates a new LogsSchemaRemapper object. +// This constructor will only assign default values to properties that have it defined, +// but it doesn't guarantee that properties required by API are set. +func NewLogsSchemaRemapperWithDefaults() *LogsSchemaRemapper { + this := LogsSchemaRemapper{} + var overrideOnConflict bool = false + this.OverrideOnConflict = &overrideOnConflict + var preserveSource bool = false + this.PreserveSource = &preserveSource + return &this +} + +// GetName returns the Name field value. +func (o *LogsSchemaRemapper) GetName() string { + if o == nil { + var ret string + return ret + } + return o.Name +} + +// GetNameOk returns a tuple with the Name field value +// and a boolean to check if the value has been set. +func (o *LogsSchemaRemapper) GetNameOk() (*string, bool) { + if o == nil { + return nil, false + } + return &o.Name, true +} + +// SetName sets field value. +func (o *LogsSchemaRemapper) SetName(v string) { + o.Name = v +} + +// GetOverrideOnConflict returns the OverrideOnConflict field value if set, zero value otherwise. +func (o *LogsSchemaRemapper) GetOverrideOnConflict() bool { + if o == nil || o.OverrideOnConflict == nil { + var ret bool + return ret + } + return *o.OverrideOnConflict +} + +// GetOverrideOnConflictOk returns a tuple with the OverrideOnConflict field value if set, nil otherwise +// and a boolean to check if the value has been set. +func (o *LogsSchemaRemapper) GetOverrideOnConflictOk() (*bool, bool) { + if o == nil || o.OverrideOnConflict == nil { + return nil, false + } + return o.OverrideOnConflict, true +} + +// HasOverrideOnConflict returns a boolean if a field has been set. +func (o *LogsSchemaRemapper) HasOverrideOnConflict() bool { + return o != nil && o.OverrideOnConflict != nil +} + +// SetOverrideOnConflict gets a reference to the given bool and assigns it to the OverrideOnConflict field. +func (o *LogsSchemaRemapper) SetOverrideOnConflict(v bool) { + o.OverrideOnConflict = &v +} + +// GetPreserveSource returns the PreserveSource field value if set, zero value otherwise. +func (o *LogsSchemaRemapper) GetPreserveSource() bool { + if o == nil || o.PreserveSource == nil { + var ret bool + return ret + } + return *o.PreserveSource +} + +// GetPreserveSourceOk returns a tuple with the PreserveSource field value if set, nil otherwise +// and a boolean to check if the value has been set. +func (o *LogsSchemaRemapper) GetPreserveSourceOk() (*bool, bool) { + if o == nil || o.PreserveSource == nil { + return nil, false + } + return o.PreserveSource, true +} + +// HasPreserveSource returns a boolean if a field has been set. +func (o *LogsSchemaRemapper) HasPreserveSource() bool { + return o != nil && o.PreserveSource != nil +} + +// SetPreserveSource gets a reference to the given bool and assigns it to the PreserveSource field. +func (o *LogsSchemaRemapper) SetPreserveSource(v bool) { + o.PreserveSource = &v +} + +// GetSources returns the Sources field value. +func (o *LogsSchemaRemapper) GetSources() []string { + if o == nil { + var ret []string + return ret + } + return o.Sources +} + +// GetSourcesOk returns a tuple with the Sources field value +// and a boolean to check if the value has been set. +func (o *LogsSchemaRemapper) GetSourcesOk() (*[]string, bool) { + if o == nil { + return nil, false + } + return &o.Sources, true +} + +// SetSources sets field value. +func (o *LogsSchemaRemapper) SetSources(v []string) { + o.Sources = v +} + +// GetTarget returns the Target field value. +func (o *LogsSchemaRemapper) GetTarget() string { + if o == nil { + var ret string + return ret + } + return o.Target +} + +// GetTargetOk returns a tuple with the Target field value +// and a boolean to check if the value has been set. +func (o *LogsSchemaRemapper) GetTargetOk() (*string, bool) { + if o == nil { + return nil, false + } + return &o.Target, true +} + +// SetTarget sets field value. +func (o *LogsSchemaRemapper) SetTarget(v string) { + o.Target = v +} + +// GetTargetFormat returns the TargetFormat field value if set, zero value otherwise. +func (o *LogsSchemaRemapper) GetTargetFormat() TargetFormatType { + if o == nil || o.TargetFormat == nil { + var ret TargetFormatType + return ret + } + return *o.TargetFormat +} + +// GetTargetFormatOk returns a tuple with the TargetFormat field value if set, nil otherwise +// and a boolean to check if the value has been set. +func (o *LogsSchemaRemapper) GetTargetFormatOk() (*TargetFormatType, bool) { + if o == nil || o.TargetFormat == nil { + return nil, false + } + return o.TargetFormat, true +} + +// HasTargetFormat returns a boolean if a field has been set. +func (o *LogsSchemaRemapper) HasTargetFormat() bool { + return o != nil && o.TargetFormat != nil +} + +// SetTargetFormat gets a reference to the given TargetFormatType and assigns it to the TargetFormat field. +func (o *LogsSchemaRemapper) SetTargetFormat(v TargetFormatType) { + o.TargetFormat = &v +} + +// GetType returns the Type field value. +func (o *LogsSchemaRemapper) GetType() LogsSchemaRemapperType { + if o == nil { + var ret LogsSchemaRemapperType + return ret + } + return o.Type +} + +// GetTypeOk returns a tuple with the Type field value +// and a boolean to check if the value has been set. +func (o *LogsSchemaRemapper) GetTypeOk() (*LogsSchemaRemapperType, bool) { + if o == nil { + return nil, false + } + return &o.Type, true +} + +// SetType sets field value. +func (o *LogsSchemaRemapper) SetType(v LogsSchemaRemapperType) { + o.Type = v +} + +// MarshalJSON serializes the struct using spec logic. +func (o LogsSchemaRemapper) MarshalJSON() ([]byte, error) { + toSerialize := map[string]interface{}{} + if o.UnparsedObject != nil { + return datadog.Marshal(o.UnparsedObject) + } + toSerialize["name"] = o.Name + if o.OverrideOnConflict != nil { + toSerialize["override_on_conflict"] = o.OverrideOnConflict + } + if o.PreserveSource != nil { + toSerialize["preserve_source"] = o.PreserveSource + } + toSerialize["sources"] = o.Sources + toSerialize["target"] = o.Target + if o.TargetFormat != nil { + toSerialize["target_format"] = o.TargetFormat + } + toSerialize["type"] = o.Type + + for key, value := range o.AdditionalProperties { + toSerialize[key] = value + } + return datadog.Marshal(toSerialize) +} + +// UnmarshalJSON deserializes the given payload. +func (o *LogsSchemaRemapper) UnmarshalJSON(bytes []byte) (err error) { + all := struct { + Name *string `json:"name"` + OverrideOnConflict *bool `json:"override_on_conflict,omitempty"` + PreserveSource *bool `json:"preserve_source,omitempty"` + Sources *[]string `json:"sources"` + Target *string `json:"target"` + TargetFormat *TargetFormatType `json:"target_format,omitempty"` + Type *LogsSchemaRemapperType `json:"type"` + }{} + if err = datadog.Unmarshal(bytes, &all); err != nil { + return datadog.Unmarshal(bytes, &o.UnparsedObject) + } + if all.Name == nil { + return fmt.Errorf("required field name missing") + } + if all.Sources == nil { + return fmt.Errorf("required field sources missing") + } + if all.Target == nil { + return fmt.Errorf("required field target missing") + } + if all.Type == nil { + return fmt.Errorf("required field type missing") + } + additionalProperties := make(map[string]interface{}) + if err = datadog.Unmarshal(bytes, &additionalProperties); err == nil { + datadog.DeleteKeys(additionalProperties, &[]string{"name", "override_on_conflict", "preserve_source", "sources", "target", "target_format", "type"}) + } else { + return err + } + + hasInvalidField := false + o.Name = *all.Name + o.OverrideOnConflict = all.OverrideOnConflict + o.PreserveSource = all.PreserveSource + o.Sources = *all.Sources + o.Target = *all.Target + if all.TargetFormat != nil && !all.TargetFormat.IsValid() { + hasInvalidField = true + } else { + o.TargetFormat = all.TargetFormat + } + if !all.Type.IsValid() { + hasInvalidField = true + } else { + o.Type = *all.Type + } + + if len(additionalProperties) > 0 { + o.AdditionalProperties = additionalProperties + } + + if hasInvalidField { + return datadog.Unmarshal(bytes, &o.UnparsedObject) + } + + return nil +} diff --git a/api/datadogV1/model_logs_schema_remapper_type.go b/api/datadogV1/model_logs_schema_remapper_type.go new file mode 100644 index 00000000000..6c376f7c01a --- /dev/null +++ b/api/datadogV1/model_logs_schema_remapper_type.go @@ -0,0 +1,64 @@ +// Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +// This product includes software developed at Datadog (https://www.datadoghq.com/). +// Copyright 2019-Present Datadog, Inc. + +package datadogV1 + +import ( + "fmt" + + "github.com/DataDog/datadog-api-client-go/v2/api/datadog" +) + +// LogsSchemaRemapperType Type of logs schema remapper. +type LogsSchemaRemapperType string + +// List of LogsSchemaRemapperType. +const ( + LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER LogsSchemaRemapperType = "schema-remapper" +) + +var allowedLogsSchemaRemapperTypeEnumValues = []LogsSchemaRemapperType{ + LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, +} + +// GetAllowedValues reeturns the list of possible values. +func (v *LogsSchemaRemapperType) GetAllowedValues() []LogsSchemaRemapperType { + return allowedLogsSchemaRemapperTypeEnumValues +} + +// UnmarshalJSON deserializes the given payload. +func (v *LogsSchemaRemapperType) UnmarshalJSON(src []byte) error { + var value string + err := datadog.Unmarshal(src, &value) + if err != nil { + return err + } + *v = LogsSchemaRemapperType(value) + return nil +} + +// NewLogsSchemaRemapperTypeFromValue returns a pointer to a valid LogsSchemaRemapperType +// for the value passed as argument, or an error if the value passed is not allowed by the enum. +func NewLogsSchemaRemapperTypeFromValue(v string) (*LogsSchemaRemapperType, error) { + ev := LogsSchemaRemapperType(v) + if ev.IsValid() { + return &ev, nil + } + return nil, fmt.Errorf("invalid value '%v' for LogsSchemaRemapperType: valid values are %v", v, allowedLogsSchemaRemapperTypeEnumValues) +} + +// IsValid return true if the value is valid for the enum, false otherwise. +func (v LogsSchemaRemapperType) IsValid() bool { + for _, existing := range allowedLogsSchemaRemapperTypeEnumValues { + if existing == v { + return true + } + } + return false +} + +// Ptr returns reference to LogsSchemaRemapperType value. +func (v LogsSchemaRemapperType) Ptr() *LogsSchemaRemapperType { + return &v +} diff --git a/examples/v1/logs-pipelines/CreateLogsPipeline_1745625064.go b/examples/v1/logs-pipelines/CreateLogsPipeline_1745625064.go new file mode 100644 index 00000000000..67e0d414049 --- /dev/null +++ b/examples/v1/logs-pipelines/CreateLogsPipeline_1745625064.go @@ -0,0 +1,288 @@ +// Create a pipeline with Schema Processor and preserve_source true returns "OK" response + +package main + +import ( + "context" + "encoding/json" + "fmt" + "os" + + "github.com/DataDog/datadog-api-client-go/v2/api/datadog" + "github.com/DataDog/datadog-api-client-go/v2/api/datadogV1" +) + +func main() { + body := datadogV1.LogsPipeline{ + Filter: &datadogV1.LogsFilter{ + Query: datadog.PtrString("source:python"), + }, + Name: "testSchemaProcessor", + Processors: []datadogV1.LogsProcessor{ + datadogV1.LogsProcessor{ + LogsSchemaProcessor: &datadogV1.LogsSchemaProcessor{ + Type: datadogV1.LOGSSCHEMAPROCESSORTYPE_SCHEMA_PROCESSOR, + IsEnabled: datadog.PtrBool(true), + Name: "Apply OCSF schema for 3001", + Schema: datadogV1.LogsSchemaData{ + SchemaType: "ocsf", + Version: "1.5.0", + ClassUid: 3001, + ClassName: "Account Change", + Profiles: []string{ + "cloud", + "datetime", + }, + }, + Mappers: []datadogV1.LogsSchemaMapper{ + datadogV1.LogsSchemaMapper{ + LogsSchemaCategoryMapper: &datadogV1.LogsSchemaCategoryMapper{ + Type: datadogV1.LOGSSCHEMACATEGORYMAPPERTYPE_SCHEMA_CATEGORY_MAPPER, + Name: "activity_id and activity_name", + Categories: []datadogV1.LogsSchemaCategoryMapperCategory{ + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:(*Create*)"), + }, + Name: "Create", + Id: 1, + }, + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:(ChangePassword OR PasswordUpdated)"), + }, + Name: "Password Change", + Id: 3, + }, + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:(*Attach*)"), + }, + Name: "Attach Policy", + Id: 7, + }, + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:(*Detach* OR *Remove*)"), + }, + Name: "Detach Policy", + Id: 8, + }, + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:(*Delete*)"), + }, + Name: "Delete", + Id: 6, + }, + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:*"), + }, + Name: "Other", + Id: 99, + }, + }, + Targets: datadogV1.LogsSchemaCategoryMapperTargets{ + Name: datadog.PtrString("ocsf.activity_name"), + Id: datadog.PtrString("ocsf.activity_id"), + }, + Fallback: &datadogV1.LogsSchemaCategoryMapperFallback{ + Values: map[string]string{ + "ocsf.activity_id": "99", + "ocsf.activity_name": "Other", + }, + Sources: map[string][]string{ + "ocsf.activity_name": []string{ + "eventName", + }, + }, + }, + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaCategoryMapper: &datadogV1.LogsSchemaCategoryMapper{ + Type: datadogV1.LOGSSCHEMACATEGORYMAPPERTYPE_SCHEMA_CATEGORY_MAPPER, + Name: "status", + Categories: []datadogV1.LogsSchemaCategoryMapperCategory{ + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("-@errorCode:*"), + }, + Id: 1, + Name: "Success", + }, + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@errorCode:*"), + }, + Id: 2, + Name: "Failure", + }, + }, + Targets: datadogV1.LogsSchemaCategoryMapperTargets{ + Id: datadog.PtrString("ocsf.status_id"), + Name: datadog.PtrString("ocsf.status"), + }, + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaCategoryMapper: &datadogV1.LogsSchemaCategoryMapper{ + Type: datadogV1.LOGSSCHEMACATEGORYMAPPERTYPE_SCHEMA_CATEGORY_MAPPER, + Name: "Set default severity", + Categories: []datadogV1.LogsSchemaCategoryMapperCategory{ + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:*"), + }, + Name: "Informational", + Id: 1, + }, + }, + Targets: datadogV1.LogsSchemaCategoryMapperTargets{ + Name: datadog.PtrString("ocsf.severity"), + Id: datadog.PtrString("ocsf.severity_id"), + }, + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map userIdentity to ocsf.user.uid", + Sources: []string{ + "userIdentity.principalId", + "responseElements.role.roleId", + "responseElements.user.userId", + }, + Target: "ocsf.user.uid", + PreserveSource: datadog.PtrBool(true), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map userName to ocsf.user.name", + Sources: []string{ + "requestParameters.userName", + "responseElements.role.roleName", + "requestParameters.roleName", + "responseElements.user.userName", + }, + Target: "ocsf.user.name", + PreserveSource: datadog.PtrBool(true), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map api to ocsf.api", + Sources: []string{ + "api", + }, + Target: "ocsf.api", + PreserveSource: datadog.PtrBool(true), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map user to ocsf.user", + Sources: []string{ + "user", + }, + Target: "ocsf.user", + PreserveSource: datadog.PtrBool(true), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map actor to ocsf.actor", + Sources: []string{ + "actor", + }, + Target: "ocsf.actor", + PreserveSource: datadog.PtrBool(true), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map cloud to ocsf.cloud", + Sources: []string{ + "cloud", + }, + Target: "ocsf.cloud", + PreserveSource: datadog.PtrBool(true), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map http_request to ocsf.http_request", + Sources: []string{ + "http_request", + }, + Target: "ocsf.http_request", + PreserveSource: datadog.PtrBool(true), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map metadata to ocsf.metadata", + Sources: []string{ + "metadata", + }, + Target: "ocsf.metadata", + PreserveSource: datadog.PtrBool(true), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map time to ocsf.time", + Sources: []string{ + "time", + }, + Target: "ocsf.time", + PreserveSource: datadog.PtrBool(true), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map src_endpoint to ocsf.src_endpoint", + Sources: []string{ + "src_endpoint", + }, + Target: "ocsf.src_endpoint", + PreserveSource: datadog.PtrBool(true), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map severity to ocsf.severity", + Sources: []string{ + "severity", + }, + Target: "ocsf.severity", + PreserveSource: datadog.PtrBool(true), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map severity_id to ocsf.severity_id", + Sources: []string{ + "severity_id", + }, + Target: "ocsf.severity_id", + PreserveSource: datadog.PtrBool(true), + }}, + }, + }}, + }, + Tags: []string{}, + } + ctx := datadog.NewDefaultContext(context.Background()) + configuration := datadog.NewConfiguration() + apiClient := datadog.NewAPIClient(configuration) + api := datadogV1.NewLogsPipelinesApi(apiClient) + resp, r, err := api.CreateLogsPipeline(ctx, body) + + if err != nil { + fmt.Fprintf(os.Stderr, "Error when calling `LogsPipelinesApi.CreateLogsPipeline`: %v\n", err) + fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r) + } + + responseContent, _ := json.MarshalIndent(resp, "", " ") + fmt.Fprintf(os.Stdout, "Response from `LogsPipelinesApi.CreateLogsPipeline`:\n%s\n", responseContent) +} diff --git a/examples/v1/logs-pipelines/CreateLogsPipeline_2256674867.go b/examples/v1/logs-pipelines/CreateLogsPipeline_2256674867.go new file mode 100644 index 00000000000..c2dd6a666a6 --- /dev/null +++ b/examples/v1/logs-pipelines/CreateLogsPipeline_2256674867.go @@ -0,0 +1,288 @@ +// Create a pipeline with Schema Processor and preserve_source false returns "OK" response + +package main + +import ( + "context" + "encoding/json" + "fmt" + "os" + + "github.com/DataDog/datadog-api-client-go/v2/api/datadog" + "github.com/DataDog/datadog-api-client-go/v2/api/datadogV1" +) + +func main() { + body := datadogV1.LogsPipeline{ + Filter: &datadogV1.LogsFilter{ + Query: datadog.PtrString("source:python"), + }, + Name: "testSchemaProcessor", + Processors: []datadogV1.LogsProcessor{ + datadogV1.LogsProcessor{ + LogsSchemaProcessor: &datadogV1.LogsSchemaProcessor{ + Type: datadogV1.LOGSSCHEMAPROCESSORTYPE_SCHEMA_PROCESSOR, + IsEnabled: datadog.PtrBool(true), + Name: "Apply OCSF schema for 3001", + Schema: datadogV1.LogsSchemaData{ + SchemaType: "ocsf", + Version: "1.5.0", + ClassUid: 3001, + ClassName: "Account Change", + Profiles: []string{ + "cloud", + "datetime", + }, + }, + Mappers: []datadogV1.LogsSchemaMapper{ + datadogV1.LogsSchemaMapper{ + LogsSchemaCategoryMapper: &datadogV1.LogsSchemaCategoryMapper{ + Type: datadogV1.LOGSSCHEMACATEGORYMAPPERTYPE_SCHEMA_CATEGORY_MAPPER, + Name: "activity_id and activity_name", + Categories: []datadogV1.LogsSchemaCategoryMapperCategory{ + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:(*Create*)"), + }, + Name: "Create", + Id: 1, + }, + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:(ChangePassword OR PasswordUpdated)"), + }, + Name: "Password Change", + Id: 3, + }, + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:(*Attach*)"), + }, + Name: "Attach Policy", + Id: 7, + }, + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:(*Detach* OR *Remove*)"), + }, + Name: "Detach Policy", + Id: 8, + }, + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:(*Delete*)"), + }, + Name: "Delete", + Id: 6, + }, + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:*"), + }, + Name: "Other", + Id: 99, + }, + }, + Targets: datadogV1.LogsSchemaCategoryMapperTargets{ + Name: datadog.PtrString("ocsf.activity_name"), + Id: datadog.PtrString("ocsf.activity_id"), + }, + Fallback: &datadogV1.LogsSchemaCategoryMapperFallback{ + Values: map[string]string{ + "ocsf.activity_id": "99", + "ocsf.activity_name": "Other", + }, + Sources: map[string][]string{ + "ocsf.activity_name": []string{ + "eventName", + }, + }, + }, + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaCategoryMapper: &datadogV1.LogsSchemaCategoryMapper{ + Type: datadogV1.LOGSSCHEMACATEGORYMAPPERTYPE_SCHEMA_CATEGORY_MAPPER, + Name: "status", + Categories: []datadogV1.LogsSchemaCategoryMapperCategory{ + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("-@errorCode:*"), + }, + Id: 1, + Name: "Success", + }, + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@errorCode:*"), + }, + Id: 2, + Name: "Failure", + }, + }, + Targets: datadogV1.LogsSchemaCategoryMapperTargets{ + Id: datadog.PtrString("ocsf.status_id"), + Name: datadog.PtrString("ocsf.status"), + }, + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaCategoryMapper: &datadogV1.LogsSchemaCategoryMapper{ + Type: datadogV1.LOGSSCHEMACATEGORYMAPPERTYPE_SCHEMA_CATEGORY_MAPPER, + Name: "Set default severity", + Categories: []datadogV1.LogsSchemaCategoryMapperCategory{ + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:*"), + }, + Name: "Informational", + Id: 1, + }, + }, + Targets: datadogV1.LogsSchemaCategoryMapperTargets{ + Name: datadog.PtrString("ocsf.severity"), + Id: datadog.PtrString("ocsf.severity_id"), + }, + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map userIdentity to ocsf.user.uid", + Sources: []string{ + "userIdentity.principalId", + "responseElements.role.roleId", + "responseElements.user.userId", + }, + Target: "ocsf.user.uid", + PreserveSource: datadog.PtrBool(false), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map userName to ocsf.user.name", + Sources: []string{ + "requestParameters.userName", + "responseElements.role.roleName", + "requestParameters.roleName", + "responseElements.user.userName", + }, + Target: "ocsf.user.name", + PreserveSource: datadog.PtrBool(false), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map api to ocsf.api", + Sources: []string{ + "api", + }, + Target: "ocsf.api", + PreserveSource: datadog.PtrBool(false), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map user to ocsf.user", + Sources: []string{ + "user", + }, + Target: "ocsf.user", + PreserveSource: datadog.PtrBool(false), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map actor to ocsf.actor", + Sources: []string{ + "actor", + }, + Target: "ocsf.actor", + PreserveSource: datadog.PtrBool(false), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map cloud to ocsf.cloud", + Sources: []string{ + "cloud", + }, + Target: "ocsf.cloud", + PreserveSource: datadog.PtrBool(false), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map http_request to ocsf.http_request", + Sources: []string{ + "http_request", + }, + Target: "ocsf.http_request", + PreserveSource: datadog.PtrBool(false), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map metadata to ocsf.metadata", + Sources: []string{ + "metadata", + }, + Target: "ocsf.metadata", + PreserveSource: datadog.PtrBool(false), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map time to ocsf.time", + Sources: []string{ + "time", + }, + Target: "ocsf.time", + PreserveSource: datadog.PtrBool(false), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map src_endpoint to ocsf.src_endpoint", + Sources: []string{ + "src_endpoint", + }, + Target: "ocsf.src_endpoint", + PreserveSource: datadog.PtrBool(false), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map severity to ocsf.severity", + Sources: []string{ + "severity", + }, + Target: "ocsf.severity", + PreserveSource: datadog.PtrBool(false), + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map severity_id to ocsf.severity_id", + Sources: []string{ + "severity_id", + }, + Target: "ocsf.severity_id", + PreserveSource: datadog.PtrBool(false), + }}, + }, + }}, + }, + Tags: []string{}, + } + ctx := datadog.NewDefaultContext(context.Background()) + configuration := datadog.NewConfiguration() + apiClient := datadog.NewAPIClient(configuration) + api := datadogV1.NewLogsPipelinesApi(apiClient) + resp, r, err := api.CreateLogsPipeline(ctx, body) + + if err != nil { + fmt.Fprintf(os.Stderr, "Error when calling `LogsPipelinesApi.CreateLogsPipeline`: %v\n", err) + fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r) + } + + responseContent, _ := json.MarshalIndent(resp, "", " ") + fmt.Fprintf(os.Stdout, "Response from `LogsPipelinesApi.CreateLogsPipeline`:\n%s\n", responseContent) +} diff --git a/examples/v1/logs-pipelines/CreateLogsPipeline_501419705.go b/examples/v1/logs-pipelines/CreateLogsPipeline_501419705.go new file mode 100644 index 00000000000..a74d74f4df7 --- /dev/null +++ b/examples/v1/logs-pipelines/CreateLogsPipeline_501419705.go @@ -0,0 +1,276 @@ +// Create a pipeline with schema processor + +package main + +import ( + "context" + "encoding/json" + "fmt" + "os" + + "github.com/DataDog/datadog-api-client-go/v2/api/datadog" + "github.com/DataDog/datadog-api-client-go/v2/api/datadogV1" +) + +func main() { + body := datadogV1.LogsPipeline{ + Filter: &datadogV1.LogsFilter{ + Query: datadog.PtrString("source:python"), + }, + Name: "testSchemaProcessor", + Processors: []datadogV1.LogsProcessor{ + datadogV1.LogsProcessor{ + LogsSchemaProcessor: &datadogV1.LogsSchemaProcessor{ + Type: datadogV1.LOGSSCHEMAPROCESSORTYPE_SCHEMA_PROCESSOR, + IsEnabled: datadog.PtrBool(true), + Name: "Apply OCSF schema for 3001", + Schema: datadogV1.LogsSchemaData{ + SchemaType: "ocsf", + Version: "1.5.0", + ClassUid: 3001, + ClassName: "Account Change", + Profiles: []string{ + "cloud", + "datetime", + }, + }, + Mappers: []datadogV1.LogsSchemaMapper{ + datadogV1.LogsSchemaMapper{ + LogsSchemaCategoryMapper: &datadogV1.LogsSchemaCategoryMapper{ + Type: datadogV1.LOGSSCHEMACATEGORYMAPPERTYPE_SCHEMA_CATEGORY_MAPPER, + Name: "activity_id and activity_name", + Categories: []datadogV1.LogsSchemaCategoryMapperCategory{ + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:(*Create*)"), + }, + Name: "Create", + Id: 1, + }, + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:(ChangePassword OR PasswordUpdated)"), + }, + Name: "Password Change", + Id: 3, + }, + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:(*Attach*)"), + }, + Name: "Attach Policy", + Id: 7, + }, + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:(*Detach* OR *Remove*)"), + }, + Name: "Detach Policy", + Id: 8, + }, + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:(*Delete*)"), + }, + Name: "Delete", + Id: 6, + }, + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:*"), + }, + Name: "Other", + Id: 99, + }, + }, + Targets: datadogV1.LogsSchemaCategoryMapperTargets{ + Name: datadog.PtrString("ocsf.activity_name"), + Id: datadog.PtrString("ocsf.activity_id"), + }, + Fallback: &datadogV1.LogsSchemaCategoryMapperFallback{ + Values: map[string]string{ + "ocsf.activity_id": "99", + "ocsf.activity_name": "Other", + }, + Sources: map[string][]string{ + "ocsf.activity_name": []string{ + "eventName", + }, + }, + }, + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaCategoryMapper: &datadogV1.LogsSchemaCategoryMapper{ + Type: datadogV1.LOGSSCHEMACATEGORYMAPPERTYPE_SCHEMA_CATEGORY_MAPPER, + Name: "status", + Categories: []datadogV1.LogsSchemaCategoryMapperCategory{ + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("-@errorCode:*"), + }, + Id: 1, + Name: "Success", + }, + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@errorCode:*"), + }, + Id: 2, + Name: "Failure", + }, + }, + Targets: datadogV1.LogsSchemaCategoryMapperTargets{ + Id: datadog.PtrString("ocsf.status_id"), + Name: datadog.PtrString("ocsf.status"), + }, + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaCategoryMapper: &datadogV1.LogsSchemaCategoryMapper{ + Type: datadogV1.LOGSSCHEMACATEGORYMAPPERTYPE_SCHEMA_CATEGORY_MAPPER, + Name: "Set default severity", + Categories: []datadogV1.LogsSchemaCategoryMapperCategory{ + { + Filter: datadogV1.LogsFilter{ + Query: datadog.PtrString("@eventName:*"), + }, + Name: "Informational", + Id: 1, + }, + }, + Targets: datadogV1.LogsSchemaCategoryMapperTargets{ + Name: datadog.PtrString("ocsf.severity"), + Id: datadog.PtrString("ocsf.severity_id"), + }, + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map userIdentity to ocsf.user.uid", + Sources: []string{ + "userIdentity.principalId", + "responseElements.role.roleId", + "responseElements.user.userId", + }, + Target: "ocsf.user.uid", + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map userName to ocsf.user.name", + Sources: []string{ + "requestParameters.userName", + "responseElements.role.roleName", + "requestParameters.roleName", + "responseElements.user.userName", + }, + Target: "ocsf.user.name", + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map api to ocsf.api", + Sources: []string{ + "api", + }, + Target: "ocsf.api", + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map user to ocsf.user", + Sources: []string{ + "user", + }, + Target: "ocsf.user", + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map actor to ocsf.actor", + Sources: []string{ + "actor", + }, + Target: "ocsf.actor", + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map cloud to ocsf.cloud", + Sources: []string{ + "cloud", + }, + Target: "ocsf.cloud", + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map http_request to ocsf.http_request", + Sources: []string{ + "http_request", + }, + Target: "ocsf.http_request", + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map metadata to ocsf.metadata", + Sources: []string{ + "metadata", + }, + Target: "ocsf.metadata", + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map time to ocsf.time", + Sources: []string{ + "time", + }, + Target: "ocsf.time", + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map src_endpoint to ocsf.src_endpoint", + Sources: []string{ + "src_endpoint", + }, + Target: "ocsf.src_endpoint", + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map severity to ocsf.severity", + Sources: []string{ + "severity", + }, + Target: "ocsf.severity", + }}, + datadogV1.LogsSchemaMapper{ + LogsSchemaRemapper: &datadogV1.LogsSchemaRemapper{ + Type: datadogV1.LOGSSCHEMAREMAPPERTYPE_SCHEMA_REMAPPER, + Name: "Map severity_id to ocsf.severity_id", + Sources: []string{ + "severity_id", + }, + Target: "ocsf.severity_id", + }}, + }, + }}, + }, + Tags: []string{}, + } + ctx := datadog.NewDefaultContext(context.Background()) + configuration := datadog.NewConfiguration() + apiClient := datadog.NewAPIClient(configuration) + api := datadogV1.NewLogsPipelinesApi(apiClient) + resp, r, err := api.CreateLogsPipeline(ctx, body) + + if err != nil { + fmt.Fprintf(os.Stderr, "Error when calling `LogsPipelinesApi.CreateLogsPipeline`: %v\n", err) + fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r) + } + + responseContent, _ := json.MarshalIndent(resp, "", " ") + fmt.Fprintf(os.Stdout, "Response from `LogsPipelinesApi.CreateLogsPipeline`:\n%s\n", responseContent) +} diff --git a/tests/scenarios/cassettes/TestScenarios/v1/Feature_Logs_Pipelines/Scenario_Create_a_pipeline_with_Schema_Processor_and_preserve_source_false_returns_OK_response.freeze b/tests/scenarios/cassettes/TestScenarios/v1/Feature_Logs_Pipelines/Scenario_Create_a_pipeline_with_Schema_Processor_and_preserve_source_false_returns_OK_response.freeze new file mode 100644 index 00000000000..bbc78f11a09 --- /dev/null +++ b/tests/scenarios/cassettes/TestScenarios/v1/Feature_Logs_Pipelines/Scenario_Create_a_pipeline_with_Schema_Processor_and_preserve_source_false_returns_OK_response.freeze @@ -0,0 +1 @@ +2025-10-22T19:11:58.774Z \ No newline at end of file diff --git a/tests/scenarios/cassettes/TestScenarios/v1/Feature_Logs_Pipelines/Scenario_Create_a_pipeline_with_Schema_Processor_and_preserve_source_false_returns_OK_response.yaml b/tests/scenarios/cassettes/TestScenarios/v1/Feature_Logs_Pipelines/Scenario_Create_a_pipeline_with_Schema_Processor_and_preserve_source_false_returns_OK_response.yaml new file mode 100644 index 00000000000..18115b0078e --- /dev/null +++ b/tests/scenarios/cassettes/TestScenarios/v1/Feature_Logs_Pipelines/Scenario_Create_a_pipeline_with_Schema_Processor_and_preserve_source_false_returns_OK_response.yaml @@ -0,0 +1,62 @@ +interactions: +- request: + body: | + {"filter":{"query":"source:python"},"name":"testSchemaProcessor","processors":[{"is_enabled":true,"mappers":[{"categories":[{"filter":{"query":"@eventName:(*Create*)"},"id":1,"name":"Create"},{"filter":{"query":"@eventName:(ChangePassword OR PasswordUpdated)"},"id":3,"name":"Password Change"},{"filter":{"query":"@eventName:(*Attach*)"},"id":7,"name":"Attach Policy"},{"filter":{"query":"@eventName:(*Detach* OR *Remove*)"},"id":8,"name":"Detach Policy"},{"filter":{"query":"@eventName:(*Delete*)"},"id":6,"name":"Delete"},{"filter":{"query":"@eventName:*"},"id":99,"name":"Other"}],"fallback":{"sources":{"ocsf.activity_name":["eventName"]},"values":{"ocsf.activity_id":"99","ocsf.activity_name":"Other"}},"name":"activity_id and activity_name","targets":{"id":"ocsf.activity_id","name":"ocsf.activity_name"},"type":"schema-category-mapper"},{"categories":[{"filter":{"query":"-@errorCode:*"},"id":1,"name":"Success"},{"filter":{"query":"@errorCode:*"},"id":2,"name":"Failure"}],"name":"status","targets":{"id":"ocsf.status_id","name":"ocsf.status"},"type":"schema-category-mapper"},{"categories":[{"filter":{"query":"@eventName:*"},"id":1,"name":"Informational"}],"name":"Set default severity","targets":{"id":"ocsf.severity_id","name":"ocsf.severity"},"type":"schema-category-mapper"},{"name":"Map userIdentity to ocsf.user.uid","preserve_source":false,"sources":["userIdentity.principalId","responseElements.role.roleId","responseElements.user.userId"],"target":"ocsf.user.uid","type":"schema-remapper"},{"name":"Map userName to ocsf.user.name","preserve_source":false,"sources":["requestParameters.userName","responseElements.role.roleName","requestParameters.roleName","responseElements.user.userName"],"target":"ocsf.user.name","type":"schema-remapper"},{"name":"Map api to ocsf.api","preserve_source":false,"sources":["api"],"target":"ocsf.api","type":"schema-remapper"},{"name":"Map user to ocsf.user","preserve_source":false,"sources":["user"],"target":"ocsf.user","type":"schema-remapper"},{"name":"Map actor to ocsf.actor","preserve_source":false,"sources":["actor"],"target":"ocsf.actor","type":"schema-remapper"},{"name":"Map cloud to ocsf.cloud","preserve_source":false,"sources":["cloud"],"target":"ocsf.cloud","type":"schema-remapper"},{"name":"Map http_request to ocsf.http_request","preserve_source":false,"sources":["http_request"],"target":"ocsf.http_request","type":"schema-remapper"},{"name":"Map metadata to ocsf.metadata","preserve_source":false,"sources":["metadata"],"target":"ocsf.metadata","type":"schema-remapper"},{"name":"Map time to ocsf.time","preserve_source":false,"sources":["time"],"target":"ocsf.time","type":"schema-remapper"},{"name":"Map src_endpoint to ocsf.src_endpoint","preserve_source":false,"sources":["src_endpoint"],"target":"ocsf.src_endpoint","type":"schema-remapper"},{"name":"Map severity to ocsf.severity","preserve_source":false,"sources":["severity"],"target":"ocsf.severity","type":"schema-remapper"},{"name":"Map severity_id to ocsf.severity_id","preserve_source":false,"sources":["severity_id"],"target":"ocsf.severity_id","type":"schema-remapper"}],"name":"Apply OCSF schema for 3001","schema":{"class_name":"Account Change","class_uid":3001,"profiles":["cloud","datetime"],"schema_type":"ocsf","version":"1.5.0"},"type":"schema-processor"}],"tags":[]} + form: {} + headers: + Accept: + - application/json + Content-Type: + - application/json + id: 0 + method: POST + url: https://api.datadoghq.com/api/v1/logs/config/pipelines + response: + body: '{"id":"-qkKiJPYTne-113i8XJ_Nw","type":"pipeline","name":"testSchemaProcessor","is_enabled":false,"is_read_only":false,"filter":{"query":"source:python"},"processors":[{"name":"Apply + OCSF schema for 3001","is_enabled":true,"mappers":[{"name":"activity_id and + activity_name","categories":[{"filter":{"query":"@eventName:(*Create*)"},"name":"Create","id":1},{"filter":{"query":"@eventName:(ChangePassword + OR PasswordUpdated)"},"name":"Password Change","id":3},{"filter":{"query":"@eventName:(*Attach*)"},"name":"Attach + Policy","id":7},{"filter":{"query":"@eventName:(*Detach* OR *Remove*)"},"name":"Detach + Policy","id":8},{"filter":{"query":"@eventName:(*Delete*)"},"name":"Delete","id":6},{"filter":{"query":"@eventName:*"},"name":"Other","id":99}],"targets":{"name":"ocsf.activity_name","id":"ocsf.activity_id"},"fallback":{"values":{"ocsf.activity_id":"99","ocsf.activity_name":"Other"},"sources":{"ocsf.activity_name":["eventName"]}},"type":"schema-category-mapper"},{"name":"status","categories":[{"filter":{"query":"-@errorCode:*"},"name":"Success","id":1},{"filter":{"query":"@errorCode:*"},"name":"Failure","id":2}],"targets":{"name":"ocsf.status","id":"ocsf.status_id"},"fallback":{"values":{},"sources":{}},"type":"schema-category-mapper"},{"name":"Set + default severity","categories":[{"filter":{"query":"@eventName:*"},"name":"Informational","id":1}],"targets":{"name":"ocsf.severity","id":"ocsf.severity_id"},"fallback":{"values":{},"sources":{}},"type":"schema-category-mapper"},{"name":"Map + userIdentity to ocsf.user.uid","sources":["userIdentity.principalId","responseElements.role.roleId","responseElements.user.userId"],"target":"ocsf.user.uid","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + userName to ocsf.user.name","sources":["requestParameters.userName","responseElements.role.roleName","requestParameters.roleName","responseElements.user.userName"],"target":"ocsf.user.name","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + api to ocsf.api","sources":["api"],"target":"ocsf.api","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + user to ocsf.user","sources":["user"],"target":"ocsf.user","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + actor to ocsf.actor","sources":["actor"],"target":"ocsf.actor","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + cloud to ocsf.cloud","sources":["cloud"],"target":"ocsf.cloud","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + http_request to ocsf.http_request","sources":["http_request"],"target":"ocsf.http_request","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + metadata to ocsf.metadata","sources":["metadata"],"target":"ocsf.metadata","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + time to ocsf.time","sources":["time"],"target":"ocsf.time","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + src_endpoint to ocsf.src_endpoint","sources":["src_endpoint"],"target":"ocsf.src_endpoint","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + severity to ocsf.severity","sources":["severity"],"target":"ocsf.severity","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + severity_id to ocsf.severity_id","sources":["severity_id"],"target":"ocsf.severity_id","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"}],"schema":{"schema_type":"ocsf","version":"1.5.0","class_name":"Account + Change","class_uid":3001,"extensions":[],"profiles":["cloud","datetime"]},"type":"schema-processor"}],"tags":[]} + + ' + code: 200 + duration: 0ms + headers: + Content-Type: + - application/json + status: 200 OK +- request: + body: '' + form: {} + headers: + Accept: + - '*/*' + id: 1 + method: DELETE + url: https://api.datadoghq.com/api/v1/logs/config/pipelines/-qkKiJPYTne-113i8XJ_Nw + response: + body: '{} + + ' + code: 200 + duration: 0ms + headers: + Content-Type: + - application/json + status: 200 OK +version: 2 diff --git a/tests/scenarios/cassettes/TestScenarios/v1/Feature_Logs_Pipelines/Scenario_Create_a_pipeline_with_Schema_Processor_and_preserve_source_true_returns_OK_response.freeze b/tests/scenarios/cassettes/TestScenarios/v1/Feature_Logs_Pipelines/Scenario_Create_a_pipeline_with_Schema_Processor_and_preserve_source_true_returns_OK_response.freeze new file mode 100644 index 00000000000..bd4fc475d30 --- /dev/null +++ b/tests/scenarios/cassettes/TestScenarios/v1/Feature_Logs_Pipelines/Scenario_Create_a_pipeline_with_Schema_Processor_and_preserve_source_true_returns_OK_response.freeze @@ -0,0 +1 @@ +2025-10-22T19:11:59.195Z \ No newline at end of file diff --git a/tests/scenarios/cassettes/TestScenarios/v1/Feature_Logs_Pipelines/Scenario_Create_a_pipeline_with_Schema_Processor_and_preserve_source_true_returns_OK_response.yaml b/tests/scenarios/cassettes/TestScenarios/v1/Feature_Logs_Pipelines/Scenario_Create_a_pipeline_with_Schema_Processor_and_preserve_source_true_returns_OK_response.yaml new file mode 100644 index 00000000000..5500fa5b719 --- /dev/null +++ b/tests/scenarios/cassettes/TestScenarios/v1/Feature_Logs_Pipelines/Scenario_Create_a_pipeline_with_Schema_Processor_and_preserve_source_true_returns_OK_response.yaml @@ -0,0 +1,62 @@ +interactions: +- request: + body: | + {"filter":{"query":"source:python"},"name":"testSchemaProcessor","processors":[{"is_enabled":true,"mappers":[{"categories":[{"filter":{"query":"@eventName:(*Create*)"},"id":1,"name":"Create"},{"filter":{"query":"@eventName:(ChangePassword OR PasswordUpdated)"},"id":3,"name":"Password Change"},{"filter":{"query":"@eventName:(*Attach*)"},"id":7,"name":"Attach Policy"},{"filter":{"query":"@eventName:(*Detach* OR *Remove*)"},"id":8,"name":"Detach Policy"},{"filter":{"query":"@eventName:(*Delete*)"},"id":6,"name":"Delete"},{"filter":{"query":"@eventName:*"},"id":99,"name":"Other"}],"fallback":{"sources":{"ocsf.activity_name":["eventName"]},"values":{"ocsf.activity_id":"99","ocsf.activity_name":"Other"}},"name":"activity_id and activity_name","targets":{"id":"ocsf.activity_id","name":"ocsf.activity_name"},"type":"schema-category-mapper"},{"categories":[{"filter":{"query":"-@errorCode:*"},"id":1,"name":"Success"},{"filter":{"query":"@errorCode:*"},"id":2,"name":"Failure"}],"name":"status","targets":{"id":"ocsf.status_id","name":"ocsf.status"},"type":"schema-category-mapper"},{"categories":[{"filter":{"query":"@eventName:*"},"id":1,"name":"Informational"}],"name":"Set default severity","targets":{"id":"ocsf.severity_id","name":"ocsf.severity"},"type":"schema-category-mapper"},{"name":"Map userIdentity to ocsf.user.uid","preserve_source":true,"sources":["userIdentity.principalId","responseElements.role.roleId","responseElements.user.userId"],"target":"ocsf.user.uid","type":"schema-remapper"},{"name":"Map userName to ocsf.user.name","preserve_source":true,"sources":["requestParameters.userName","responseElements.role.roleName","requestParameters.roleName","responseElements.user.userName"],"target":"ocsf.user.name","type":"schema-remapper"},{"name":"Map api to ocsf.api","preserve_source":true,"sources":["api"],"target":"ocsf.api","type":"schema-remapper"},{"name":"Map user to ocsf.user","preserve_source":true,"sources":["user"],"target":"ocsf.user","type":"schema-remapper"},{"name":"Map actor to ocsf.actor","preserve_source":true,"sources":["actor"],"target":"ocsf.actor","type":"schema-remapper"},{"name":"Map cloud to ocsf.cloud","preserve_source":true,"sources":["cloud"],"target":"ocsf.cloud","type":"schema-remapper"},{"name":"Map http_request to ocsf.http_request","preserve_source":true,"sources":["http_request"],"target":"ocsf.http_request","type":"schema-remapper"},{"name":"Map metadata to ocsf.metadata","preserve_source":true,"sources":["metadata"],"target":"ocsf.metadata","type":"schema-remapper"},{"name":"Map time to ocsf.time","preserve_source":true,"sources":["time"],"target":"ocsf.time","type":"schema-remapper"},{"name":"Map src_endpoint to ocsf.src_endpoint","preserve_source":true,"sources":["src_endpoint"],"target":"ocsf.src_endpoint","type":"schema-remapper"},{"name":"Map severity to ocsf.severity","preserve_source":true,"sources":["severity"],"target":"ocsf.severity","type":"schema-remapper"},{"name":"Map severity_id to ocsf.severity_id","preserve_source":true,"sources":["severity_id"],"target":"ocsf.severity_id","type":"schema-remapper"}],"name":"Apply OCSF schema for 3001","schema":{"class_name":"Account Change","class_uid":3001,"profiles":["cloud","datetime"],"schema_type":"ocsf","version":"1.5.0"},"type":"schema-processor"}],"tags":[]} + form: {} + headers: + Accept: + - application/json + Content-Type: + - application/json + id: 0 + method: POST + url: https://api.datadoghq.com/api/v1/logs/config/pipelines + response: + body: '{"id":"ReEWRVSbQ-ersoCn0Ibo6g","type":"pipeline","name":"testSchemaProcessor","is_enabled":false,"is_read_only":false,"filter":{"query":"source:python"},"processors":[{"name":"Apply + OCSF schema for 3001","is_enabled":true,"mappers":[{"name":"activity_id and + activity_name","categories":[{"filter":{"query":"@eventName:(*Create*)"},"name":"Create","id":1},{"filter":{"query":"@eventName:(ChangePassword + OR PasswordUpdated)"},"name":"Password Change","id":3},{"filter":{"query":"@eventName:(*Attach*)"},"name":"Attach + Policy","id":7},{"filter":{"query":"@eventName:(*Detach* OR *Remove*)"},"name":"Detach + Policy","id":8},{"filter":{"query":"@eventName:(*Delete*)"},"name":"Delete","id":6},{"filter":{"query":"@eventName:*"},"name":"Other","id":99}],"targets":{"name":"ocsf.activity_name","id":"ocsf.activity_id"},"fallback":{"values":{"ocsf.activity_id":"99","ocsf.activity_name":"Other"},"sources":{"ocsf.activity_name":["eventName"]}},"type":"schema-category-mapper"},{"name":"status","categories":[{"filter":{"query":"-@errorCode:*"},"name":"Success","id":1},{"filter":{"query":"@errorCode:*"},"name":"Failure","id":2}],"targets":{"name":"ocsf.status","id":"ocsf.status_id"},"fallback":{"values":{},"sources":{}},"type":"schema-category-mapper"},{"name":"Set + default severity","categories":[{"filter":{"query":"@eventName:*"},"name":"Informational","id":1}],"targets":{"name":"ocsf.severity","id":"ocsf.severity_id"},"fallback":{"values":{},"sources":{}},"type":"schema-category-mapper"},{"name":"Map + userIdentity to ocsf.user.uid","sources":["userIdentity.principalId","responseElements.role.roleId","responseElements.user.userId"],"target":"ocsf.user.uid","preserve_source":true,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + userName to ocsf.user.name","sources":["requestParameters.userName","responseElements.role.roleName","requestParameters.roleName","responseElements.user.userName"],"target":"ocsf.user.name","preserve_source":true,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + api to ocsf.api","sources":["api"],"target":"ocsf.api","preserve_source":true,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + user to ocsf.user","sources":["user"],"target":"ocsf.user","preserve_source":true,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + actor to ocsf.actor","sources":["actor"],"target":"ocsf.actor","preserve_source":true,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + cloud to ocsf.cloud","sources":["cloud"],"target":"ocsf.cloud","preserve_source":true,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + http_request to ocsf.http_request","sources":["http_request"],"target":"ocsf.http_request","preserve_source":true,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + metadata to ocsf.metadata","sources":["metadata"],"target":"ocsf.metadata","preserve_source":true,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + time to ocsf.time","sources":["time"],"target":"ocsf.time","preserve_source":true,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + src_endpoint to ocsf.src_endpoint","sources":["src_endpoint"],"target":"ocsf.src_endpoint","preserve_source":true,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + severity to ocsf.severity","sources":["severity"],"target":"ocsf.severity","preserve_source":true,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + severity_id to ocsf.severity_id","sources":["severity_id"],"target":"ocsf.severity_id","preserve_source":true,"override_on_conflict":false,"type":"schema-remapper"}],"schema":{"schema_type":"ocsf","version":"1.5.0","class_name":"Account + Change","class_uid":3001,"extensions":[],"profiles":["cloud","datetime"]},"type":"schema-processor"}],"tags":[]} + + ' + code: 200 + duration: 0ms + headers: + Content-Type: + - application/json + status: 200 OK +- request: + body: '' + form: {} + headers: + Accept: + - '*/*' + id: 1 + method: DELETE + url: https://api.datadoghq.com/api/v1/logs/config/pipelines/ReEWRVSbQ-ersoCn0Ibo6g + response: + body: '{} + + ' + code: 200 + duration: 0ms + headers: + Content-Type: + - application/json + status: 200 OK +version: 2 diff --git a/tests/scenarios/cassettes/TestScenarios/v1/Feature_Logs_Pipelines/Scenario_Create_a_pipeline_with_schema_processor.freeze b/tests/scenarios/cassettes/TestScenarios/v1/Feature_Logs_Pipelines/Scenario_Create_a_pipeline_with_schema_processor.freeze new file mode 100644 index 00000000000..ac0d5b77e90 --- /dev/null +++ b/tests/scenarios/cassettes/TestScenarios/v1/Feature_Logs_Pipelines/Scenario_Create_a_pipeline_with_schema_processor.freeze @@ -0,0 +1 @@ +2025-10-22T19:12:00.030Z \ No newline at end of file diff --git a/tests/scenarios/cassettes/TestScenarios/v1/Feature_Logs_Pipelines/Scenario_Create_a_pipeline_with_schema_processor.yaml b/tests/scenarios/cassettes/TestScenarios/v1/Feature_Logs_Pipelines/Scenario_Create_a_pipeline_with_schema_processor.yaml new file mode 100644 index 00000000000..284f566d143 --- /dev/null +++ b/tests/scenarios/cassettes/TestScenarios/v1/Feature_Logs_Pipelines/Scenario_Create_a_pipeline_with_schema_processor.yaml @@ -0,0 +1,62 @@ +interactions: +- request: + body: | + {"filter":{"query":"source:python"},"name":"testSchemaProcessor","processors":[{"is_enabled":true,"mappers":[{"categories":[{"filter":{"query":"@eventName:(*Create*)"},"id":1,"name":"Create"},{"filter":{"query":"@eventName:(ChangePassword OR PasswordUpdated)"},"id":3,"name":"Password Change"},{"filter":{"query":"@eventName:(*Attach*)"},"id":7,"name":"Attach Policy"},{"filter":{"query":"@eventName:(*Detach* OR *Remove*)"},"id":8,"name":"Detach Policy"},{"filter":{"query":"@eventName:(*Delete*)"},"id":6,"name":"Delete"},{"filter":{"query":"@eventName:*"},"id":99,"name":"Other"}],"fallback":{"sources":{"ocsf.activity_name":["eventName"]},"values":{"ocsf.activity_id":"99","ocsf.activity_name":"Other"}},"name":"activity_id and activity_name","targets":{"id":"ocsf.activity_id","name":"ocsf.activity_name"},"type":"schema-category-mapper"},{"categories":[{"filter":{"query":"-@errorCode:*"},"id":1,"name":"Success"},{"filter":{"query":"@errorCode:*"},"id":2,"name":"Failure"}],"name":"status","targets":{"id":"ocsf.status_id","name":"ocsf.status"},"type":"schema-category-mapper"},{"categories":[{"filter":{"query":"@eventName:*"},"id":1,"name":"Informational"}],"name":"Set default severity","targets":{"id":"ocsf.severity_id","name":"ocsf.severity"},"type":"schema-category-mapper"},{"name":"Map userIdentity to ocsf.user.uid","sources":["userIdentity.principalId","responseElements.role.roleId","responseElements.user.userId"],"target":"ocsf.user.uid","type":"schema-remapper"},{"name":"Map userName to ocsf.user.name","sources":["requestParameters.userName","responseElements.role.roleName","requestParameters.roleName","responseElements.user.userName"],"target":"ocsf.user.name","type":"schema-remapper"},{"name":"Map api to ocsf.api","sources":["api"],"target":"ocsf.api","type":"schema-remapper"},{"name":"Map user to ocsf.user","sources":["user"],"target":"ocsf.user","type":"schema-remapper"},{"name":"Map actor to ocsf.actor","sources":["actor"],"target":"ocsf.actor","type":"schema-remapper"},{"name":"Map cloud to ocsf.cloud","sources":["cloud"],"target":"ocsf.cloud","type":"schema-remapper"},{"name":"Map http_request to ocsf.http_request","sources":["http_request"],"target":"ocsf.http_request","type":"schema-remapper"},{"name":"Map metadata to ocsf.metadata","sources":["metadata"],"target":"ocsf.metadata","type":"schema-remapper"},{"name":"Map time to ocsf.time","sources":["time"],"target":"ocsf.time","type":"schema-remapper"},{"name":"Map src_endpoint to ocsf.src_endpoint","sources":["src_endpoint"],"target":"ocsf.src_endpoint","type":"schema-remapper"},{"name":"Map severity to ocsf.severity","sources":["severity"],"target":"ocsf.severity","type":"schema-remapper"},{"name":"Map severity_id to ocsf.severity_id","sources":["severity_id"],"target":"ocsf.severity_id","type":"schema-remapper"}],"name":"Apply OCSF schema for 3001","schema":{"class_name":"Account Change","class_uid":3001,"profiles":["cloud","datetime"],"schema_type":"ocsf","version":"1.5.0"},"type":"schema-processor"}],"tags":[]} + form: {} + headers: + Accept: + - application/json + Content-Type: + - application/json + id: 0 + method: POST + url: https://api.datadoghq.com/api/v1/logs/config/pipelines + response: + body: '{"id":"1unf0vMNQKSSwzsg6BuWMw","type":"pipeline","name":"testSchemaProcessor","is_enabled":false,"is_read_only":false,"filter":{"query":"source:python"},"processors":[{"name":"Apply + OCSF schema for 3001","is_enabled":true,"mappers":[{"name":"activity_id and + activity_name","categories":[{"filter":{"query":"@eventName:(*Create*)"},"name":"Create","id":1},{"filter":{"query":"@eventName:(ChangePassword + OR PasswordUpdated)"},"name":"Password Change","id":3},{"filter":{"query":"@eventName:(*Attach*)"},"name":"Attach + Policy","id":7},{"filter":{"query":"@eventName:(*Detach* OR *Remove*)"},"name":"Detach + Policy","id":8},{"filter":{"query":"@eventName:(*Delete*)"},"name":"Delete","id":6},{"filter":{"query":"@eventName:*"},"name":"Other","id":99}],"targets":{"name":"ocsf.activity_name","id":"ocsf.activity_id"},"fallback":{"values":{"ocsf.activity_id":"99","ocsf.activity_name":"Other"},"sources":{"ocsf.activity_name":["eventName"]}},"type":"schema-category-mapper"},{"name":"status","categories":[{"filter":{"query":"-@errorCode:*"},"name":"Success","id":1},{"filter":{"query":"@errorCode:*"},"name":"Failure","id":2}],"targets":{"name":"ocsf.status","id":"ocsf.status_id"},"fallback":{"values":{},"sources":{}},"type":"schema-category-mapper"},{"name":"Set + default severity","categories":[{"filter":{"query":"@eventName:*"},"name":"Informational","id":1}],"targets":{"name":"ocsf.severity","id":"ocsf.severity_id"},"fallback":{"values":{},"sources":{}},"type":"schema-category-mapper"},{"name":"Map + userIdentity to ocsf.user.uid","sources":["userIdentity.principalId","responseElements.role.roleId","responseElements.user.userId"],"target":"ocsf.user.uid","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + userName to ocsf.user.name","sources":["requestParameters.userName","responseElements.role.roleName","requestParameters.roleName","responseElements.user.userName"],"target":"ocsf.user.name","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + api to ocsf.api","sources":["api"],"target":"ocsf.api","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + user to ocsf.user","sources":["user"],"target":"ocsf.user","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + actor to ocsf.actor","sources":["actor"],"target":"ocsf.actor","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + cloud to ocsf.cloud","sources":["cloud"],"target":"ocsf.cloud","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + http_request to ocsf.http_request","sources":["http_request"],"target":"ocsf.http_request","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + metadata to ocsf.metadata","sources":["metadata"],"target":"ocsf.metadata","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + time to ocsf.time","sources":["time"],"target":"ocsf.time","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + src_endpoint to ocsf.src_endpoint","sources":["src_endpoint"],"target":"ocsf.src_endpoint","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + severity to ocsf.severity","sources":["severity"],"target":"ocsf.severity","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"},{"name":"Map + severity_id to ocsf.severity_id","sources":["severity_id"],"target":"ocsf.severity_id","preserve_source":false,"override_on_conflict":false,"type":"schema-remapper"}],"schema":{"schema_type":"ocsf","version":"1.5.0","class_name":"Account + Change","class_uid":3001,"extensions":[],"profiles":["cloud","datetime"]},"type":"schema-processor"}],"tags":[]} + + ' + code: 200 + duration: 0ms + headers: + Content-Type: + - application/json + status: 200 OK +- request: + body: '' + form: {} + headers: + Accept: + - '*/*' + id: 1 + method: DELETE + url: https://api.datadoghq.com/api/v1/logs/config/pipelines/1unf0vMNQKSSwzsg6BuWMw + response: + body: '{} + + ' + code: 200 + duration: 0ms + headers: + Content-Type: + - application/json + status: 200 OK +version: 2 diff --git a/tests/scenarios/features/v1/logs_pipelines.feature b/tests/scenarios/features/v1/logs_pipelines.feature index cdb150dd6ed..5f7dde5db67 100644 --- a/tests/scenarios/features/v1/logs_pipelines.feature +++ b/tests/scenarios/features/v1/logs_pipelines.feature @@ -77,6 +77,20 @@ Feature: Logs Pipelines When the request is sent Then the response status is 200 OK + @team:DataDog/event-platform-experience + Scenario: Create a pipeline with Schema Processor and preserve_source false returns "OK" response + Given new "CreateLogsPipeline" request + And body with value {"filter": {"query": "source:python"}, "name": "testSchemaProcessor", "processors": [{"type": "schema-processor", "is_enabled": true, "name": "Apply OCSF schema for 3001", "schema": {"schema_type": "ocsf", "version": "1.5.0", "class_uid": 3001, "class_name": "Account Change", "profiles": ["cloud", "datetime"]}, "mappers": [{"type": "schema-category-mapper", "name": "activity_id and activity_name", "categories": [{"filter": {"query": "@eventName:(*Create*)"}, "name": "Create", "id": 1}, {"filter": {"query": "@eventName:(ChangePassword OR PasswordUpdated)"}, "name": "Password Change", "id": 3}, {"filter": {"query": "@eventName:(*Attach*)"}, "name": "Attach Policy", "id": 7}, {"filter": {"query": "@eventName:(*Detach* OR *Remove*)"}, "name": "Detach Policy", "id": 8}, {"filter": {"query": "@eventName:(*Delete*)"}, "name": "Delete", "id": 6}, {"filter": {"query": "@eventName:*"}, "name": "Other", "id": 99}], "targets": {"name": "ocsf.activity_name", "id": "ocsf.activity_id"}, "fallback": {"values": {"ocsf.activity_id": "99", "ocsf.activity_name": "Other"}, "sources": {"ocsf.activity_name": ["eventName"]}}}, {"type": "schema-category-mapper", "name": "status", "categories": [{"filter": {"query": "-@errorCode:*"}, "id": 1, "name": "Success"}, {"filter": {"query": "@errorCode:*"}, "id": 2, "name": "Failure"}], "targets": {"id": "ocsf.status_id", "name": "ocsf.status"}}, {"type": "schema-category-mapper", "name": "Set default severity", "categories": [{"filter": {"query": "@eventName:*"}, "name": "Informational", "id": 1}], "targets": {"name": "ocsf.severity", "id": "ocsf.severity_id"}}, {"type": "schema-remapper", "name": "Map userIdentity to ocsf.user.uid", "sources": ["userIdentity.principalId", "responseElements.role.roleId", "responseElements.user.userId"], "target": "ocsf.user.uid", "preserve_source": false}, {"type": "schema-remapper", "name": "Map userName to ocsf.user.name", "sources": ["requestParameters.userName", "responseElements.role.roleName", "requestParameters.roleName", "responseElements.user.userName"], "target": "ocsf.user.name", "preserve_source": false}, {"type": "schema-remapper", "name": "Map api to ocsf.api", "sources": ["api"], "target": "ocsf.api", "preserve_source": false}, {"type": "schema-remapper", "name": "Map user to ocsf.user", "sources": ["user"], "target": "ocsf.user", "preserve_source": false}, {"type": "schema-remapper", "name": "Map actor to ocsf.actor", "sources": ["actor"], "target": "ocsf.actor", "preserve_source": false}, {"type": "schema-remapper", "name": "Map cloud to ocsf.cloud", "sources": ["cloud"], "target": "ocsf.cloud", "preserve_source": false}, {"type": "schema-remapper", "name": "Map http_request to ocsf.http_request", "sources": ["http_request"], "target": "ocsf.http_request", "preserve_source": false}, {"type": "schema-remapper", "name": "Map metadata to ocsf.metadata", "sources": ["metadata"], "target": "ocsf.metadata", "preserve_source": false}, {"type": "schema-remapper", "name": "Map time to ocsf.time", "sources": ["time"], "target": "ocsf.time", "preserve_source": false}, {"type": "schema-remapper", "name": "Map src_endpoint to ocsf.src_endpoint", "sources": ["src_endpoint"], "target": "ocsf.src_endpoint", "preserve_source": false}, {"type": "schema-remapper", "name": "Map severity to ocsf.severity", "sources": ["severity"], "target": "ocsf.severity", "preserve_source": false}, {"type": "schema-remapper", "name": "Map severity_id to ocsf.severity_id", "sources": ["severity_id"], "target": "ocsf.severity_id", "preserve_source": false}]}], "tags": []} + When the request is sent + Then the response status is 200 OK + + @team:DataDog/event-platform-experience + Scenario: Create a pipeline with Schema Processor and preserve_source true returns "OK" response + Given new "CreateLogsPipeline" request + And body with value {"filter": {"query": "source:python"}, "name": "testSchemaProcessor", "processors": [{"type": "schema-processor", "is_enabled": true, "name": "Apply OCSF schema for 3001", "schema": {"schema_type": "ocsf", "version": "1.5.0", "class_uid": 3001, "class_name": "Account Change", "profiles": ["cloud", "datetime"]}, "mappers": [{"type": "schema-category-mapper", "name": "activity_id and activity_name", "categories": [{"filter": {"query": "@eventName:(*Create*)"}, "name": "Create", "id": 1}, {"filter": {"query": "@eventName:(ChangePassword OR PasswordUpdated)"}, "name": "Password Change", "id": 3}, {"filter": {"query": "@eventName:(*Attach*)"}, "name": "Attach Policy", "id": 7}, {"filter": {"query": "@eventName:(*Detach* OR *Remove*)"}, "name": "Detach Policy", "id": 8}, {"filter": {"query": "@eventName:(*Delete*)"}, "name": "Delete", "id": 6}, {"filter": {"query": "@eventName:*"}, "name": "Other", "id": 99}], "targets": {"name": "ocsf.activity_name", "id": "ocsf.activity_id"}, "fallback": {"values": {"ocsf.activity_id": "99", "ocsf.activity_name": "Other"}, "sources": {"ocsf.activity_name": ["eventName"]}}}, {"type": "schema-category-mapper", "name": "status", "categories": [{"filter": {"query": "-@errorCode:*"}, "id": 1, "name": "Success"}, {"filter": {"query": "@errorCode:*"}, "id": 2, "name": "Failure"}], "targets": {"id": "ocsf.status_id", "name": "ocsf.status"}}, {"type": "schema-category-mapper", "name": "Set default severity", "categories": [{"filter": {"query": "@eventName:*"}, "name": "Informational", "id": 1}], "targets": {"name": "ocsf.severity", "id": "ocsf.severity_id"}}, {"type": "schema-remapper", "name": "Map userIdentity to ocsf.user.uid", "sources": ["userIdentity.principalId", "responseElements.role.roleId", "responseElements.user.userId"], "target": "ocsf.user.uid", "preserve_source": true}, {"type": "schema-remapper", "name": "Map userName to ocsf.user.name", "sources": ["requestParameters.userName", "responseElements.role.roleName", "requestParameters.roleName", "responseElements.user.userName"], "target": "ocsf.user.name", "preserve_source": true}, {"type": "schema-remapper", "name": "Map api to ocsf.api", "sources": ["api"], "target": "ocsf.api", "preserve_source": true}, {"type": "schema-remapper", "name": "Map user to ocsf.user", "sources": ["user"], "target": "ocsf.user", "preserve_source": true}, {"type": "schema-remapper", "name": "Map actor to ocsf.actor", "sources": ["actor"], "target": "ocsf.actor", "preserve_source": true}, {"type": "schema-remapper", "name": "Map cloud to ocsf.cloud", "sources": ["cloud"], "target": "ocsf.cloud", "preserve_source": true}, {"type": "schema-remapper", "name": "Map http_request to ocsf.http_request", "sources": ["http_request"], "target": "ocsf.http_request", "preserve_source": true}, {"type": "schema-remapper", "name": "Map metadata to ocsf.metadata", "sources": ["metadata"], "target": "ocsf.metadata", "preserve_source": true}, {"type": "schema-remapper", "name": "Map time to ocsf.time", "sources": ["time"], "target": "ocsf.time", "preserve_source": true}, {"type": "schema-remapper", "name": "Map src_endpoint to ocsf.src_endpoint", "sources": ["src_endpoint"], "target": "ocsf.src_endpoint", "preserve_source": true}, {"type": "schema-remapper", "name": "Map severity to ocsf.severity", "sources": ["severity"], "target": "ocsf.severity", "preserve_source": true}, {"type": "schema-remapper", "name": "Map severity_id to ocsf.severity_id", "sources": ["severity_id"], "target": "ocsf.severity_id", "preserve_source": true}]}], "tags": []} + When the request is sent + Then the response status is 200 OK + @team:DataDog/event-platform-experience Scenario: Create a pipeline with Span Id Remapper returns "OK" response Given new "CreateLogsPipeline" request @@ -84,6 +98,13 @@ Feature: Logs Pipelines When the request is sent Then the response status is 200 OK + @team:DataDog/event-platform-experience + Scenario: Create a pipeline with schema processor + Given new "CreateLogsPipeline" request + And body with value {"filter": {"query": "source:python"}, "name": "testSchemaProcessor", "processors": [{"type": "schema-processor", "is_enabled": true, "name": "Apply OCSF schema for 3001", "schema": {"schema_type": "ocsf", "version": "1.5.0", "class_uid": 3001, "class_name": "Account Change", "profiles": ["cloud", "datetime"]}, "mappers": [{"type": "schema-category-mapper", "name": "activity_id and activity_name", "categories": [{"filter": {"query": "@eventName:(*Create*)"}, "name": "Create", "id": 1}, {"filter": {"query": "@eventName:(ChangePassword OR PasswordUpdated)"}, "name": "Password Change", "id": 3}, {"filter": {"query": "@eventName:(*Attach*)"}, "name": "Attach Policy", "id": 7}, {"filter": {"query": "@eventName:(*Detach* OR *Remove*)"}, "name": "Detach Policy", "id": 8}, {"filter": {"query": "@eventName:(*Delete*)"}, "name": "Delete", "id": 6}, {"filter": {"query": "@eventName:*"}, "name": "Other", "id": 99}], "targets": {"name": "ocsf.activity_name", "id": "ocsf.activity_id"}, "fallback": {"values": {"ocsf.activity_id": "99", "ocsf.activity_name": "Other"}, "sources": {"ocsf.activity_name": ["eventName"]}}}, {"type": "schema-category-mapper", "name": "status", "categories": [{"filter": {"query": "-@errorCode:*"}, "id": 1, "name": "Success"}, {"filter": {"query": "@errorCode:*"}, "id": 2, "name": "Failure"}], "targets": {"id": "ocsf.status_id", "name": "ocsf.status"}}, {"type": "schema-category-mapper", "name": "Set default severity", "categories": [{"filter": {"query": "@eventName:*"}, "name": "Informational", "id": 1}], "targets": {"name": "ocsf.severity", "id": "ocsf.severity_id"}}, {"type": "schema-remapper", "name": "Map userIdentity to ocsf.user.uid", "sources": ["userIdentity.principalId", "responseElements.role.roleId", "responseElements.user.userId"], "target": "ocsf.user.uid"}, {"type": "schema-remapper", "name": "Map userName to ocsf.user.name", "sources": ["requestParameters.userName", "responseElements.role.roleName", "requestParameters.roleName", "responseElements.user.userName"], "target": "ocsf.user.name"}, {"type": "schema-remapper", "name": "Map api to ocsf.api", "sources": ["api"], "target": "ocsf.api"}, {"type": "schema-remapper", "name": "Map user to ocsf.user", "sources": ["user"], "target": "ocsf.user"}, {"type": "schema-remapper", "name": "Map actor to ocsf.actor", "sources": ["actor"], "target": "ocsf.actor"}, {"type": "schema-remapper", "name": "Map cloud to ocsf.cloud", "sources": ["cloud"], "target": "ocsf.cloud"}, {"type": "schema-remapper", "name": "Map http_request to ocsf.http_request", "sources": ["http_request"], "target": "ocsf.http_request"}, {"type": "schema-remapper", "name": "Map metadata to ocsf.metadata", "sources": ["metadata"], "target": "ocsf.metadata"}, {"type": "schema-remapper", "name": "Map time to ocsf.time", "sources": ["time"], "target": "ocsf.time"}, {"type": "schema-remapper", "name": "Map src_endpoint to ocsf.src_endpoint", "sources": ["src_endpoint"], "target": "ocsf.src_endpoint"}, {"type": "schema-remapper", "name": "Map severity to ocsf.severity", "sources": ["severity"], "target": "ocsf.severity"}, {"type": "schema-remapper", "name": "Map severity_id to ocsf.severity_id", "sources": ["severity_id"], "target": "ocsf.severity_id"}]}], "tags": []} + When the request is sent + Then the response status is 200 OK + @generated @skip @team:DataDog/event-platform-experience Scenario: Delete a pipeline returns "Bad Request" response Given new "DeleteLogsPipeline" request