@@ -25145,6 +25145,7 @@ components:
2514525145 - $ref: '#/components/schemas/ObservabilityPipelineSentinelOneDestination'
2514625146 - $ref: '#/components/schemas/ObservabilityPipelineOpenSearchDestination'
2514725147 - $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestination'
25148+ - $ref: '#/components/schemas/ObservabilityPipelineSocketDestination'
2514825149 ObservabilityPipelineConfigProcessorItem:
2514925150 description: A processor for the pipeline.
2515025151 oneOf:
@@ -25164,6 +25165,7 @@ components:
2516425165 - $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableProcessor'
2516525166 - $ref: '#/components/schemas/ObservabilityPipelineReduceProcessor'
2516625167 - $ref: '#/components/schemas/ObservabilityPipelineThrottleProcessor'
25168+ - $ref: '#/components/schemas/ObservabilityPipelineRemapVrlProcessor'
2516725169 ObservabilityPipelineConfigSourceItem:
2516825170 description: A data source for the pipeline.
2516925171 oneOf:
@@ -25182,6 +25184,7 @@ components:
2518225184 - $ref: '#/components/schemas/ObservabilityPipelineGooglePubSubSource'
2518325185 - $ref: '#/components/schemas/ObservabilityPipelineHttpClientSource'
2518425186 - $ref: '#/components/schemas/ObservabilityPipelineLogstashSource'
25187+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSource'
2518525188 ObservabilityPipelineData:
2518625189 description: "Contains the pipeline\u2019s ID, type, and configuration attributes."
2518725190 properties:
@@ -26827,6 +26830,87 @@ components:
2682726830 type: string
2682826831 x-enum-varnames:
2682926832 - REDUCE
26833+ ObservabilityPipelineRemapVrlProcessor:
26834+ description: The `remap_vrl` processor (also called "Custom processor") transforms
26835+ events using [Vector Remap Language (VRL)](https://vector.dev/docs/reference/vrl/)
26836+ scripts with advanced filtering capabilities.
26837+ properties:
26838+ id:
26839+ description: The unique identifier for this processor.
26840+ example: remap-vrl-processor
26841+ type: string
26842+ include:
26843+ description: A Datadog search query used to determine which logs this processor
26844+ targets. This field should always be set to `*` for the remap_vrl processor.
26845+ example: '*'
26846+ type: string
26847+ inputs:
26848+ description: A list of component IDs whose output is used as the input for
26849+ this processor.
26850+ example:
26851+ - datadog-agent-source
26852+ items:
26853+ type: string
26854+ type: array
26855+ remaps:
26856+ description: Array of VRL remap rules.
26857+ items:
26858+ $ref: '#/components/schemas/ObservabilityPipelineRemapVrlProcessorRemap'
26859+ maxItems: 15
26860+ minItems: 1
26861+ type: array
26862+ type:
26863+ $ref: '#/components/schemas/ObservabilityPipelineRemapVrlProcessorType'
26864+ required:
26865+ - id
26866+ - type
26867+ - include
26868+ - remaps
26869+ - inputs
26870+ type: object
26871+ ObservabilityPipelineRemapVrlProcessorRemap:
26872+ description: Defines a single VRL remap rule with its own filtering and transformation
26873+ logic.
26874+ properties:
26875+ drop_on_error:
26876+ default: false
26877+ description: Whether to drop events that caused errors during processing.
26878+ example: false
26879+ type: boolean
26880+ enabled:
26881+ default: true
26882+ description: Whether this remap rule is enabled.
26883+ example: true
26884+ type: boolean
26885+ include:
26886+ description: A Datadog search query used to filter events for this specific
26887+ remap rule.
26888+ example: service:web
26889+ type: string
26890+ name:
26891+ description: A descriptive name for this remap rule.
26892+ example: Parse JSON from message field
26893+ type: string
26894+ source:
26895+ description: The VRL script source code that defines the processing logic.
26896+ Must not exceed 3000 characters.
26897+ example: . = parse_json!(.message)
26898+ maxLength: 3000
26899+ type: string
26900+ required:
26901+ - include
26902+ - name
26903+ - source
26904+ type: object
26905+ ObservabilityPipelineRemapVrlProcessorType:
26906+ default: remap_vrl
26907+ description: The processor type. The value should always be `remap_vrl`.
26908+ enum:
26909+ - remap_vrl
26910+ example: remap_vrl
26911+ type: string
26912+ x-enum-varnames:
26913+ - REMAP_VRL
2683026914 ObservabilityPipelineRemoveFieldsProcessor:
2683126915 description: The `remove_fields` processor deletes specified fields from logs.
2683226916 properties:
@@ -27465,6 +27549,278 @@ components:
2746527549 type: string
2746627550 x-enum-varnames:
2746727551 - SENTINEL_ONE
27552+ ObservabilityPipelineSocketDestination:
27553+ description: 'The `socket` destination sends logs over TCP or UDP to a remote
27554+ server.
27555+
27556+ '
27557+ properties:
27558+ encoding:
27559+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationEncoding'
27560+ framing:
27561+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFraming'
27562+ id:
27563+ description: The unique identifier for this component.
27564+ example: socket-destination
27565+ type: string
27566+ inputs:
27567+ description: A list of component IDs whose output is used as the `input`
27568+ for this component.
27569+ example:
27570+ - filter-processor
27571+ items:
27572+ type: string
27573+ type: array
27574+ mode:
27575+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationMode'
27576+ tls:
27577+ $ref: '#/components/schemas/ObservabilityPipelineTls'
27578+ description: TLS configuration. Relevant only when `mode` is `tcp`.
27579+ type:
27580+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationType'
27581+ required:
27582+ - id
27583+ - type
27584+ - inputs
27585+ - encoding
27586+ - framing
27587+ - mode
27588+ type: object
27589+ ObservabilityPipelineSocketDestinationEncoding:
27590+ description: Encoding format for log events.
27591+ enum:
27592+ - json
27593+ - raw_message
27594+ example: json
27595+ type: string
27596+ x-enum-varnames:
27597+ - JSON
27598+ - RAW_MESSAGE
27599+ ObservabilityPipelineSocketDestinationFraming:
27600+ description: Framing method configuration.
27601+ oneOf:
27602+ - $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingNewlineDelimited'
27603+ - $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingBytes'
27604+ - $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingCharacterDelimited'
27605+ ObservabilityPipelineSocketDestinationFramingBytes:
27606+ description: Event data is not delimited at all.
27607+ properties:
27608+ method:
27609+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingBytesMethod'
27610+ required:
27611+ - method
27612+ type: object
27613+ ObservabilityPipelineSocketDestinationFramingBytesMethod:
27614+ description: The definition of `ObservabilityPipelineSocketDestinationFramingBytesMethod`
27615+ object.
27616+ enum:
27617+ - bytes
27618+ example: bytes
27619+ type: string
27620+ x-enum-varnames:
27621+ - BYTES
27622+ ObservabilityPipelineSocketDestinationFramingCharacterDelimited:
27623+ description: Each log event is separated using the specified delimiter character.
27624+ properties:
27625+ delimiter:
27626+ description: A single ASCII character used as a delimiter.
27627+ example: '|'
27628+ maxLength: 1
27629+ minLength: 1
27630+ type: string
27631+ method:
27632+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingCharacterDelimitedMethod'
27633+ required:
27634+ - method
27635+ - delimiter
27636+ type: object
27637+ ObservabilityPipelineSocketDestinationFramingCharacterDelimitedMethod:
27638+ description: The definition of `ObservabilityPipelineSocketDestinationFramingCharacterDelimitedMethod`
27639+ object.
27640+ enum:
27641+ - character_delimited
27642+ example: character_delimited
27643+ type: string
27644+ x-enum-varnames:
27645+ - CHARACTER_DELIMITED
27646+ ObservabilityPipelineSocketDestinationFramingNewlineDelimited:
27647+ description: Each log event is delimited by a newline character.
27648+ properties:
27649+ method:
27650+ $ref: '#/components/schemas/ObservabilityPipelineSocketDestinationFramingNewlineDelimitedMethod'
27651+ required:
27652+ - method
27653+ type: object
27654+ ObservabilityPipelineSocketDestinationFramingNewlineDelimitedMethod:
27655+ description: The definition of `ObservabilityPipelineSocketDestinationFramingNewlineDelimitedMethod`
27656+ object.
27657+ enum:
27658+ - newline_delimited
27659+ example: newline_delimited
27660+ type: string
27661+ x-enum-varnames:
27662+ - NEWLINE_DELIMITED
27663+ ObservabilityPipelineSocketDestinationMode:
27664+ description: Protocol used to send logs.
27665+ enum:
27666+ - tcp
27667+ - udp
27668+ example: tcp
27669+ type: string
27670+ x-enum-varnames:
27671+ - TCP
27672+ - UDP
27673+ ObservabilityPipelineSocketDestinationType:
27674+ default: socket
27675+ description: The destination type. The value should always be `socket`.
27676+ enum:
27677+ - socket
27678+ example: socket
27679+ type: string
27680+ x-enum-varnames:
27681+ - SOCKET
27682+ ObservabilityPipelineSocketSource:
27683+ description: 'The `socket` source ingests logs over TCP or UDP.
27684+
27685+ '
27686+ properties:
27687+ framing:
27688+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFraming'
27689+ id:
27690+ description: The unique identifier for this component. Used to reference
27691+ this component in other parts of the pipeline (e.g., as input to downstream
27692+ components).
27693+ example: socket-source
27694+ type: string
27695+ mode:
27696+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceMode'
27697+ tls:
27698+ $ref: '#/components/schemas/ObservabilityPipelineTls'
27699+ description: TLS configuration. Relevant only when `mode` is `tcp`.
27700+ type:
27701+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceType'
27702+ required:
27703+ - id
27704+ - type
27705+ - mode
27706+ - framing
27707+ type: object
27708+ ObservabilityPipelineSocketSourceFraming:
27709+ description: Framing method configuration for the socket source.
27710+ oneOf:
27711+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingNewlineDelimited'
27712+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingBytes'
27713+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingCharacterDelimited'
27714+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingOctetCounting'
27715+ - $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingChunkedGelf'
27716+ ObservabilityPipelineSocketSourceFramingBytes:
27717+ description: Byte frames are passed through as-is according to the underlying
27718+ I/O boundaries (for example, split between messages or stream segments).
27719+ properties:
27720+ method:
27721+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingBytesMethod'
27722+ required:
27723+ - method
27724+ type: object
27725+ ObservabilityPipelineSocketSourceFramingBytesMethod:
27726+ description: Byte frames are passed through as-is according to the underlying
27727+ I/O boundaries (for example, split between messages or stream segments).
27728+ enum:
27729+ - bytes
27730+ example: bytes
27731+ type: string
27732+ x-enum-varnames:
27733+ - BYTES
27734+ ObservabilityPipelineSocketSourceFramingCharacterDelimited:
27735+ description: Byte frames which are delimited by a chosen character.
27736+ properties:
27737+ delimiter:
27738+ description: A single ASCII character used to delimit events.
27739+ example: '|'
27740+ maxLength: 1
27741+ minLength: 1
27742+ type: string
27743+ method:
27744+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingCharacterDelimitedMethod'
27745+ required:
27746+ - method
27747+ - delimiter
27748+ type: object
27749+ ObservabilityPipelineSocketSourceFramingCharacterDelimitedMethod:
27750+ description: Byte frames which are delimited by a chosen character.
27751+ enum:
27752+ - character_delimited
27753+ example: character_delimited
27754+ type: string
27755+ x-enum-varnames:
27756+ - CHARACTER_DELIMITED
27757+ ObservabilityPipelineSocketSourceFramingChunkedGelf:
27758+ description: Byte frames which are chunked GELF messages.
27759+ properties:
27760+ method:
27761+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingChunkedGelfMethod'
27762+ required:
27763+ - method
27764+ type: object
27765+ ObservabilityPipelineSocketSourceFramingChunkedGelfMethod:
27766+ description: Byte frames which are chunked GELF messages.
27767+ enum:
27768+ - chunked_gelf
27769+ example: chunked_gelf
27770+ type: string
27771+ x-enum-varnames:
27772+ - CHUNKED_GELF
27773+ ObservabilityPipelineSocketSourceFramingNewlineDelimited:
27774+ description: Byte frames which are delimited by a newline character.
27775+ properties:
27776+ method:
27777+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingNewlineDelimitedMethod'
27778+ required:
27779+ - method
27780+ type: object
27781+ ObservabilityPipelineSocketSourceFramingNewlineDelimitedMethod:
27782+ description: Byte frames which are delimited by a newline character.
27783+ enum:
27784+ - newline_delimited
27785+ example: newline_delimited
27786+ type: string
27787+ x-enum-varnames:
27788+ - NEWLINE_DELIMITED
27789+ ObservabilityPipelineSocketSourceFramingOctetCounting:
27790+ description: Byte frames according to the octet counting format as per RFC6587.
27791+ properties:
27792+ method:
27793+ $ref: '#/components/schemas/ObservabilityPipelineSocketSourceFramingOctetCountingMethod'
27794+ required:
27795+ - method
27796+ type: object
27797+ ObservabilityPipelineSocketSourceFramingOctetCountingMethod:
27798+ description: Byte frames according to the octet counting format as per RFC6587.
27799+ enum:
27800+ - octet_counting
27801+ example: octet_counting
27802+ type: string
27803+ x-enum-varnames:
27804+ - OCTET_COUNTING
27805+ ObservabilityPipelineSocketSourceMode:
27806+ description: Protocol used to receive logs.
27807+ enum:
27808+ - tcp
27809+ - udp
27810+ example: tcp
27811+ type: string
27812+ x-enum-varnames:
27813+ - TCP
27814+ - UDP
27815+ ObservabilityPipelineSocketSourceType:
27816+ default: socket
27817+ description: The source type. The value should always be `socket`.
27818+ enum:
27819+ - socket
27820+ example: socket
27821+ type: string
27822+ x-enum-varnames:
27823+ - SOCKET
2746827824 ObservabilityPipelineSpec:
2746927825 description: Input schema representing an observability pipeline configuration.
2747027826 Used in create and validate requests.
0 commit comments