From 1aeb71c498f08364eaab14abed84b89332ca63da Mon Sep 17 00:00:00 2001 From: "ci.datadog-api-spec" Date: Fri, 21 Feb 2025 18:18:33 +0000 Subject: [PATCH] Regenerate client from commit 5de91bd6 of spec repo --- .apigentools-info | 8 +- .../en/api/v1/logs-pipelines/examples.json | 12 +- ...request.CreateLogsPipeline_2707101123.json | 17 + data/api/v1/CodeExamples.json | 7 + data/api/v1/full_spec.yaml | 40 +- data/api/v1/full_spec_deref.json | 485 +++++++++++++++++- static/resources/json/full_spec_v1.json | 485 +++++++++++++++++- 7 files changed, 1021 insertions(+), 33 deletions(-) create mode 100644 content/en/api/v1/logs-pipelines/request.CreateLogsPipeline_2707101123.json diff --git a/.apigentools-info b/.apigentools-info index 9105e58ba267a..fea46e0906bda 100644 --- a/.apigentools-info +++ b/.apigentools-info @@ -4,13 +4,13 @@ "spec_versions": { "v1": { "apigentools_version": "1.6.6", - "regenerated": "2025-02-21 08:02:09.923530", - "spec_repo_commit": "8f2d39c3" + "regenerated": "2025-02-21 18:18:14.103443", + "spec_repo_commit": "5de91bd6" }, "v2": { "apigentools_version": "1.6.6", - "regenerated": "2025-02-21 08:02:18.314729", - "spec_repo_commit": "8f2d39c3" + "regenerated": "2025-02-21 18:18:22.362127", + "spec_repo_commit": "5de91bd6" } } } \ No newline at end of file diff --git a/content/en/api/v1/logs-pipelines/examples.json b/content/en/api/v1/logs-pipelines/examples.json index e25e72b1f9f9f..c025afd891248 100644 --- a/content/en/api/v1/logs-pipelines/examples.json +++ b/content/en/api/v1/logs-pipelines/examples.json @@ -129,7 +129,7 @@ "tags": [], "type": "pipeline" }, - "html": "
\n
\n
\n
\n

description

\n
\n

string

\n

A description of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

ID of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the pipeline is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_read_only

\n
\n

boolean

\n

Whether or not the pipeline can be edited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[ <oneOf>]

\n

Ordered list of processors in this pipeline.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Create custom grok rules to parse the full message or a specific attribute of your raw event.\nFor more information, see the parsing section.

\n
\n
\n
\n
\n
\n

grok [required]

\n
\n

object

\n

Set of rules for the grok parser.

\n
\n
\n
\n
\n
\n

match_rules [required]

\n
\n

string

\n

List of match rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n

support_rules

\n
\n

string

\n

List of support rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

samples

\n
\n

[string]

\n

List of sample logs to test this grok parser.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Name of the log attribute to parse.

default: message

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs grok parser. \nAllowed enum values: grok-parser

default: grok-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

As Datadog receives logs, it timestamps them using the value(s) from any of these default attributes.

\n
    \n

  • timestamp

    \n
    • \n

  • date

    \n
    • \n

  • _timestamp

    \n
    • \n

  • Timestamp

    \n
    • \n

  • eventTime

    \n
    • \n

  • published_date

    \n

    If your logs put their dates in an attribute not in this list,\nuse the log date Remapper Processor to define their date attribute as the official log timestamp.\nThe recognized date formats are ISO8601, UNIX (the milliseconds EPOCH format), and RFC3164.

    \n
    • \n
\n

Note: If your logs don’t contain any of the default attributes\n and you haven’t defined your own date attribute, Datadog timestamps\n the logs with the date it received them.

\n

If multiple log date remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs date remapper. \nAllowed enum values: date-remapper

default: date-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 3

\n
\n

object

\n

Use this Processor if you want to assign some attributes as the official status.

\n

Each incoming status value is mapped as follows.

\n
    \n
  • Integers from 0 to 7 map to the Syslog severity standards
    • \n
  • Strings beginning with emerg or f (case-insensitive) map to emerg (0)
    • \n
  • Strings beginning with a (case-insensitive) map to alert (1)
    • \n
  • Strings beginning with c (case-insensitive) map to critical (2)
    • \n
  • Strings beginning with err (case-insensitive) map to error (3)
    • \n
  • Strings beginning with w (case-insensitive) map to warning (4)
    • \n
  • Strings beginning with n (case-insensitive) map to notice (5)
    • \n
  • Strings beginning with i (case-insensitive) map to info (6)
    • \n
  • Strings beginning with d, trace or verbose (case-insensitive) map to debug (7)
    • \n
  • Strings beginning with o or matching OK or Success (case-insensitive) map to OK
    • \n
  • All others map to info (6)
    • \n
\n

Note: If multiple log status remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs status remapper. \nAllowed enum values: status-remapper

default: status-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 4

\n
\n

object

\n

Use this processor if you want to assign one or more attributes as the official service.

\n

Note: If multiple service remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs service remapper. \nAllowed enum values: service-remapper

default: service-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 5

\n
\n

object

\n

The message is a key attribute in Datadog.\nIt is displayed in the message column of the Log Explorer and you can do full string search on it.\nUse this Processor to define one or more attributes as the official log message.

\n

Note: If multiple log message remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: msg

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs message remapper. \nAllowed enum values: message-remapper

default: message-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 6

\n
\n

object

\n

The remapper processor remaps any source attribute(s) or tag to another target attribute or tag.\nConstraints on the tag/attribute name are explained in the Tag Best Practice documentation.\nSome additional constraints are applied as : or , are not allowed in the target tag/attribute name.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

override_on_conflict

\n
\n

boolean

\n

Override or not the target element if already set,

\n
\n \n
\n
\n
\n
\n
\n

preserve_source

\n
\n

boolean

\n

Remove or preserve the remapped source element.

\n
\n \n
\n
\n
\n
\n
\n

source_type

\n
\n

string

\n

Defines if the sources are from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Final attribute or tag name to remap the sources to.

\n
\n \n
\n
\n
\n
\n
\n

target_format

\n
\n

enum

\n

If the target_type of the remapper is attribute, try to cast the value to a new specific type.\nIf the cast is not possible, the original type is kept. string, integer, or double are the possible types.\nIf the target_type is tag, this parameter may not be specified. \nAllowed enum values: auto,string,integer,double

\n
\n \n
\n
\n
\n
\n
\n

target_type

\n
\n

string

\n

Defines if the final attribute or tag name is from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs attribute remapper. \nAllowed enum values: attribute-remapper

default: attribute-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 7

\n
\n

object

\n

This processor extracts query parameters and other important parameters from a URL.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

normalize_ending_slashes

\n
\n

boolean

\n

Normalize the ending slashes or not.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.url

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.url_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs URL parser. \nAllowed enum values: url-parser

default: url-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 8

\n
\n

object

\n

The User-Agent parser takes a User-Agent attribute and extracts the OS, browser, device, and other user data.\nIt recognizes major bots like the Google Bot, Yahoo Slurp, and Bing.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_encoded

\n
\n

boolean

\n

Define if the source attribute is URL encoded or not.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.useragent

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.useragent_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs User-Agent parser. \nAllowed enum values: user-agent-parser

default: user-agent-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 9

\n
\n

object

\n

Use the Category Processor to add a new attribute (without spaces or special characters in the new attribute name)\nto a log matching a provided search query. Use categories to create groups for an analytical view.\nFor example, URL groups, machine groups, environments, and response time buckets.

\n

Notes:

\n
    \n
  • The syntax of the query is the one of Logs Explorer search bar.\nThe query can be done on any log attribute or tag, whether it is a facet or not.\nWildcards can also be used inside your query.
    • \n
  • Once the log has matched one of the Processor queries, it stops.\nMake sure they are properly ordered in case a log could match several queries.
    • \n
  • The names of the categories must be unique.
    • \n
  • Once defined in the Category Processor, you can map categories to log status using the Log Status Remapper.
    • \n
\n
\n
\n
\n
\n
\n

categories [required]

\n
\n

[object]

\n

Array of filters to match or not a log and their\ncorresponding name to assign a custom value to the log.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Value to assign to the target attribute.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the target attribute which value is defined by the matching category.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs category processor. \nAllowed enum values: category-processor

default: category-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 10

\n
\n

object

\n

Use the Arithmetic Processor to add a new attribute (without spaces or special characters\nin the new attribute name) to a log with the result of the provided formula.\nThis enables you to remap different time attributes with different units into a single attribute,\nor to compute operations on attributes within the same log.

\n

The formula can use parentheses and the basic arithmetic operators -, +, *, /.

\n

By default, the calculation is skipped if an attribute is missing.\nSelect “Replace missing attribute by 0” to automatically populate\nmissing attribute values with 0 to ensure that the calculation is done.\nAn attribute is missing if it is not found in the log attributes,\nor if it cannot be converted to a number.

\n

Notes:

\n
    \n
  • The operator - needs to be space split in the formula as it can also be contained in attribute names.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the formula.
    • \n
  • Results are rounded up to the 9th decimal. For example, if the result of the formula is 0.1234567891,\nthe actual value stored for the attribute is 0.123456789.
    • \n
  • If you need to scale a unit of measure,\nsee Scale Filter.
    • \n
\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Arithmetic operation between one or more log attributes.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of expression by 0, false\nskip the operation if an attribute is missing.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the result of the arithmetic operation.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs arithmetic processor. \nAllowed enum values: arithmetic-processor

default: arithmetic-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 11

\n
\n

object

\n

Use the string builder processor to add a new attribute (without spaces or special characters)\nto a log with the result of the provided template.\nThis enables aggregation of different attributes or raw strings into a single attribute.

\n

The template is defined by both raw text and blocks with the syntax %{attribute_path}.

\n

Notes:

\n
    \n
  • The processor only accepts attributes with values or an array of values in the blocks.
    • \n
  • If an attribute cannot be used (object or array of object),\nit is replaced by an empty string or the entire operation is skipped depending on your selection.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the template.
    • \n
  • Results of the template cannot exceed 256 characters.
    • \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of template by an empty string.\nIf false (default), skips the operation for missing attributes.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

The name of the attribute that contains the result of the template.

\n
\n \n
\n
\n
\n
\n
\n

template [required]

\n
\n

string

\n

A formula with one or more attributes and raw text.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs string builder processor. \nAllowed enum values: string-builder-processor

default: string-builder-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 12

\n
\n

object

\n

Nested Pipelines are pipelines within a pipeline. Use Nested Pipelines to split the processing into two steps.\nFor example, first use a high-level filtering such as team and then a second level of filtering based on the\nintegration, service, or any other tag or attribute.

\n

A pipeline can contain Nested Pipelines and Processors whereas a Nested Pipeline can only contain Processors.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[object]

\n

Ordered list of processors in this pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs pipeline processor. \nAllowed enum values: pipeline

default: pipeline

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 13

\n
\n

object

\n

The GeoIP parser takes an IP address attribute and extracts if available\nthe Continent, Country, Subdivision, and City information in the target attribute path.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: network.client.ip

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: network.client.geoip

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of GeoIP parser. \nAllowed enum values: geo-ip-parser

default: geo-ip-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 14

\n
\n

object

\n

Use the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in the processors mapping table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

default_lookup

\n
\n

string

\n

Value to set the target attribute if the source value is not found in the list.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_table [required]

\n
\n

[string]

\n

Mapping table of values for the source attribute and their associated target attribute values,\nformatted as ["source_key1,target_value1", "source_key2,target_value2"]

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list\nor the default_lookup if not found in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 15

\n
\n

object

\n

Note: Reference Tables are in public beta.\nUse the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in a Reference Table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_enrichment_table [required]

\n
\n

string

\n

Name of the Reference Table for the source attribute and their associated target attribute values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 16

\n
\n

object

\n

There are two ways to improve correlation between application traces and logs.

\n
    \n

  1. Follow the documentation on how to inject a trace ID in the application logs\nand by default log integrations take care of all the rest of the setup.

    \n
    2. \n

  2. Use the Trace remapper processor to define a log attribute as its associated trace ID.

    \n
    3. \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources

\n
\n

[string]

\n

Array of source attributes.

default: dd.trace_id

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs trace remapper. \nAllowed enum values: trace-id-remapper

default: trace-id-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

A list of tags associated with the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

string

\n

Type of pipeline.

\n
\n \n
\n
" + "html": "
\n
\n
\n
\n

description

\n
\n

string

\n

A description of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

ID of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the pipeline is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_read_only

\n
\n

boolean

\n

Whether or not the pipeline can be edited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[ <oneOf>]

\n

Ordered list of processors in this pipeline.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Create custom grok rules to parse the full message or a specific attribute of your raw event.\nFor more information, see the parsing section.

\n
\n
\n
\n
\n
\n

grok [required]

\n
\n

object

\n

Set of rules for the grok parser.

\n
\n
\n
\n
\n
\n

match_rules [required]

\n
\n

string

\n

List of match rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n

support_rules

\n
\n

string

\n

List of support rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

samples

\n
\n

[string]

\n

List of sample logs to test this grok parser.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Name of the log attribute to parse.

default: message

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs grok parser. \nAllowed enum values: grok-parser

default: grok-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

As Datadog receives logs, it timestamps them using the value(s) from any of these default attributes.

\n
    \n

  • timestamp

    \n
    • \n

  • date

    \n
    • \n

  • _timestamp

    \n
    • \n

  • Timestamp

    \n
    • \n

  • eventTime

    \n
    • \n

  • published_date

    \n

    If your logs put their dates in an attribute not in this list,\nuse the log date Remapper Processor to define their date attribute as the official log timestamp.\nThe recognized date formats are ISO8601, UNIX (the milliseconds EPOCH format), and RFC3164.

    \n
    • \n
\n

Note: If your logs don’t contain any of the default attributes\n and you haven’t defined your own date attribute, Datadog timestamps\n the logs with the date it received them.

\n

If multiple log date remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs date remapper. \nAllowed enum values: date-remapper

default: date-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 3

\n
\n

object

\n

Use this Processor if you want to assign some attributes as the official status.

\n

Each incoming status value is mapped as follows.

\n
    \n
  • Integers from 0 to 7 map to the Syslog severity standards
    • \n
  • Strings beginning with emerg or f (case-insensitive) map to emerg (0)
    • \n
  • Strings beginning with a (case-insensitive) map to alert (1)
    • \n
  • Strings beginning with c (case-insensitive) map to critical (2)
    • \n
  • Strings beginning with err (case-insensitive) map to error (3)
    • \n
  • Strings beginning with w (case-insensitive) map to warning (4)
    • \n
  • Strings beginning with n (case-insensitive) map to notice (5)
    • \n
  • Strings beginning with i (case-insensitive) map to info (6)
    • \n
  • Strings beginning with d, trace or verbose (case-insensitive) map to debug (7)
    • \n
  • Strings beginning with o or matching OK or Success (case-insensitive) map to OK
    • \n
  • All others map to info (6)
    • \n
\n

Note: If multiple log status remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs status remapper. \nAllowed enum values: status-remapper

default: status-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 4

\n
\n

object

\n

Use this processor if you want to assign one or more attributes as the official service.

\n

Note: If multiple service remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs service remapper. \nAllowed enum values: service-remapper

default: service-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 5

\n
\n

object

\n

The message is a key attribute in Datadog.\nIt is displayed in the message column of the Log Explorer and you can do full string search on it.\nUse this Processor to define one or more attributes as the official log message.

\n

Note: If multiple log message remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: msg

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs message remapper. \nAllowed enum values: message-remapper

default: message-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 6

\n
\n

object

\n

The remapper processor remaps any source attribute(s) or tag to another target attribute or tag.\nConstraints on the tag/attribute name are explained in the Tag Best Practice documentation.\nSome additional constraints are applied as : or , are not allowed in the target tag/attribute name.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

override_on_conflict

\n
\n

boolean

\n

Override or not the target element if already set,

\n
\n \n
\n
\n
\n
\n
\n

preserve_source

\n
\n

boolean

\n

Remove or preserve the remapped source element.

\n
\n \n
\n
\n
\n
\n
\n

source_type

\n
\n

string

\n

Defines if the sources are from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Final attribute or tag name to remap the sources to.

\n
\n \n
\n
\n
\n
\n
\n

target_format

\n
\n

enum

\n

If the target_type of the remapper is attribute, try to cast the value to a new specific type.\nIf the cast is not possible, the original type is kept. string, integer, or double are the possible types.\nIf the target_type is tag, this parameter may not be specified. \nAllowed enum values: auto,string,integer,double

\n
\n \n
\n
\n
\n
\n
\n

target_type

\n
\n

string

\n

Defines if the final attribute or tag name is from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs attribute remapper. \nAllowed enum values: attribute-remapper

default: attribute-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 7

\n
\n

object

\n

This processor extracts query parameters and other important parameters from a URL.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

normalize_ending_slashes

\n
\n

boolean

\n

Normalize the ending slashes or not.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.url

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.url_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs URL parser. \nAllowed enum values: url-parser

default: url-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 8

\n
\n

object

\n

The User-Agent parser takes a User-Agent attribute and extracts the OS, browser, device, and other user data.\nIt recognizes major bots like the Google Bot, Yahoo Slurp, and Bing.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_encoded

\n
\n

boolean

\n

Define if the source attribute is URL encoded or not.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.useragent

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.useragent_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs User-Agent parser. \nAllowed enum values: user-agent-parser

default: user-agent-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 9

\n
\n

object

\n

Use the Category Processor to add a new attribute (without spaces or special characters in the new attribute name)\nto a log matching a provided search query. Use categories to create groups for an analytical view.\nFor example, URL groups, machine groups, environments, and response time buckets.

\n

Notes:

\n
    \n
  • The syntax of the query is the one of Logs Explorer search bar.\nThe query can be done on any log attribute or tag, whether it is a facet or not.\nWildcards can also be used inside your query.
    • \n
  • Once the log has matched one of the Processor queries, it stops.\nMake sure they are properly ordered in case a log could match several queries.
    • \n
  • The names of the categories must be unique.
    • \n
  • Once defined in the Category Processor, you can map categories to log status using the Log Status Remapper.
    • \n
\n
\n
\n
\n
\n
\n

categories [required]

\n
\n

[object]

\n

Array of filters to match or not a log and their\ncorresponding name to assign a custom value to the log.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Value to assign to the target attribute.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the target attribute which value is defined by the matching category.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs category processor. \nAllowed enum values: category-processor

default: category-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 10

\n
\n

object

\n

Use the Arithmetic Processor to add a new attribute (without spaces or special characters\nin the new attribute name) to a log with the result of the provided formula.\nThis enables you to remap different time attributes with different units into a single attribute,\nor to compute operations on attributes within the same log.

\n

The formula can use parentheses and the basic arithmetic operators -, +, *, /.

\n

By default, the calculation is skipped if an attribute is missing.\nSelect “Replace missing attribute by 0” to automatically populate\nmissing attribute values with 0 to ensure that the calculation is done.\nAn attribute is missing if it is not found in the log attributes,\nor if it cannot be converted to a number.

\n

Notes:

\n
    \n
  • The operator - needs to be space split in the formula as it can also be contained in attribute names.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the formula.
    • \n
  • Results are rounded up to the 9th decimal. For example, if the result of the formula is 0.1234567891,\nthe actual value stored for the attribute is 0.123456789.
    • \n
  • If you need to scale a unit of measure,\nsee Scale Filter.
    • \n
\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Arithmetic operation between one or more log attributes.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of expression by 0, false\nskip the operation if an attribute is missing.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the result of the arithmetic operation.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs arithmetic processor. \nAllowed enum values: arithmetic-processor

default: arithmetic-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 11

\n
\n

object

\n

Use the string builder processor to add a new attribute (without spaces or special characters)\nto a log with the result of the provided template.\nThis enables aggregation of different attributes or raw strings into a single attribute.

\n

The template is defined by both raw text and blocks with the syntax %{attribute_path}.

\n

Notes:

\n
    \n
  • The processor only accepts attributes with values or an array of values in the blocks.
    • \n
  • If an attribute cannot be used (object or array of object),\nit is replaced by an empty string or the entire operation is skipped depending on your selection.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the template.
    • \n
  • Results of the template cannot exceed 256 characters.
    • \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of template by an empty string.\nIf false (default), skips the operation for missing attributes.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

The name of the attribute that contains the result of the template.

\n
\n \n
\n
\n
\n
\n
\n

template [required]

\n
\n

string

\n

A formula with one or more attributes and raw text.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs string builder processor. \nAllowed enum values: string-builder-processor

default: string-builder-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 12

\n
\n

object

\n

Nested Pipelines are pipelines within a pipeline. Use Nested Pipelines to split the processing into two steps.\nFor example, first use a high-level filtering such as team and then a second level of filtering based on the\nintegration, service, or any other tag or attribute.

\n

A pipeline can contain Nested Pipelines and Processors whereas a Nested Pipeline can only contain Processors.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[object]

\n

Ordered list of processors in this pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs pipeline processor. \nAllowed enum values: pipeline

default: pipeline

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 13

\n
\n

object

\n

The GeoIP parser takes an IP address attribute and extracts if available\nthe Continent, Country, Subdivision, and City information in the target attribute path.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: network.client.ip

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: network.client.geoip

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of GeoIP parser. \nAllowed enum values: geo-ip-parser

default: geo-ip-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 14

\n
\n

object

\n

Use the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in the processors mapping table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

default_lookup

\n
\n

string

\n

Value to set the target attribute if the source value is not found in the list.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_table [required]

\n
\n

[string]

\n

Mapping table of values for the source attribute and their associated target attribute values,\nformatted as ["source_key1,target_value1", "source_key2,target_value2"]

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list\nor the default_lookup if not found in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 15

\n
\n

object

\n

Note: Reference Tables are in public beta.\nUse the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in a Reference Table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_enrichment_table [required]

\n
\n

string

\n

Name of the Reference Table for the source attribute and their associated target attribute values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 16

\n
\n

object

\n

There are two ways to improve correlation between application traces and logs.

\n
    \n

  1. Follow the documentation on how to inject a trace ID in the application logs\nand by default log integrations take care of all the rest of the setup.

    \n
    2. \n

  2. Use the Trace remapper processor to define a log attribute as its associated trace ID.

    \n
    3. \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources

\n
\n

[string]

\n

Array of source attributes.

default: dd.trace_id

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs trace remapper. \nAllowed enum values: trace-id-remapper

default: trace-id-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 17

\n
\n

object

\n

There are two ways to define correlation between application spans and logs:

\n
    \n

  1. Follow the documentation on how to inject a span ID in the application logs.\nLog integrations automatically handle all remaining setup steps by default.

    \n
    2. \n

  2. Use the span remapper processor to define a log attribute as its associated span ID.

    \n
    3. \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources

\n
\n

[string]

\n

Array of source attributes.

default: dd.span_id

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs span remapper. \nAllowed enum values: span-id-remapper

default: span-id-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

A list of tags associated with the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

string

\n

Type of pipeline.

\n
\n \n
\n
" }, "403": { "json": { @@ -182,7 +182,7 @@ "tags": [], "type": "pipeline" }, - "html": "
\n
\n
\n
\n

description

\n
\n

string

\n

A description of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

ID of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the pipeline is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_read_only

\n
\n

boolean

\n

Whether or not the pipeline can be edited.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Name of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[ <oneOf>]

\n

Ordered list of processors in this pipeline.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Create custom grok rules to parse the full message or a specific attribute of your raw event.\nFor more information, see the parsing section.

\n
\n
\n
\n
\n
\n

grok [required]

\n
\n

object

\n

Set of rules for the grok parser.

\n
\n
\n
\n
\n
\n

match_rules [required]

\n
\n

string

\n

List of match rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n

support_rules

\n
\n

string

\n

List of support rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

samples

\n
\n

[string]

\n

List of sample logs to test this grok parser.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Name of the log attribute to parse.

default: message

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs grok parser. \nAllowed enum values: grok-parser

default: grok-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

As Datadog receives logs, it timestamps them using the value(s) from any of these default attributes.

\n
    \n

  • timestamp

    \n
    • \n

  • date

    \n
    • \n

  • _timestamp

    \n
    • \n

  • Timestamp

    \n
    • \n

  • eventTime

    \n
    • \n

  • published_date

    \n

    If your logs put their dates in an attribute not in this list,\nuse the log date Remapper Processor to define their date attribute as the official log timestamp.\nThe recognized date formats are ISO8601, UNIX (the milliseconds EPOCH format), and RFC3164.

    \n
    • \n
\n

Note: If your logs don’t contain any of the default attributes\n and you haven’t defined your own date attribute, Datadog timestamps\n the logs with the date it received them.

\n

If multiple log date remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs date remapper. \nAllowed enum values: date-remapper

default: date-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 3

\n
\n

object

\n

Use this Processor if you want to assign some attributes as the official status.

\n

Each incoming status value is mapped as follows.

\n
    \n
  • Integers from 0 to 7 map to the Syslog severity standards
    • \n
  • Strings beginning with emerg or f (case-insensitive) map to emerg (0)
    • \n
  • Strings beginning with a (case-insensitive) map to alert (1)
    • \n
  • Strings beginning with c (case-insensitive) map to critical (2)
    • \n
  • Strings beginning with err (case-insensitive) map to error (3)
    • \n
  • Strings beginning with w (case-insensitive) map to warning (4)
    • \n
  • Strings beginning with n (case-insensitive) map to notice (5)
    • \n
  • Strings beginning with i (case-insensitive) map to info (6)
    • \n
  • Strings beginning with d, trace or verbose (case-insensitive) map to debug (7)
    • \n
  • Strings beginning with o or matching OK or Success (case-insensitive) map to OK
    • \n
  • All others map to info (6)
    • \n
\n

Note: If multiple log status remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs status remapper. \nAllowed enum values: status-remapper

default: status-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 4

\n
\n

object

\n

Use this processor if you want to assign one or more attributes as the official service.

\n

Note: If multiple service remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs service remapper. \nAllowed enum values: service-remapper

default: service-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 5

\n
\n

object

\n

The message is a key attribute in Datadog.\nIt is displayed in the message column of the Log Explorer and you can do full string search on it.\nUse this Processor to define one or more attributes as the official log message.

\n

Note: If multiple log message remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: msg

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs message remapper. \nAllowed enum values: message-remapper

default: message-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 6

\n
\n

object

\n

The remapper processor remaps any source attribute(s) or tag to another target attribute or tag.\nConstraints on the tag/attribute name are explained in the Tag Best Practice documentation.\nSome additional constraints are applied as : or , are not allowed in the target tag/attribute name.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

override_on_conflict

\n
\n

boolean

\n

Override or not the target element if already set,

\n
\n \n
\n
\n
\n
\n
\n

preserve_source

\n
\n

boolean

\n

Remove or preserve the remapped source element.

\n
\n \n
\n
\n
\n
\n
\n

source_type

\n
\n

string

\n

Defines if the sources are from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Final attribute or tag name to remap the sources to.

\n
\n \n
\n
\n
\n
\n
\n

target_format

\n
\n

enum

\n

If the target_type of the remapper is attribute, try to cast the value to a new specific type.\nIf the cast is not possible, the original type is kept. string, integer, or double are the possible types.\nIf the target_type is tag, this parameter may not be specified. \nAllowed enum values: auto,string,integer,double

\n
\n \n
\n
\n
\n
\n
\n

target_type

\n
\n

string

\n

Defines if the final attribute or tag name is from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs attribute remapper. \nAllowed enum values: attribute-remapper

default: attribute-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 7

\n
\n

object

\n

This processor extracts query parameters and other important parameters from a URL.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

normalize_ending_slashes

\n
\n

boolean

\n

Normalize the ending slashes or not.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.url

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.url_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs URL parser. \nAllowed enum values: url-parser

default: url-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 8

\n
\n

object

\n

The User-Agent parser takes a User-Agent attribute and extracts the OS, browser, device, and other user data.\nIt recognizes major bots like the Google Bot, Yahoo Slurp, and Bing.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_encoded

\n
\n

boolean

\n

Define if the source attribute is URL encoded or not.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.useragent

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.useragent_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs User-Agent parser. \nAllowed enum values: user-agent-parser

default: user-agent-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 9

\n
\n

object

\n

Use the Category Processor to add a new attribute (without spaces or special characters in the new attribute name)\nto a log matching a provided search query. Use categories to create groups for an analytical view.\nFor example, URL groups, machine groups, environments, and response time buckets.

\n

Notes:

\n
    \n
  • The syntax of the query is the one of Logs Explorer search bar.\nThe query can be done on any log attribute or tag, whether it is a facet or not.\nWildcards can also be used inside your query.
    • \n
  • Once the log has matched one of the Processor queries, it stops.\nMake sure they are properly ordered in case a log could match several queries.
    • \n
  • The names of the categories must be unique.
    • \n
  • Once defined in the Category Processor, you can map categories to log status using the Log Status Remapper.
    • \n
\n
\n
\n
\n
\n
\n

categories [required]

\n
\n

[object]

\n

Array of filters to match or not a log and their\ncorresponding name to assign a custom value to the log.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Value to assign to the target attribute.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the target attribute which value is defined by the matching category.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs category processor. \nAllowed enum values: category-processor

default: category-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 10

\n
\n

object

\n

Use the Arithmetic Processor to add a new attribute (without spaces or special characters\nin the new attribute name) to a log with the result of the provided formula.\nThis enables you to remap different time attributes with different units into a single attribute,\nor to compute operations on attributes within the same log.

\n

The formula can use parentheses and the basic arithmetic operators -, +, *, /.

\n

By default, the calculation is skipped if an attribute is missing.\nSelect “Replace missing attribute by 0” to automatically populate\nmissing attribute values with 0 to ensure that the calculation is done.\nAn attribute is missing if it is not found in the log attributes,\nor if it cannot be converted to a number.

\n

Notes:

\n
    \n
  • The operator - needs to be space split in the formula as it can also be contained in attribute names.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the formula.
    • \n
  • Results are rounded up to the 9th decimal. For example, if the result of the formula is 0.1234567891,\nthe actual value stored for the attribute is 0.123456789.
    • \n
  • If you need to scale a unit of measure,\nsee Scale Filter.
    • \n
\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Arithmetic operation between one or more log attributes.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of expression by 0, false\nskip the operation if an attribute is missing.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the result of the arithmetic operation.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs arithmetic processor. \nAllowed enum values: arithmetic-processor

default: arithmetic-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 11

\n
\n

object

\n

Use the string builder processor to add a new attribute (without spaces or special characters)\nto a log with the result of the provided template.\nThis enables aggregation of different attributes or raw strings into a single attribute.

\n

The template is defined by both raw text and blocks with the syntax %{attribute_path}.

\n

Notes:

\n
    \n
  • The processor only accepts attributes with values or an array of values in the blocks.
    • \n
  • If an attribute cannot be used (object or array of object),\nit is replaced by an empty string or the entire operation is skipped depending on your selection.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the template.
    • \n
  • Results of the template cannot exceed 256 characters.
    • \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of template by an empty string.\nIf false (default), skips the operation for missing attributes.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

The name of the attribute that contains the result of the template.

\n
\n \n
\n
\n
\n
\n
\n

template [required]

\n
\n

string

\n

A formula with one or more attributes and raw text.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs string builder processor. \nAllowed enum values: string-builder-processor

default: string-builder-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 12

\n
\n

object

\n

Nested Pipelines are pipelines within a pipeline. Use Nested Pipelines to split the processing into two steps.\nFor example, first use a high-level filtering such as team and then a second level of filtering based on the\nintegration, service, or any other tag or attribute.

\n

A pipeline can contain Nested Pipelines and Processors whereas a Nested Pipeline can only contain Processors.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[object]

\n

Ordered list of processors in this pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs pipeline processor. \nAllowed enum values: pipeline

default: pipeline

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 13

\n
\n

object

\n

The GeoIP parser takes an IP address attribute and extracts if available\nthe Continent, Country, Subdivision, and City information in the target attribute path.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: network.client.ip

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: network.client.geoip

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of GeoIP parser. \nAllowed enum values: geo-ip-parser

default: geo-ip-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 14

\n
\n

object

\n

Use the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in the processors mapping table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

default_lookup

\n
\n

string

\n

Value to set the target attribute if the source value is not found in the list.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_table [required]

\n
\n

[string]

\n

Mapping table of values for the source attribute and their associated target attribute values,\nformatted as ["source_key1,target_value1", "source_key2,target_value2"]

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list\nor the default_lookup if not found in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 15

\n
\n

object

\n

Note: Reference Tables are in public beta.\nUse the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in a Reference Table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_enrichment_table [required]

\n
\n

string

\n

Name of the Reference Table for the source attribute and their associated target attribute values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 16

\n
\n

object

\n

There are two ways to improve correlation between application traces and logs.

\n
    \n

  1. Follow the documentation on how to inject a trace ID in the application logs\nand by default log integrations take care of all the rest of the setup.

    \n
    2. \n

  2. Use the Trace remapper processor to define a log attribute as its associated trace ID.

    \n
    3. \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources

\n
\n

[string]

\n

Array of source attributes.

default: dd.trace_id

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs trace remapper. \nAllowed enum values: trace-id-remapper

default: trace-id-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

A list of tags associated with the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

string

\n

Type of pipeline.

\n
\n \n
\n
" + "html": "
\n
\n
\n
\n

description

\n
\n

string

\n

A description of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

ID of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the pipeline is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_read_only

\n
\n

boolean

\n

Whether or not the pipeline can be edited.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Name of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[ <oneOf>]

\n

Ordered list of processors in this pipeline.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Create custom grok rules to parse the full message or a specific attribute of your raw event.\nFor more information, see the parsing section.

\n
\n
\n
\n
\n
\n

grok [required]

\n
\n

object

\n

Set of rules for the grok parser.

\n
\n
\n
\n
\n
\n

match_rules [required]

\n
\n

string

\n

List of match rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n

support_rules

\n
\n

string

\n

List of support rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

samples

\n
\n

[string]

\n

List of sample logs to test this grok parser.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Name of the log attribute to parse.

default: message

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs grok parser. \nAllowed enum values: grok-parser

default: grok-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

As Datadog receives logs, it timestamps them using the value(s) from any of these default attributes.

\n
    \n

  • timestamp

    \n
    • \n

  • date

    \n
    • \n

  • _timestamp

    \n
    • \n

  • Timestamp

    \n
    • \n

  • eventTime

    \n
    • \n

  • published_date

    \n

    If your logs put their dates in an attribute not in this list,\nuse the log date Remapper Processor to define their date attribute as the official log timestamp.\nThe recognized date formats are ISO8601, UNIX (the milliseconds EPOCH format), and RFC3164.

    \n
    • \n
\n

Note: If your logs don’t contain any of the default attributes\n and you haven’t defined your own date attribute, Datadog timestamps\n the logs with the date it received them.

\n

If multiple log date remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs date remapper. \nAllowed enum values: date-remapper

default: date-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 3

\n
\n

object

\n

Use this Processor if you want to assign some attributes as the official status.

\n

Each incoming status value is mapped as follows.

\n
    \n
  • Integers from 0 to 7 map to the Syslog severity standards
    • \n
  • Strings beginning with emerg or f (case-insensitive) map to emerg (0)
    • \n
  • Strings beginning with a (case-insensitive) map to alert (1)
    • \n
  • Strings beginning with c (case-insensitive) map to critical (2)
    • \n
  • Strings beginning with err (case-insensitive) map to error (3)
    • \n
  • Strings beginning with w (case-insensitive) map to warning (4)
    • \n
  • Strings beginning with n (case-insensitive) map to notice (5)
    • \n
  • Strings beginning with i (case-insensitive) map to info (6)
    • \n
  • Strings beginning with d, trace or verbose (case-insensitive) map to debug (7)
    • \n
  • Strings beginning with o or matching OK or Success (case-insensitive) map to OK
    • \n
  • All others map to info (6)
    • \n
\n

Note: If multiple log status remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs status remapper. \nAllowed enum values: status-remapper

default: status-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 4

\n
\n

object

\n

Use this processor if you want to assign one or more attributes as the official service.

\n

Note: If multiple service remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs service remapper. \nAllowed enum values: service-remapper

default: service-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 5

\n
\n

object

\n

The message is a key attribute in Datadog.\nIt is displayed in the message column of the Log Explorer and you can do full string search on it.\nUse this Processor to define one or more attributes as the official log message.

\n

Note: If multiple log message remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: msg

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs message remapper. \nAllowed enum values: message-remapper

default: message-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 6

\n
\n

object

\n

The remapper processor remaps any source attribute(s) or tag to another target attribute or tag.\nConstraints on the tag/attribute name are explained in the Tag Best Practice documentation.\nSome additional constraints are applied as : or , are not allowed in the target tag/attribute name.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

override_on_conflict

\n
\n

boolean

\n

Override or not the target element if already set,

\n
\n \n
\n
\n
\n
\n
\n

preserve_source

\n
\n

boolean

\n

Remove or preserve the remapped source element.

\n
\n \n
\n
\n
\n
\n
\n

source_type

\n
\n

string

\n

Defines if the sources are from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Final attribute or tag name to remap the sources to.

\n
\n \n
\n
\n
\n
\n
\n

target_format

\n
\n

enum

\n

If the target_type of the remapper is attribute, try to cast the value to a new specific type.\nIf the cast is not possible, the original type is kept. string, integer, or double are the possible types.\nIf the target_type is tag, this parameter may not be specified. \nAllowed enum values: auto,string,integer,double

\n
\n \n
\n
\n
\n
\n
\n

target_type

\n
\n

string

\n

Defines if the final attribute or tag name is from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs attribute remapper. \nAllowed enum values: attribute-remapper

default: attribute-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 7

\n
\n

object

\n

This processor extracts query parameters and other important parameters from a URL.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

normalize_ending_slashes

\n
\n

boolean

\n

Normalize the ending slashes or not.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.url

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.url_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs URL parser. \nAllowed enum values: url-parser

default: url-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 8

\n
\n

object

\n

The User-Agent parser takes a User-Agent attribute and extracts the OS, browser, device, and other user data.\nIt recognizes major bots like the Google Bot, Yahoo Slurp, and Bing.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_encoded

\n
\n

boolean

\n

Define if the source attribute is URL encoded or not.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.useragent

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.useragent_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs User-Agent parser. \nAllowed enum values: user-agent-parser

default: user-agent-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 9

\n
\n

object

\n

Use the Category Processor to add a new attribute (without spaces or special characters in the new attribute name)\nto a log matching a provided search query. Use categories to create groups for an analytical view.\nFor example, URL groups, machine groups, environments, and response time buckets.

\n

Notes:

\n
    \n
  • The syntax of the query is the one of Logs Explorer search bar.\nThe query can be done on any log attribute or tag, whether it is a facet or not.\nWildcards can also be used inside your query.
    • \n
  • Once the log has matched one of the Processor queries, it stops.\nMake sure they are properly ordered in case a log could match several queries.
    • \n
  • The names of the categories must be unique.
    • \n
  • Once defined in the Category Processor, you can map categories to log status using the Log Status Remapper.
    • \n
\n
\n
\n
\n
\n
\n

categories [required]

\n
\n

[object]

\n

Array of filters to match or not a log and their\ncorresponding name to assign a custom value to the log.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Value to assign to the target attribute.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the target attribute which value is defined by the matching category.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs category processor. \nAllowed enum values: category-processor

default: category-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 10

\n
\n

object

\n

Use the Arithmetic Processor to add a new attribute (without spaces or special characters\nin the new attribute name) to a log with the result of the provided formula.\nThis enables you to remap different time attributes with different units into a single attribute,\nor to compute operations on attributes within the same log.

\n

The formula can use parentheses and the basic arithmetic operators -, +, *, /.

\n

By default, the calculation is skipped if an attribute is missing.\nSelect “Replace missing attribute by 0” to automatically populate\nmissing attribute values with 0 to ensure that the calculation is done.\nAn attribute is missing if it is not found in the log attributes,\nor if it cannot be converted to a number.

\n

Notes:

\n
    \n
  • The operator - needs to be space split in the formula as it can also be contained in attribute names.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the formula.
    • \n
  • Results are rounded up to the 9th decimal. For example, if the result of the formula is 0.1234567891,\nthe actual value stored for the attribute is 0.123456789.
    • \n
  • If you need to scale a unit of measure,\nsee Scale Filter.
    • \n
\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Arithmetic operation between one or more log attributes.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of expression by 0, false\nskip the operation if an attribute is missing.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the result of the arithmetic operation.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs arithmetic processor. \nAllowed enum values: arithmetic-processor

default: arithmetic-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 11

\n
\n

object

\n

Use the string builder processor to add a new attribute (without spaces or special characters)\nto a log with the result of the provided template.\nThis enables aggregation of different attributes or raw strings into a single attribute.

\n

The template is defined by both raw text and blocks with the syntax %{attribute_path}.

\n

Notes:

\n
    \n
  • The processor only accepts attributes with values or an array of values in the blocks.
    • \n
  • If an attribute cannot be used (object or array of object),\nit is replaced by an empty string or the entire operation is skipped depending on your selection.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the template.
    • \n
  • Results of the template cannot exceed 256 characters.
    • \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of template by an empty string.\nIf false (default), skips the operation for missing attributes.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

The name of the attribute that contains the result of the template.

\n
\n \n
\n
\n
\n
\n
\n

template [required]

\n
\n

string

\n

A formula with one or more attributes and raw text.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs string builder processor. \nAllowed enum values: string-builder-processor

default: string-builder-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 12

\n
\n

object

\n

Nested Pipelines are pipelines within a pipeline. Use Nested Pipelines to split the processing into two steps.\nFor example, first use a high-level filtering such as team and then a second level of filtering based on the\nintegration, service, or any other tag or attribute.

\n

A pipeline can contain Nested Pipelines and Processors whereas a Nested Pipeline can only contain Processors.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[object]

\n

Ordered list of processors in this pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs pipeline processor. \nAllowed enum values: pipeline

default: pipeline

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 13

\n
\n

object

\n

The GeoIP parser takes an IP address attribute and extracts if available\nthe Continent, Country, Subdivision, and City information in the target attribute path.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: network.client.ip

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: network.client.geoip

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of GeoIP parser. \nAllowed enum values: geo-ip-parser

default: geo-ip-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 14

\n
\n

object

\n

Use the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in the processors mapping table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

default_lookup

\n
\n

string

\n

Value to set the target attribute if the source value is not found in the list.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_table [required]

\n
\n

[string]

\n

Mapping table of values for the source attribute and their associated target attribute values,\nformatted as ["source_key1,target_value1", "source_key2,target_value2"]

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list\nor the default_lookup if not found in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 15

\n
\n

object

\n

Note: Reference Tables are in public beta.\nUse the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in a Reference Table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_enrichment_table [required]

\n
\n

string

\n

Name of the Reference Table for the source attribute and their associated target attribute values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 16

\n
\n

object

\n

There are two ways to improve correlation between application traces and logs.

\n
    \n

  1. Follow the documentation on how to inject a trace ID in the application logs\nand by default log integrations take care of all the rest of the setup.

    \n
    2. \n

  2. Use the Trace remapper processor to define a log attribute as its associated trace ID.

    \n
    3. \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources

\n
\n

[string]

\n

Array of source attributes.

default: dd.trace_id

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs trace remapper. \nAllowed enum values: trace-id-remapper

default: trace-id-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 17

\n
\n

object

\n

There are two ways to define correlation between application spans and logs:

\n
    \n

  1. Follow the documentation on how to inject a span ID in the application logs.\nLog integrations automatically handle all remaining setup steps by default.

    \n
    2. \n

  2. Use the span remapper processor to define a log attribute as its associated span ID.

    \n
    3. \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources

\n
\n

[string]

\n

Array of source attributes.

default: dd.span_id

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs span remapper. \nAllowed enum values: span-id-remapper

default: span-id-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

A list of tags associated with the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

string

\n

Type of pipeline.

\n
\n \n
\n
" }, "400": { "json": { @@ -244,7 +244,7 @@ ], "tags": [] }, - "html": "
\n
\n
\n
\n

description

\n
\n

string

\n

A description of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

ID of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the pipeline is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_read_only

\n
\n

boolean

\n

Whether or not the pipeline can be edited.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Name of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[ <oneOf>]

\n

Ordered list of processors in this pipeline.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Create custom grok rules to parse the full message or a specific attribute of your raw event.\nFor more information, see the parsing section.

\n
\n
\n
\n
\n
\n

grok [required]

\n
\n

object

\n

Set of rules for the grok parser.

\n
\n
\n
\n
\n
\n

match_rules [required]

\n
\n

string

\n

List of match rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n

support_rules

\n
\n

string

\n

List of support rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

samples

\n
\n

[string]

\n

List of sample logs to test this grok parser.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Name of the log attribute to parse.

default: message

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs grok parser. \nAllowed enum values: grok-parser

default: grok-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

As Datadog receives logs, it timestamps them using the value(s) from any of these default attributes.

\n
    \n

  • timestamp

    \n
    • \n

  • date

    \n
    • \n

  • _timestamp

    \n
    • \n

  • Timestamp

    \n
    • \n

  • eventTime

    \n
    • \n

  • published_date

    \n

    If your logs put their dates in an attribute not in this list,\nuse the log date Remapper Processor to define their date attribute as the official log timestamp.\nThe recognized date formats are ISO8601, UNIX (the milliseconds EPOCH format), and RFC3164.

    \n
    • \n
\n

Note: If your logs don’t contain any of the default attributes\n and you haven’t defined your own date attribute, Datadog timestamps\n the logs with the date it received them.

\n

If multiple log date remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs date remapper. \nAllowed enum values: date-remapper

default: date-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 3

\n
\n

object

\n

Use this Processor if you want to assign some attributes as the official status.

\n

Each incoming status value is mapped as follows.

\n
    \n
  • Integers from 0 to 7 map to the Syslog severity standards
    • \n
  • Strings beginning with emerg or f (case-insensitive) map to emerg (0)
    • \n
  • Strings beginning with a (case-insensitive) map to alert (1)
    • \n
  • Strings beginning with c (case-insensitive) map to critical (2)
    • \n
  • Strings beginning with err (case-insensitive) map to error (3)
    • \n
  • Strings beginning with w (case-insensitive) map to warning (4)
    • \n
  • Strings beginning with n (case-insensitive) map to notice (5)
    • \n
  • Strings beginning with i (case-insensitive) map to info (6)
    • \n
  • Strings beginning with d, trace or verbose (case-insensitive) map to debug (7)
    • \n
  • Strings beginning with o or matching OK or Success (case-insensitive) map to OK
    • \n
  • All others map to info (6)
    • \n
\n

Note: If multiple log status remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs status remapper. \nAllowed enum values: status-remapper

default: status-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 4

\n
\n

object

\n

Use this processor if you want to assign one or more attributes as the official service.

\n

Note: If multiple service remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs service remapper. \nAllowed enum values: service-remapper

default: service-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 5

\n
\n

object

\n

The message is a key attribute in Datadog.\nIt is displayed in the message column of the Log Explorer and you can do full string search on it.\nUse this Processor to define one or more attributes as the official log message.

\n

Note: If multiple log message remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: msg

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs message remapper. \nAllowed enum values: message-remapper

default: message-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 6

\n
\n

object

\n

The remapper processor remaps any source attribute(s) or tag to another target attribute or tag.\nConstraints on the tag/attribute name are explained in the Tag Best Practice documentation.\nSome additional constraints are applied as : or , are not allowed in the target tag/attribute name.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

override_on_conflict

\n
\n

boolean

\n

Override or not the target element if already set,

\n
\n \n
\n
\n
\n
\n
\n

preserve_source

\n
\n

boolean

\n

Remove or preserve the remapped source element.

\n
\n \n
\n
\n
\n
\n
\n

source_type

\n
\n

string

\n

Defines if the sources are from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Final attribute or tag name to remap the sources to.

\n
\n \n
\n
\n
\n
\n
\n

target_format

\n
\n

enum

\n

If the target_type of the remapper is attribute, try to cast the value to a new specific type.\nIf the cast is not possible, the original type is kept. string, integer, or double are the possible types.\nIf the target_type is tag, this parameter may not be specified. \nAllowed enum values: auto,string,integer,double

\n
\n \n
\n
\n
\n
\n
\n

target_type

\n
\n

string

\n

Defines if the final attribute or tag name is from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs attribute remapper. \nAllowed enum values: attribute-remapper

default: attribute-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 7

\n
\n

object

\n

This processor extracts query parameters and other important parameters from a URL.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

normalize_ending_slashes

\n
\n

boolean

\n

Normalize the ending slashes or not.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.url

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.url_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs URL parser. \nAllowed enum values: url-parser

default: url-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 8

\n
\n

object

\n

The User-Agent parser takes a User-Agent attribute and extracts the OS, browser, device, and other user data.\nIt recognizes major bots like the Google Bot, Yahoo Slurp, and Bing.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_encoded

\n
\n

boolean

\n

Define if the source attribute is URL encoded or not.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.useragent

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.useragent_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs User-Agent parser. \nAllowed enum values: user-agent-parser

default: user-agent-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 9

\n
\n

object

\n

Use the Category Processor to add a new attribute (without spaces or special characters in the new attribute name)\nto a log matching a provided search query. Use categories to create groups for an analytical view.\nFor example, URL groups, machine groups, environments, and response time buckets.

\n

Notes:

\n
    \n
  • The syntax of the query is the one of Logs Explorer search bar.\nThe query can be done on any log attribute or tag, whether it is a facet or not.\nWildcards can also be used inside your query.
    • \n
  • Once the log has matched one of the Processor queries, it stops.\nMake sure they are properly ordered in case a log could match several queries.
    • \n
  • The names of the categories must be unique.
    • \n
  • Once defined in the Category Processor, you can map categories to log status using the Log Status Remapper.
    • \n
\n
\n
\n
\n
\n
\n

categories [required]

\n
\n

[object]

\n

Array of filters to match or not a log and their\ncorresponding name to assign a custom value to the log.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Value to assign to the target attribute.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the target attribute which value is defined by the matching category.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs category processor. \nAllowed enum values: category-processor

default: category-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 10

\n
\n

object

\n

Use the Arithmetic Processor to add a new attribute (without spaces or special characters\nin the new attribute name) to a log with the result of the provided formula.\nThis enables you to remap different time attributes with different units into a single attribute,\nor to compute operations on attributes within the same log.

\n

The formula can use parentheses and the basic arithmetic operators -, +, *, /.

\n

By default, the calculation is skipped if an attribute is missing.\nSelect “Replace missing attribute by 0” to automatically populate\nmissing attribute values with 0 to ensure that the calculation is done.\nAn attribute is missing if it is not found in the log attributes,\nor if it cannot be converted to a number.

\n

Notes:

\n
    \n
  • The operator - needs to be space split in the formula as it can also be contained in attribute names.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the formula.
    • \n
  • Results are rounded up to the 9th decimal. For example, if the result of the formula is 0.1234567891,\nthe actual value stored for the attribute is 0.123456789.
    • \n
  • If you need to scale a unit of measure,\nsee Scale Filter.
    • \n
\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Arithmetic operation between one or more log attributes.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of expression by 0, false\nskip the operation if an attribute is missing.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the result of the arithmetic operation.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs arithmetic processor. \nAllowed enum values: arithmetic-processor

default: arithmetic-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 11

\n
\n

object

\n

Use the string builder processor to add a new attribute (without spaces or special characters)\nto a log with the result of the provided template.\nThis enables aggregation of different attributes or raw strings into a single attribute.

\n

The template is defined by both raw text and blocks with the syntax %{attribute_path}.

\n

Notes:

\n
    \n
  • The processor only accepts attributes with values or an array of values in the blocks.
    • \n
  • If an attribute cannot be used (object or array of object),\nit is replaced by an empty string or the entire operation is skipped depending on your selection.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the template.
    • \n
  • Results of the template cannot exceed 256 characters.
    • \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of template by an empty string.\nIf false (default), skips the operation for missing attributes.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

The name of the attribute that contains the result of the template.

\n
\n \n
\n
\n
\n
\n
\n

template [required]

\n
\n

string

\n

A formula with one or more attributes and raw text.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs string builder processor. \nAllowed enum values: string-builder-processor

default: string-builder-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 12

\n
\n

object

\n

Nested Pipelines are pipelines within a pipeline. Use Nested Pipelines to split the processing into two steps.\nFor example, first use a high-level filtering such as team and then a second level of filtering based on the\nintegration, service, or any other tag or attribute.

\n

A pipeline can contain Nested Pipelines and Processors whereas a Nested Pipeline can only contain Processors.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[object]

\n

Ordered list of processors in this pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs pipeline processor. \nAllowed enum values: pipeline

default: pipeline

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 13

\n
\n

object

\n

The GeoIP parser takes an IP address attribute and extracts if available\nthe Continent, Country, Subdivision, and City information in the target attribute path.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: network.client.ip

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: network.client.geoip

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of GeoIP parser. \nAllowed enum values: geo-ip-parser

default: geo-ip-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 14

\n
\n

object

\n

Use the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in the processors mapping table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

default_lookup

\n
\n

string

\n

Value to set the target attribute if the source value is not found in the list.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_table [required]

\n
\n

[string]

\n

Mapping table of values for the source attribute and their associated target attribute values,\nformatted as ["source_key1,target_value1", "source_key2,target_value2"]

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list\nor the default_lookup if not found in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 15

\n
\n

object

\n

Note: Reference Tables are in public beta.\nUse the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in a Reference Table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_enrichment_table [required]

\n
\n

string

\n

Name of the Reference Table for the source attribute and their associated target attribute values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 16

\n
\n

object

\n

There are two ways to improve correlation between application traces and logs.

\n
    \n

  1. Follow the documentation on how to inject a trace ID in the application logs\nand by default log integrations take care of all the rest of the setup.

    \n
    2. \n

  2. Use the Trace remapper processor to define a log attribute as its associated trace ID.

    \n
    3. \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources

\n
\n

[string]

\n

Array of source attributes.

default: dd.trace_id

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs trace remapper. \nAllowed enum values: trace-id-remapper

default: trace-id-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

A list of tags associated with the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

string

\n

Type of pipeline.

\n
\n \n
\n
" + "html": "
\n
\n
\n
\n

description

\n
\n

string

\n

A description of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

ID of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the pipeline is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_read_only

\n
\n

boolean

\n

Whether or not the pipeline can be edited.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Name of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[ <oneOf>]

\n

Ordered list of processors in this pipeline.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Create custom grok rules to parse the full message or a specific attribute of your raw event.\nFor more information, see the parsing section.

\n
\n
\n
\n
\n
\n

grok [required]

\n
\n

object

\n

Set of rules for the grok parser.

\n
\n
\n
\n
\n
\n

match_rules [required]

\n
\n

string

\n

List of match rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n

support_rules

\n
\n

string

\n

List of support rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

samples

\n
\n

[string]

\n

List of sample logs to test this grok parser.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Name of the log attribute to parse.

default: message

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs grok parser. \nAllowed enum values: grok-parser

default: grok-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

As Datadog receives logs, it timestamps them using the value(s) from any of these default attributes.

\n
    \n

  • timestamp

    \n
    • \n

  • date

    \n
    • \n

  • _timestamp

    \n
    • \n

  • Timestamp

    \n
    • \n

  • eventTime

    \n
    • \n

  • published_date

    \n

    If your logs put their dates in an attribute not in this list,\nuse the log date Remapper Processor to define their date attribute as the official log timestamp.\nThe recognized date formats are ISO8601, UNIX (the milliseconds EPOCH format), and RFC3164.

    \n
    • \n
\n

Note: If your logs don’t contain any of the default attributes\n and you haven’t defined your own date attribute, Datadog timestamps\n the logs with the date it received them.

\n

If multiple log date remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs date remapper. \nAllowed enum values: date-remapper

default: date-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 3

\n
\n

object

\n

Use this Processor if you want to assign some attributes as the official status.

\n

Each incoming status value is mapped as follows.

\n
    \n
  • Integers from 0 to 7 map to the Syslog severity standards
    • \n
  • Strings beginning with emerg or f (case-insensitive) map to emerg (0)
    • \n
  • Strings beginning with a (case-insensitive) map to alert (1)
    • \n
  • Strings beginning with c (case-insensitive) map to critical (2)
    • \n
  • Strings beginning with err (case-insensitive) map to error (3)
    • \n
  • Strings beginning with w (case-insensitive) map to warning (4)
    • \n
  • Strings beginning with n (case-insensitive) map to notice (5)
    • \n
  • Strings beginning with i (case-insensitive) map to info (6)
    • \n
  • Strings beginning with d, trace or verbose (case-insensitive) map to debug (7)
    • \n
  • Strings beginning with o or matching OK or Success (case-insensitive) map to OK
    • \n
  • All others map to info (6)
    • \n
\n

Note: If multiple log status remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs status remapper. \nAllowed enum values: status-remapper

default: status-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 4

\n
\n

object

\n

Use this processor if you want to assign one or more attributes as the official service.

\n

Note: If multiple service remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs service remapper. \nAllowed enum values: service-remapper

default: service-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 5

\n
\n

object

\n

The message is a key attribute in Datadog.\nIt is displayed in the message column of the Log Explorer and you can do full string search on it.\nUse this Processor to define one or more attributes as the official log message.

\n

Note: If multiple log message remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: msg

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs message remapper. \nAllowed enum values: message-remapper

default: message-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 6

\n
\n

object

\n

The remapper processor remaps any source attribute(s) or tag to another target attribute or tag.\nConstraints on the tag/attribute name are explained in the Tag Best Practice documentation.\nSome additional constraints are applied as : or , are not allowed in the target tag/attribute name.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

override_on_conflict

\n
\n

boolean

\n

Override or not the target element if already set,

\n
\n \n
\n
\n
\n
\n
\n

preserve_source

\n
\n

boolean

\n

Remove or preserve the remapped source element.

\n
\n \n
\n
\n
\n
\n
\n

source_type

\n
\n

string

\n

Defines if the sources are from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Final attribute or tag name to remap the sources to.

\n
\n \n
\n
\n
\n
\n
\n

target_format

\n
\n

enum

\n

If the target_type of the remapper is attribute, try to cast the value to a new specific type.\nIf the cast is not possible, the original type is kept. string, integer, or double are the possible types.\nIf the target_type is tag, this parameter may not be specified. \nAllowed enum values: auto,string,integer,double

\n
\n \n
\n
\n
\n
\n
\n

target_type

\n
\n

string

\n

Defines if the final attribute or tag name is from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs attribute remapper. \nAllowed enum values: attribute-remapper

default: attribute-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 7

\n
\n

object

\n

This processor extracts query parameters and other important parameters from a URL.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

normalize_ending_slashes

\n
\n

boolean

\n

Normalize the ending slashes or not.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.url

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.url_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs URL parser. \nAllowed enum values: url-parser

default: url-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 8

\n
\n

object

\n

The User-Agent parser takes a User-Agent attribute and extracts the OS, browser, device, and other user data.\nIt recognizes major bots like the Google Bot, Yahoo Slurp, and Bing.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_encoded

\n
\n

boolean

\n

Define if the source attribute is URL encoded or not.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.useragent

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.useragent_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs User-Agent parser. \nAllowed enum values: user-agent-parser

default: user-agent-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 9

\n
\n

object

\n

Use the Category Processor to add a new attribute (without spaces or special characters in the new attribute name)\nto a log matching a provided search query. Use categories to create groups for an analytical view.\nFor example, URL groups, machine groups, environments, and response time buckets.

\n

Notes:

\n
    \n
  • The syntax of the query is the one of Logs Explorer search bar.\nThe query can be done on any log attribute or tag, whether it is a facet or not.\nWildcards can also be used inside your query.
    • \n
  • Once the log has matched one of the Processor queries, it stops.\nMake sure they are properly ordered in case a log could match several queries.
    • \n
  • The names of the categories must be unique.
    • \n
  • Once defined in the Category Processor, you can map categories to log status using the Log Status Remapper.
    • \n
\n
\n
\n
\n
\n
\n

categories [required]

\n
\n

[object]

\n

Array of filters to match or not a log and their\ncorresponding name to assign a custom value to the log.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Value to assign to the target attribute.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the target attribute which value is defined by the matching category.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs category processor. \nAllowed enum values: category-processor

default: category-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 10

\n
\n

object

\n

Use the Arithmetic Processor to add a new attribute (without spaces or special characters\nin the new attribute name) to a log with the result of the provided formula.\nThis enables you to remap different time attributes with different units into a single attribute,\nor to compute operations on attributes within the same log.

\n

The formula can use parentheses and the basic arithmetic operators -, +, *, /.

\n

By default, the calculation is skipped if an attribute is missing.\nSelect “Replace missing attribute by 0” to automatically populate\nmissing attribute values with 0 to ensure that the calculation is done.\nAn attribute is missing if it is not found in the log attributes,\nor if it cannot be converted to a number.

\n

Notes:

\n
    \n
  • The operator - needs to be space split in the formula as it can also be contained in attribute names.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the formula.
    • \n
  • Results are rounded up to the 9th decimal. For example, if the result of the formula is 0.1234567891,\nthe actual value stored for the attribute is 0.123456789.
    • \n
  • If you need to scale a unit of measure,\nsee Scale Filter.
    • \n
\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Arithmetic operation between one or more log attributes.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of expression by 0, false\nskip the operation if an attribute is missing.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the result of the arithmetic operation.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs arithmetic processor. \nAllowed enum values: arithmetic-processor

default: arithmetic-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 11

\n
\n

object

\n

Use the string builder processor to add a new attribute (without spaces or special characters)\nto a log with the result of the provided template.\nThis enables aggregation of different attributes or raw strings into a single attribute.

\n

The template is defined by both raw text and blocks with the syntax %{attribute_path}.

\n

Notes:

\n
    \n
  • The processor only accepts attributes with values or an array of values in the blocks.
    • \n
  • If an attribute cannot be used (object or array of object),\nit is replaced by an empty string or the entire operation is skipped depending on your selection.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the template.
    • \n
  • Results of the template cannot exceed 256 characters.
    • \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of template by an empty string.\nIf false (default), skips the operation for missing attributes.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

The name of the attribute that contains the result of the template.

\n
\n \n
\n
\n
\n
\n
\n

template [required]

\n
\n

string

\n

A formula with one or more attributes and raw text.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs string builder processor. \nAllowed enum values: string-builder-processor

default: string-builder-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 12

\n
\n

object

\n

Nested Pipelines are pipelines within a pipeline. Use Nested Pipelines to split the processing into two steps.\nFor example, first use a high-level filtering such as team and then a second level of filtering based on the\nintegration, service, or any other tag or attribute.

\n

A pipeline can contain Nested Pipelines and Processors whereas a Nested Pipeline can only contain Processors.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[object]

\n

Ordered list of processors in this pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs pipeline processor. \nAllowed enum values: pipeline

default: pipeline

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 13

\n
\n

object

\n

The GeoIP parser takes an IP address attribute and extracts if available\nthe Continent, Country, Subdivision, and City information in the target attribute path.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: network.client.ip

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: network.client.geoip

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of GeoIP parser. \nAllowed enum values: geo-ip-parser

default: geo-ip-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 14

\n
\n

object

\n

Use the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in the processors mapping table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

default_lookup

\n
\n

string

\n

Value to set the target attribute if the source value is not found in the list.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_table [required]

\n
\n

[string]

\n

Mapping table of values for the source attribute and their associated target attribute values,\nformatted as ["source_key1,target_value1", "source_key2,target_value2"]

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list\nor the default_lookup if not found in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 15

\n
\n

object

\n

Note: Reference Tables are in public beta.\nUse the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in a Reference Table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_enrichment_table [required]

\n
\n

string

\n

Name of the Reference Table for the source attribute and their associated target attribute values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 16

\n
\n

object

\n

There are two ways to improve correlation between application traces and logs.

\n
    \n

  1. Follow the documentation on how to inject a trace ID in the application logs\nand by default log integrations take care of all the rest of the setup.

    \n
    2. \n

  2. Use the Trace remapper processor to define a log attribute as its associated trace ID.

    \n
    3. \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources

\n
\n

[string]

\n

Array of source attributes.

default: dd.trace_id

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs trace remapper. \nAllowed enum values: trace-id-remapper

default: trace-id-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 17

\n
\n

object

\n

There are two ways to define correlation between application spans and logs:

\n
    \n

  1. Follow the documentation on how to inject a span ID in the application logs.\nLog integrations automatically handle all remaining setup steps by default.

    \n
    2. \n

  2. Use the span remapper processor to define a log attribute as its associated span ID.

    \n
    3. \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources

\n
\n

[string]

\n

Array of source attributes.

default: dd.span_id

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs span remapper. \nAllowed enum values: span-id-remapper

default: span-id-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

A list of tags associated with the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

string

\n

Type of pipeline.

\n
\n \n
\n
" } }, "DeleteLogsPipeline": { @@ -310,7 +310,7 @@ "tags": [], "type": "pipeline" }, - "html": "
\n
\n
\n
\n

description

\n
\n

string

\n

A description of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

ID of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the pipeline is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_read_only

\n
\n

boolean

\n

Whether or not the pipeline can be edited.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Name of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[ <oneOf>]

\n

Ordered list of processors in this pipeline.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Create custom grok rules to parse the full message or a specific attribute of your raw event.\nFor more information, see the parsing section.

\n
\n
\n
\n
\n
\n

grok [required]

\n
\n

object

\n

Set of rules for the grok parser.

\n
\n
\n
\n
\n
\n

match_rules [required]

\n
\n

string

\n

List of match rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n

support_rules

\n
\n

string

\n

List of support rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

samples

\n
\n

[string]

\n

List of sample logs to test this grok parser.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Name of the log attribute to parse.

default: message

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs grok parser. \nAllowed enum values: grok-parser

default: grok-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

As Datadog receives logs, it timestamps them using the value(s) from any of these default attributes.

\n
    \n

  • timestamp

    \n
    • \n

  • date

    \n
    • \n

  • _timestamp

    \n
    • \n

  • Timestamp

    \n
    • \n

  • eventTime

    \n
    • \n

  • published_date

    \n

    If your logs put their dates in an attribute not in this list,\nuse the log date Remapper Processor to define their date attribute as the official log timestamp.\nThe recognized date formats are ISO8601, UNIX (the milliseconds EPOCH format), and RFC3164.

    \n
    • \n
\n

Note: If your logs don’t contain any of the default attributes\n and you haven’t defined your own date attribute, Datadog timestamps\n the logs with the date it received them.

\n

If multiple log date remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs date remapper. \nAllowed enum values: date-remapper

default: date-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 3

\n
\n

object

\n

Use this Processor if you want to assign some attributes as the official status.

\n

Each incoming status value is mapped as follows.

\n
    \n
  • Integers from 0 to 7 map to the Syslog severity standards
    • \n
  • Strings beginning with emerg or f (case-insensitive) map to emerg (0)
    • \n
  • Strings beginning with a (case-insensitive) map to alert (1)
    • \n
  • Strings beginning with c (case-insensitive) map to critical (2)
    • \n
  • Strings beginning with err (case-insensitive) map to error (3)
    • \n
  • Strings beginning with w (case-insensitive) map to warning (4)
    • \n
  • Strings beginning with n (case-insensitive) map to notice (5)
    • \n
  • Strings beginning with i (case-insensitive) map to info (6)
    • \n
  • Strings beginning with d, trace or verbose (case-insensitive) map to debug (7)
    • \n
  • Strings beginning with o or matching OK or Success (case-insensitive) map to OK
    • \n
  • All others map to info (6)
    • \n
\n

Note: If multiple log status remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs status remapper. \nAllowed enum values: status-remapper

default: status-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 4

\n
\n

object

\n

Use this processor if you want to assign one or more attributes as the official service.

\n

Note: If multiple service remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs service remapper. \nAllowed enum values: service-remapper

default: service-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 5

\n
\n

object

\n

The message is a key attribute in Datadog.\nIt is displayed in the message column of the Log Explorer and you can do full string search on it.\nUse this Processor to define one or more attributes as the official log message.

\n

Note: If multiple log message remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: msg

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs message remapper. \nAllowed enum values: message-remapper

default: message-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 6

\n
\n

object

\n

The remapper processor remaps any source attribute(s) or tag to another target attribute or tag.\nConstraints on the tag/attribute name are explained in the Tag Best Practice documentation.\nSome additional constraints are applied as : or , are not allowed in the target tag/attribute name.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

override_on_conflict

\n
\n

boolean

\n

Override or not the target element if already set,

\n
\n \n
\n
\n
\n
\n
\n

preserve_source

\n
\n

boolean

\n

Remove or preserve the remapped source element.

\n
\n \n
\n
\n
\n
\n
\n

source_type

\n
\n

string

\n

Defines if the sources are from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Final attribute or tag name to remap the sources to.

\n
\n \n
\n
\n
\n
\n
\n

target_format

\n
\n

enum

\n

If the target_type of the remapper is attribute, try to cast the value to a new specific type.\nIf the cast is not possible, the original type is kept. string, integer, or double are the possible types.\nIf the target_type is tag, this parameter may not be specified. \nAllowed enum values: auto,string,integer,double

\n
\n \n
\n
\n
\n
\n
\n

target_type

\n
\n

string

\n

Defines if the final attribute or tag name is from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs attribute remapper. \nAllowed enum values: attribute-remapper

default: attribute-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 7

\n
\n

object

\n

This processor extracts query parameters and other important parameters from a URL.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

normalize_ending_slashes

\n
\n

boolean

\n

Normalize the ending slashes or not.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.url

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.url_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs URL parser. \nAllowed enum values: url-parser

default: url-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 8

\n
\n

object

\n

The User-Agent parser takes a User-Agent attribute and extracts the OS, browser, device, and other user data.\nIt recognizes major bots like the Google Bot, Yahoo Slurp, and Bing.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_encoded

\n
\n

boolean

\n

Define if the source attribute is URL encoded or not.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.useragent

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.useragent_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs User-Agent parser. \nAllowed enum values: user-agent-parser

default: user-agent-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 9

\n
\n

object

\n

Use the Category Processor to add a new attribute (without spaces or special characters in the new attribute name)\nto a log matching a provided search query. Use categories to create groups for an analytical view.\nFor example, URL groups, machine groups, environments, and response time buckets.

\n

Notes:

\n
    \n
  • The syntax of the query is the one of Logs Explorer search bar.\nThe query can be done on any log attribute or tag, whether it is a facet or not.\nWildcards can also be used inside your query.
    • \n
  • Once the log has matched one of the Processor queries, it stops.\nMake sure they are properly ordered in case a log could match several queries.
    • \n
  • The names of the categories must be unique.
    • \n
  • Once defined in the Category Processor, you can map categories to log status using the Log Status Remapper.
    • \n
\n
\n
\n
\n
\n
\n

categories [required]

\n
\n

[object]

\n

Array of filters to match or not a log and their\ncorresponding name to assign a custom value to the log.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Value to assign to the target attribute.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the target attribute which value is defined by the matching category.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs category processor. \nAllowed enum values: category-processor

default: category-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 10

\n
\n

object

\n

Use the Arithmetic Processor to add a new attribute (without spaces or special characters\nin the new attribute name) to a log with the result of the provided formula.\nThis enables you to remap different time attributes with different units into a single attribute,\nor to compute operations on attributes within the same log.

\n

The formula can use parentheses and the basic arithmetic operators -, +, *, /.

\n

By default, the calculation is skipped if an attribute is missing.\nSelect “Replace missing attribute by 0” to automatically populate\nmissing attribute values with 0 to ensure that the calculation is done.\nAn attribute is missing if it is not found in the log attributes,\nor if it cannot be converted to a number.

\n

Notes:

\n
    \n
  • The operator - needs to be space split in the formula as it can also be contained in attribute names.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the formula.
    • \n
  • Results are rounded up to the 9th decimal. For example, if the result of the formula is 0.1234567891,\nthe actual value stored for the attribute is 0.123456789.
    • \n
  • If you need to scale a unit of measure,\nsee Scale Filter.
    • \n
\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Arithmetic operation between one or more log attributes.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of expression by 0, false\nskip the operation if an attribute is missing.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the result of the arithmetic operation.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs arithmetic processor. \nAllowed enum values: arithmetic-processor

default: arithmetic-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 11

\n
\n

object

\n

Use the string builder processor to add a new attribute (without spaces or special characters)\nto a log with the result of the provided template.\nThis enables aggregation of different attributes or raw strings into a single attribute.

\n

The template is defined by both raw text and blocks with the syntax %{attribute_path}.

\n

Notes:

\n
    \n
  • The processor only accepts attributes with values or an array of values in the blocks.
    • \n
  • If an attribute cannot be used (object or array of object),\nit is replaced by an empty string or the entire operation is skipped depending on your selection.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the template.
    • \n
  • Results of the template cannot exceed 256 characters.
    • \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of template by an empty string.\nIf false (default), skips the operation for missing attributes.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

The name of the attribute that contains the result of the template.

\n
\n \n
\n
\n
\n
\n
\n

template [required]

\n
\n

string

\n

A formula with one or more attributes and raw text.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs string builder processor. \nAllowed enum values: string-builder-processor

default: string-builder-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 12

\n
\n

object

\n

Nested Pipelines are pipelines within a pipeline. Use Nested Pipelines to split the processing into two steps.\nFor example, first use a high-level filtering such as team and then a second level of filtering based on the\nintegration, service, or any other tag or attribute.

\n

A pipeline can contain Nested Pipelines and Processors whereas a Nested Pipeline can only contain Processors.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[object]

\n

Ordered list of processors in this pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs pipeline processor. \nAllowed enum values: pipeline

default: pipeline

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 13

\n
\n

object

\n

The GeoIP parser takes an IP address attribute and extracts if available\nthe Continent, Country, Subdivision, and City information in the target attribute path.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: network.client.ip

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: network.client.geoip

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of GeoIP parser. \nAllowed enum values: geo-ip-parser

default: geo-ip-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 14

\n
\n

object

\n

Use the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in the processors mapping table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

default_lookup

\n
\n

string

\n

Value to set the target attribute if the source value is not found in the list.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_table [required]

\n
\n

[string]

\n

Mapping table of values for the source attribute and their associated target attribute values,\nformatted as ["source_key1,target_value1", "source_key2,target_value2"]

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list\nor the default_lookup if not found in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 15

\n
\n

object

\n

Note: Reference Tables are in public beta.\nUse the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in a Reference Table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_enrichment_table [required]

\n
\n

string

\n

Name of the Reference Table for the source attribute and their associated target attribute values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 16

\n
\n

object

\n

There are two ways to improve correlation between application traces and logs.

\n
    \n

  1. Follow the documentation on how to inject a trace ID in the application logs\nand by default log integrations take care of all the rest of the setup.

    \n
    2. \n

  2. Use the Trace remapper processor to define a log attribute as its associated trace ID.

    \n
    3. \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources

\n
\n

[string]

\n

Array of source attributes.

default: dd.trace_id

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs trace remapper. \nAllowed enum values: trace-id-remapper

default: trace-id-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

A list of tags associated with the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

string

\n

Type of pipeline.

\n
\n \n
\n
" + "html": "
\n
\n
\n
\n

description

\n
\n

string

\n

A description of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

ID of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the pipeline is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_read_only

\n
\n

boolean

\n

Whether or not the pipeline can be edited.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Name of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[ <oneOf>]

\n

Ordered list of processors in this pipeline.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Create custom grok rules to parse the full message or a specific attribute of your raw event.\nFor more information, see the parsing section.

\n
\n
\n
\n
\n
\n

grok [required]

\n
\n

object

\n

Set of rules for the grok parser.

\n
\n
\n
\n
\n
\n

match_rules [required]

\n
\n

string

\n

List of match rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n

support_rules

\n
\n

string

\n

List of support rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

samples

\n
\n

[string]

\n

List of sample logs to test this grok parser.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Name of the log attribute to parse.

default: message

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs grok parser. \nAllowed enum values: grok-parser

default: grok-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

As Datadog receives logs, it timestamps them using the value(s) from any of these default attributes.

\n
    \n

  • timestamp

    \n
    • \n

  • date

    \n
    • \n

  • _timestamp

    \n
    • \n

  • Timestamp

    \n
    • \n

  • eventTime

    \n
    • \n

  • published_date

    \n

    If your logs put their dates in an attribute not in this list,\nuse the log date Remapper Processor to define their date attribute as the official log timestamp.\nThe recognized date formats are ISO8601, UNIX (the milliseconds EPOCH format), and RFC3164.

    \n
    • \n
\n

Note: If your logs don’t contain any of the default attributes\n and you haven’t defined your own date attribute, Datadog timestamps\n the logs with the date it received them.

\n

If multiple log date remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs date remapper. \nAllowed enum values: date-remapper

default: date-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 3

\n
\n

object

\n

Use this Processor if you want to assign some attributes as the official status.

\n

Each incoming status value is mapped as follows.

\n
    \n
  • Integers from 0 to 7 map to the Syslog severity standards
    • \n
  • Strings beginning with emerg or f (case-insensitive) map to emerg (0)
    • \n
  • Strings beginning with a (case-insensitive) map to alert (1)
    • \n
  • Strings beginning with c (case-insensitive) map to critical (2)
    • \n
  • Strings beginning with err (case-insensitive) map to error (3)
    • \n
  • Strings beginning with w (case-insensitive) map to warning (4)
    • \n
  • Strings beginning with n (case-insensitive) map to notice (5)
    • \n
  • Strings beginning with i (case-insensitive) map to info (6)
    • \n
  • Strings beginning with d, trace or verbose (case-insensitive) map to debug (7)
    • \n
  • Strings beginning with o or matching OK or Success (case-insensitive) map to OK
    • \n
  • All others map to info (6)
    • \n
\n

Note: If multiple log status remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs status remapper. \nAllowed enum values: status-remapper

default: status-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 4

\n
\n

object

\n

Use this processor if you want to assign one or more attributes as the official service.

\n

Note: If multiple service remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs service remapper. \nAllowed enum values: service-remapper

default: service-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 5

\n
\n

object

\n

The message is a key attribute in Datadog.\nIt is displayed in the message column of the Log Explorer and you can do full string search on it.\nUse this Processor to define one or more attributes as the official log message.

\n

Note: If multiple log message remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: msg

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs message remapper. \nAllowed enum values: message-remapper

default: message-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 6

\n
\n

object

\n

The remapper processor remaps any source attribute(s) or tag to another target attribute or tag.\nConstraints on the tag/attribute name are explained in the Tag Best Practice documentation.\nSome additional constraints are applied as : or , are not allowed in the target tag/attribute name.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

override_on_conflict

\n
\n

boolean

\n

Override or not the target element if already set,

\n
\n \n
\n
\n
\n
\n
\n

preserve_source

\n
\n

boolean

\n

Remove or preserve the remapped source element.

\n
\n \n
\n
\n
\n
\n
\n

source_type

\n
\n

string

\n

Defines if the sources are from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Final attribute or tag name to remap the sources to.

\n
\n \n
\n
\n
\n
\n
\n

target_format

\n
\n

enum

\n

If the target_type of the remapper is attribute, try to cast the value to a new specific type.\nIf the cast is not possible, the original type is kept. string, integer, or double are the possible types.\nIf the target_type is tag, this parameter may not be specified. \nAllowed enum values: auto,string,integer,double

\n
\n \n
\n
\n
\n
\n
\n

target_type

\n
\n

string

\n

Defines if the final attribute or tag name is from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs attribute remapper. \nAllowed enum values: attribute-remapper

default: attribute-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 7

\n
\n

object

\n

This processor extracts query parameters and other important parameters from a URL.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

normalize_ending_slashes

\n
\n

boolean

\n

Normalize the ending slashes or not.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.url

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.url_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs URL parser. \nAllowed enum values: url-parser

default: url-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 8

\n
\n

object

\n

The User-Agent parser takes a User-Agent attribute and extracts the OS, browser, device, and other user data.\nIt recognizes major bots like the Google Bot, Yahoo Slurp, and Bing.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_encoded

\n
\n

boolean

\n

Define if the source attribute is URL encoded or not.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.useragent

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.useragent_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs User-Agent parser. \nAllowed enum values: user-agent-parser

default: user-agent-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 9

\n
\n

object

\n

Use the Category Processor to add a new attribute (without spaces or special characters in the new attribute name)\nto a log matching a provided search query. Use categories to create groups for an analytical view.\nFor example, URL groups, machine groups, environments, and response time buckets.

\n

Notes:

\n
    \n
  • The syntax of the query is the one of Logs Explorer search bar.\nThe query can be done on any log attribute or tag, whether it is a facet or not.\nWildcards can also be used inside your query.
    • \n
  • Once the log has matched one of the Processor queries, it stops.\nMake sure they are properly ordered in case a log could match several queries.
    • \n
  • The names of the categories must be unique.
    • \n
  • Once defined in the Category Processor, you can map categories to log status using the Log Status Remapper.
    • \n
\n
\n
\n
\n
\n
\n

categories [required]

\n
\n

[object]

\n

Array of filters to match or not a log and their\ncorresponding name to assign a custom value to the log.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Value to assign to the target attribute.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the target attribute which value is defined by the matching category.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs category processor. \nAllowed enum values: category-processor

default: category-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 10

\n
\n

object

\n

Use the Arithmetic Processor to add a new attribute (without spaces or special characters\nin the new attribute name) to a log with the result of the provided formula.\nThis enables you to remap different time attributes with different units into a single attribute,\nor to compute operations on attributes within the same log.

\n

The formula can use parentheses and the basic arithmetic operators -, +, *, /.

\n

By default, the calculation is skipped if an attribute is missing.\nSelect “Replace missing attribute by 0” to automatically populate\nmissing attribute values with 0 to ensure that the calculation is done.\nAn attribute is missing if it is not found in the log attributes,\nor if it cannot be converted to a number.

\n

Notes:

\n
    \n
  • The operator - needs to be space split in the formula as it can also be contained in attribute names.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the formula.
    • \n
  • Results are rounded up to the 9th decimal. For example, if the result of the formula is 0.1234567891,\nthe actual value stored for the attribute is 0.123456789.
    • \n
  • If you need to scale a unit of measure,\nsee Scale Filter.
    • \n
\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Arithmetic operation between one or more log attributes.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of expression by 0, false\nskip the operation if an attribute is missing.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the result of the arithmetic operation.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs arithmetic processor. \nAllowed enum values: arithmetic-processor

default: arithmetic-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 11

\n
\n

object

\n

Use the string builder processor to add a new attribute (without spaces or special characters)\nto a log with the result of the provided template.\nThis enables aggregation of different attributes or raw strings into a single attribute.

\n

The template is defined by both raw text and blocks with the syntax %{attribute_path}.

\n

Notes:

\n
    \n
  • The processor only accepts attributes with values or an array of values in the blocks.
    • \n
  • If an attribute cannot be used (object or array of object),\nit is replaced by an empty string or the entire operation is skipped depending on your selection.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the template.
    • \n
  • Results of the template cannot exceed 256 characters.
    • \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of template by an empty string.\nIf false (default), skips the operation for missing attributes.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

The name of the attribute that contains the result of the template.

\n
\n \n
\n
\n
\n
\n
\n

template [required]

\n
\n

string

\n

A formula with one or more attributes and raw text.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs string builder processor. \nAllowed enum values: string-builder-processor

default: string-builder-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 12

\n
\n

object

\n

Nested Pipelines are pipelines within a pipeline. Use Nested Pipelines to split the processing into two steps.\nFor example, first use a high-level filtering such as team and then a second level of filtering based on the\nintegration, service, or any other tag or attribute.

\n

A pipeline can contain Nested Pipelines and Processors whereas a Nested Pipeline can only contain Processors.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[object]

\n

Ordered list of processors in this pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs pipeline processor. \nAllowed enum values: pipeline

default: pipeline

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 13

\n
\n

object

\n

The GeoIP parser takes an IP address attribute and extracts if available\nthe Continent, Country, Subdivision, and City information in the target attribute path.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: network.client.ip

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: network.client.geoip

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of GeoIP parser. \nAllowed enum values: geo-ip-parser

default: geo-ip-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 14

\n
\n

object

\n

Use the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in the processors mapping table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

default_lookup

\n
\n

string

\n

Value to set the target attribute if the source value is not found in the list.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_table [required]

\n
\n

[string]

\n

Mapping table of values for the source attribute and their associated target attribute values,\nformatted as ["source_key1,target_value1", "source_key2,target_value2"]

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list\nor the default_lookup if not found in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 15

\n
\n

object

\n

Note: Reference Tables are in public beta.\nUse the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in a Reference Table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_enrichment_table [required]

\n
\n

string

\n

Name of the Reference Table for the source attribute and their associated target attribute values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 16

\n
\n

object

\n

There are two ways to improve correlation between application traces and logs.

\n
    \n

  1. Follow the documentation on how to inject a trace ID in the application logs\nand by default log integrations take care of all the rest of the setup.

    \n
    2. \n

  2. Use the Trace remapper processor to define a log attribute as its associated trace ID.

    \n
    3. \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources

\n
\n

[string]

\n

Array of source attributes.

default: dd.trace_id

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs trace remapper. \nAllowed enum values: trace-id-remapper

default: trace-id-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 17

\n
\n

object

\n

There are two ways to define correlation between application spans and logs:

\n
    \n

  1. Follow the documentation on how to inject a span ID in the application logs.\nLog integrations automatically handle all remaining setup steps by default.

    \n
    2. \n

  2. Use the span remapper processor to define a log attribute as its associated span ID.

    \n
    3. \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources

\n
\n

[string]

\n

Array of source attributes.

default: dd.span_id

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs span remapper. \nAllowed enum values: span-id-remapper

default: span-id-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

A list of tags associated with the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

string

\n

Type of pipeline.

\n
\n \n
\n
" }, "400": { "json": { @@ -373,7 +373,7 @@ "tags": [], "type": "pipeline" }, - "html": "
\n
\n
\n
\n

description

\n
\n

string

\n

A description of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

ID of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the pipeline is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_read_only

\n
\n

boolean

\n

Whether or not the pipeline can be edited.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Name of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[ <oneOf>]

\n

Ordered list of processors in this pipeline.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Create custom grok rules to parse the full message or a specific attribute of your raw event.\nFor more information, see the parsing section.

\n
\n
\n
\n
\n
\n

grok [required]

\n
\n

object

\n

Set of rules for the grok parser.

\n
\n
\n
\n
\n
\n

match_rules [required]

\n
\n

string

\n

List of match rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n

support_rules

\n
\n

string

\n

List of support rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

samples

\n
\n

[string]

\n

List of sample logs to test this grok parser.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Name of the log attribute to parse.

default: message

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs grok parser. \nAllowed enum values: grok-parser

default: grok-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

As Datadog receives logs, it timestamps them using the value(s) from any of these default attributes.

\n
    \n

  • timestamp

    \n
    • \n

  • date

    \n
    • \n

  • _timestamp

    \n
    • \n

  • Timestamp

    \n
    • \n

  • eventTime

    \n
    • \n

  • published_date

    \n

    If your logs put their dates in an attribute not in this list,\nuse the log date Remapper Processor to define their date attribute as the official log timestamp.\nThe recognized date formats are ISO8601, UNIX (the milliseconds EPOCH format), and RFC3164.

    \n
    • \n
\n

Note: If your logs don’t contain any of the default attributes\n and you haven’t defined your own date attribute, Datadog timestamps\n the logs with the date it received them.

\n

If multiple log date remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs date remapper. \nAllowed enum values: date-remapper

default: date-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 3

\n
\n

object

\n

Use this Processor if you want to assign some attributes as the official status.

\n

Each incoming status value is mapped as follows.

\n
    \n
  • Integers from 0 to 7 map to the Syslog severity standards
    • \n
  • Strings beginning with emerg or f (case-insensitive) map to emerg (0)
    • \n
  • Strings beginning with a (case-insensitive) map to alert (1)
    • \n
  • Strings beginning with c (case-insensitive) map to critical (2)
    • \n
  • Strings beginning with err (case-insensitive) map to error (3)
    • \n
  • Strings beginning with w (case-insensitive) map to warning (4)
    • \n
  • Strings beginning with n (case-insensitive) map to notice (5)
    • \n
  • Strings beginning with i (case-insensitive) map to info (6)
    • \n
  • Strings beginning with d, trace or verbose (case-insensitive) map to debug (7)
    • \n
  • Strings beginning with o or matching OK or Success (case-insensitive) map to OK
    • \n
  • All others map to info (6)
    • \n
\n

Note: If multiple log status remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs status remapper. \nAllowed enum values: status-remapper

default: status-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 4

\n
\n

object

\n

Use this processor if you want to assign one or more attributes as the official service.

\n

Note: If multiple service remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs service remapper. \nAllowed enum values: service-remapper

default: service-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 5

\n
\n

object

\n

The message is a key attribute in Datadog.\nIt is displayed in the message column of the Log Explorer and you can do full string search on it.\nUse this Processor to define one or more attributes as the official log message.

\n

Note: If multiple log message remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: msg

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs message remapper. \nAllowed enum values: message-remapper

default: message-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 6

\n
\n

object

\n

The remapper processor remaps any source attribute(s) or tag to another target attribute or tag.\nConstraints on the tag/attribute name are explained in the Tag Best Practice documentation.\nSome additional constraints are applied as : or , are not allowed in the target tag/attribute name.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

override_on_conflict

\n
\n

boolean

\n

Override or not the target element if already set,

\n
\n \n
\n
\n
\n
\n
\n

preserve_source

\n
\n

boolean

\n

Remove or preserve the remapped source element.

\n
\n \n
\n
\n
\n
\n
\n

source_type

\n
\n

string

\n

Defines if the sources are from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Final attribute or tag name to remap the sources to.

\n
\n \n
\n
\n
\n
\n
\n

target_format

\n
\n

enum

\n

If the target_type of the remapper is attribute, try to cast the value to a new specific type.\nIf the cast is not possible, the original type is kept. string, integer, or double are the possible types.\nIf the target_type is tag, this parameter may not be specified. \nAllowed enum values: auto,string,integer,double

\n
\n \n
\n
\n
\n
\n
\n

target_type

\n
\n

string

\n

Defines if the final attribute or tag name is from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs attribute remapper. \nAllowed enum values: attribute-remapper

default: attribute-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 7

\n
\n

object

\n

This processor extracts query parameters and other important parameters from a URL.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

normalize_ending_slashes

\n
\n

boolean

\n

Normalize the ending slashes or not.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.url

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.url_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs URL parser. \nAllowed enum values: url-parser

default: url-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 8

\n
\n

object

\n

The User-Agent parser takes a User-Agent attribute and extracts the OS, browser, device, and other user data.\nIt recognizes major bots like the Google Bot, Yahoo Slurp, and Bing.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_encoded

\n
\n

boolean

\n

Define if the source attribute is URL encoded or not.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.useragent

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.useragent_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs User-Agent parser. \nAllowed enum values: user-agent-parser

default: user-agent-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 9

\n
\n

object

\n

Use the Category Processor to add a new attribute (without spaces or special characters in the new attribute name)\nto a log matching a provided search query. Use categories to create groups for an analytical view.\nFor example, URL groups, machine groups, environments, and response time buckets.

\n

Notes:

\n
    \n
  • The syntax of the query is the one of Logs Explorer search bar.\nThe query can be done on any log attribute or tag, whether it is a facet or not.\nWildcards can also be used inside your query.
    • \n
  • Once the log has matched one of the Processor queries, it stops.\nMake sure they are properly ordered in case a log could match several queries.
    • \n
  • The names of the categories must be unique.
    • \n
  • Once defined in the Category Processor, you can map categories to log status using the Log Status Remapper.
    • \n
\n
\n
\n
\n
\n
\n

categories [required]

\n
\n

[object]

\n

Array of filters to match or not a log and their\ncorresponding name to assign a custom value to the log.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Value to assign to the target attribute.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the target attribute which value is defined by the matching category.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs category processor. \nAllowed enum values: category-processor

default: category-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 10

\n
\n

object

\n

Use the Arithmetic Processor to add a new attribute (without spaces or special characters\nin the new attribute name) to a log with the result of the provided formula.\nThis enables you to remap different time attributes with different units into a single attribute,\nor to compute operations on attributes within the same log.

\n

The formula can use parentheses and the basic arithmetic operators -, +, *, /.

\n

By default, the calculation is skipped if an attribute is missing.\nSelect “Replace missing attribute by 0” to automatically populate\nmissing attribute values with 0 to ensure that the calculation is done.\nAn attribute is missing if it is not found in the log attributes,\nor if it cannot be converted to a number.

\n

Notes:

\n
    \n
  • The operator - needs to be space split in the formula as it can also be contained in attribute names.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the formula.
    • \n
  • Results are rounded up to the 9th decimal. For example, if the result of the formula is 0.1234567891,\nthe actual value stored for the attribute is 0.123456789.
    • \n
  • If you need to scale a unit of measure,\nsee Scale Filter.
    • \n
\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Arithmetic operation between one or more log attributes.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of expression by 0, false\nskip the operation if an attribute is missing.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the result of the arithmetic operation.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs arithmetic processor. \nAllowed enum values: arithmetic-processor

default: arithmetic-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 11

\n
\n

object

\n

Use the string builder processor to add a new attribute (without spaces or special characters)\nto a log with the result of the provided template.\nThis enables aggregation of different attributes or raw strings into a single attribute.

\n

The template is defined by both raw text and blocks with the syntax %{attribute_path}.

\n

Notes:

\n
    \n
  • The processor only accepts attributes with values or an array of values in the blocks.
    • \n
  • If an attribute cannot be used (object or array of object),\nit is replaced by an empty string or the entire operation is skipped depending on your selection.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the template.
    • \n
  • Results of the template cannot exceed 256 characters.
    • \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of template by an empty string.\nIf false (default), skips the operation for missing attributes.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

The name of the attribute that contains the result of the template.

\n
\n \n
\n
\n
\n
\n
\n

template [required]

\n
\n

string

\n

A formula with one or more attributes and raw text.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs string builder processor. \nAllowed enum values: string-builder-processor

default: string-builder-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 12

\n
\n

object

\n

Nested Pipelines are pipelines within a pipeline. Use Nested Pipelines to split the processing into two steps.\nFor example, first use a high-level filtering such as team and then a second level of filtering based on the\nintegration, service, or any other tag or attribute.

\n

A pipeline can contain Nested Pipelines and Processors whereas a Nested Pipeline can only contain Processors.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[object]

\n

Ordered list of processors in this pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs pipeline processor. \nAllowed enum values: pipeline

default: pipeline

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 13

\n
\n

object

\n

The GeoIP parser takes an IP address attribute and extracts if available\nthe Continent, Country, Subdivision, and City information in the target attribute path.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: network.client.ip

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: network.client.geoip

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of GeoIP parser. \nAllowed enum values: geo-ip-parser

default: geo-ip-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 14

\n
\n

object

\n

Use the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in the processors mapping table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

default_lookup

\n
\n

string

\n

Value to set the target attribute if the source value is not found in the list.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_table [required]

\n
\n

[string]

\n

Mapping table of values for the source attribute and their associated target attribute values,\nformatted as ["source_key1,target_value1", "source_key2,target_value2"]

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list\nor the default_lookup if not found in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 15

\n
\n

object

\n

Note: Reference Tables are in public beta.\nUse the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in a Reference Table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_enrichment_table [required]

\n
\n

string

\n

Name of the Reference Table for the source attribute and their associated target attribute values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 16

\n
\n

object

\n

There are two ways to improve correlation between application traces and logs.

\n
    \n

  1. Follow the documentation on how to inject a trace ID in the application logs\nand by default log integrations take care of all the rest of the setup.

    \n
    2. \n

  2. Use the Trace remapper processor to define a log attribute as its associated trace ID.

    \n
    3. \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources

\n
\n

[string]

\n

Array of source attributes.

default: dd.trace_id

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs trace remapper. \nAllowed enum values: trace-id-remapper

default: trace-id-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

A list of tags associated with the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

string

\n

Type of pipeline.

\n
\n \n
\n
" + "html": "
\n
\n
\n
\n

description

\n
\n

string

\n

A description of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

ID of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the pipeline is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_read_only

\n
\n

boolean

\n

Whether or not the pipeline can be edited.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Name of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[ <oneOf>]

\n

Ordered list of processors in this pipeline.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Create custom grok rules to parse the full message or a specific attribute of your raw event.\nFor more information, see the parsing section.

\n
\n
\n
\n
\n
\n

grok [required]

\n
\n

object

\n

Set of rules for the grok parser.

\n
\n
\n
\n
\n
\n

match_rules [required]

\n
\n

string

\n

List of match rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n

support_rules

\n
\n

string

\n

List of support rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

samples

\n
\n

[string]

\n

List of sample logs to test this grok parser.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Name of the log attribute to parse.

default: message

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs grok parser. \nAllowed enum values: grok-parser

default: grok-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

As Datadog receives logs, it timestamps them using the value(s) from any of these default attributes.

\n
    \n

  • timestamp

    \n
    • \n

  • date

    \n
    • \n

  • _timestamp

    \n
    • \n

  • Timestamp

    \n
    • \n

  • eventTime

    \n
    • \n

  • published_date

    \n

    If your logs put their dates in an attribute not in this list,\nuse the log date Remapper Processor to define their date attribute as the official log timestamp.\nThe recognized date formats are ISO8601, UNIX (the milliseconds EPOCH format), and RFC3164.

    \n
    • \n
\n

Note: If your logs don’t contain any of the default attributes\n and you haven’t defined your own date attribute, Datadog timestamps\n the logs with the date it received them.

\n

If multiple log date remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs date remapper. \nAllowed enum values: date-remapper

default: date-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 3

\n
\n

object

\n

Use this Processor if you want to assign some attributes as the official status.

\n

Each incoming status value is mapped as follows.

\n
    \n
  • Integers from 0 to 7 map to the Syslog severity standards
    • \n
  • Strings beginning with emerg or f (case-insensitive) map to emerg (0)
    • \n
  • Strings beginning with a (case-insensitive) map to alert (1)
    • \n
  • Strings beginning with c (case-insensitive) map to critical (2)
    • \n
  • Strings beginning with err (case-insensitive) map to error (3)
    • \n
  • Strings beginning with w (case-insensitive) map to warning (4)
    • \n
  • Strings beginning with n (case-insensitive) map to notice (5)
    • \n
  • Strings beginning with i (case-insensitive) map to info (6)
    • \n
  • Strings beginning with d, trace or verbose (case-insensitive) map to debug (7)
    • \n
  • Strings beginning with o or matching OK or Success (case-insensitive) map to OK
    • \n
  • All others map to info (6)
    • \n
\n

Note: If multiple log status remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs status remapper. \nAllowed enum values: status-remapper

default: status-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 4

\n
\n

object

\n

Use this processor if you want to assign one or more attributes as the official service.

\n

Note: If multiple service remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs service remapper. \nAllowed enum values: service-remapper

default: service-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 5

\n
\n

object

\n

The message is a key attribute in Datadog.\nIt is displayed in the message column of the Log Explorer and you can do full string search on it.\nUse this Processor to define one or more attributes as the official log message.

\n

Note: If multiple log message remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: msg

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs message remapper. \nAllowed enum values: message-remapper

default: message-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 6

\n
\n

object

\n

The remapper processor remaps any source attribute(s) or tag to another target attribute or tag.\nConstraints on the tag/attribute name are explained in the Tag Best Practice documentation.\nSome additional constraints are applied as : or , are not allowed in the target tag/attribute name.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

override_on_conflict

\n
\n

boolean

\n

Override or not the target element if already set,

\n
\n \n
\n
\n
\n
\n
\n

preserve_source

\n
\n

boolean

\n

Remove or preserve the remapped source element.

\n
\n \n
\n
\n
\n
\n
\n

source_type

\n
\n

string

\n

Defines if the sources are from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Final attribute or tag name to remap the sources to.

\n
\n \n
\n
\n
\n
\n
\n

target_format

\n
\n

enum

\n

If the target_type of the remapper is attribute, try to cast the value to a new specific type.\nIf the cast is not possible, the original type is kept. string, integer, or double are the possible types.\nIf the target_type is tag, this parameter may not be specified. \nAllowed enum values: auto,string,integer,double

\n
\n \n
\n
\n
\n
\n
\n

target_type

\n
\n

string

\n

Defines if the final attribute or tag name is from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs attribute remapper. \nAllowed enum values: attribute-remapper

default: attribute-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 7

\n
\n

object

\n

This processor extracts query parameters and other important parameters from a URL.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

normalize_ending_slashes

\n
\n

boolean

\n

Normalize the ending slashes or not.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.url

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.url_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs URL parser. \nAllowed enum values: url-parser

default: url-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 8

\n
\n

object

\n

The User-Agent parser takes a User-Agent attribute and extracts the OS, browser, device, and other user data.\nIt recognizes major bots like the Google Bot, Yahoo Slurp, and Bing.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_encoded

\n
\n

boolean

\n

Define if the source attribute is URL encoded or not.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.useragent

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.useragent_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs User-Agent parser. \nAllowed enum values: user-agent-parser

default: user-agent-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 9

\n
\n

object

\n

Use the Category Processor to add a new attribute (without spaces or special characters in the new attribute name)\nto a log matching a provided search query. Use categories to create groups for an analytical view.\nFor example, URL groups, machine groups, environments, and response time buckets.

\n

Notes:

\n
    \n
  • The syntax of the query is the one of Logs Explorer search bar.\nThe query can be done on any log attribute or tag, whether it is a facet or not.\nWildcards can also be used inside your query.
    • \n
  • Once the log has matched one of the Processor queries, it stops.\nMake sure they are properly ordered in case a log could match several queries.
    • \n
  • The names of the categories must be unique.
    • \n
  • Once defined in the Category Processor, you can map categories to log status using the Log Status Remapper.
    • \n
\n
\n
\n
\n
\n
\n

categories [required]

\n
\n

[object]

\n

Array of filters to match or not a log and their\ncorresponding name to assign a custom value to the log.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Value to assign to the target attribute.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the target attribute which value is defined by the matching category.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs category processor. \nAllowed enum values: category-processor

default: category-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 10

\n
\n

object

\n

Use the Arithmetic Processor to add a new attribute (without spaces or special characters\nin the new attribute name) to a log with the result of the provided formula.\nThis enables you to remap different time attributes with different units into a single attribute,\nor to compute operations on attributes within the same log.

\n

The formula can use parentheses and the basic arithmetic operators -, +, *, /.

\n

By default, the calculation is skipped if an attribute is missing.\nSelect “Replace missing attribute by 0” to automatically populate\nmissing attribute values with 0 to ensure that the calculation is done.\nAn attribute is missing if it is not found in the log attributes,\nor if it cannot be converted to a number.

\n

Notes:

\n
    \n
  • The operator - needs to be space split in the formula as it can also be contained in attribute names.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the formula.
    • \n
  • Results are rounded up to the 9th decimal. For example, if the result of the formula is 0.1234567891,\nthe actual value stored for the attribute is 0.123456789.
    • \n
  • If you need to scale a unit of measure,\nsee Scale Filter.
    • \n
\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Arithmetic operation between one or more log attributes.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of expression by 0, false\nskip the operation if an attribute is missing.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the result of the arithmetic operation.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs arithmetic processor. \nAllowed enum values: arithmetic-processor

default: arithmetic-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 11

\n
\n

object

\n

Use the string builder processor to add a new attribute (without spaces or special characters)\nto a log with the result of the provided template.\nThis enables aggregation of different attributes or raw strings into a single attribute.

\n

The template is defined by both raw text and blocks with the syntax %{attribute_path}.

\n

Notes:

\n
    \n
  • The processor only accepts attributes with values or an array of values in the blocks.
    • \n
  • If an attribute cannot be used (object or array of object),\nit is replaced by an empty string or the entire operation is skipped depending on your selection.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the template.
    • \n
  • Results of the template cannot exceed 256 characters.
    • \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of template by an empty string.\nIf false (default), skips the operation for missing attributes.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

The name of the attribute that contains the result of the template.

\n
\n \n
\n
\n
\n
\n
\n

template [required]

\n
\n

string

\n

A formula with one or more attributes and raw text.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs string builder processor. \nAllowed enum values: string-builder-processor

default: string-builder-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 12

\n
\n

object

\n

Nested Pipelines are pipelines within a pipeline. Use Nested Pipelines to split the processing into two steps.\nFor example, first use a high-level filtering such as team and then a second level of filtering based on the\nintegration, service, or any other tag or attribute.

\n

A pipeline can contain Nested Pipelines and Processors whereas a Nested Pipeline can only contain Processors.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[object]

\n

Ordered list of processors in this pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs pipeline processor. \nAllowed enum values: pipeline

default: pipeline

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 13

\n
\n

object

\n

The GeoIP parser takes an IP address attribute and extracts if available\nthe Continent, Country, Subdivision, and City information in the target attribute path.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: network.client.ip

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: network.client.geoip

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of GeoIP parser. \nAllowed enum values: geo-ip-parser

default: geo-ip-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 14

\n
\n

object

\n

Use the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in the processors mapping table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

default_lookup

\n
\n

string

\n

Value to set the target attribute if the source value is not found in the list.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_table [required]

\n
\n

[string]

\n

Mapping table of values for the source attribute and their associated target attribute values,\nformatted as ["source_key1,target_value1", "source_key2,target_value2"]

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list\nor the default_lookup if not found in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 15

\n
\n

object

\n

Note: Reference Tables are in public beta.\nUse the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in a Reference Table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_enrichment_table [required]

\n
\n

string

\n

Name of the Reference Table for the source attribute and their associated target attribute values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 16

\n
\n

object

\n

There are two ways to improve correlation between application traces and logs.

\n
    \n

  1. Follow the documentation on how to inject a trace ID in the application logs\nand by default log integrations take care of all the rest of the setup.

    \n
    2. \n

  2. Use the Trace remapper processor to define a log attribute as its associated trace ID.

    \n
    3. \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources

\n
\n

[string]

\n

Array of source attributes.

default: dd.trace_id

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs trace remapper. \nAllowed enum values: trace-id-remapper

default: trace-id-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 17

\n
\n

object

\n

There are two ways to define correlation between application spans and logs:

\n
    \n

  1. Follow the documentation on how to inject a span ID in the application logs.\nLog integrations automatically handle all remaining setup steps by default.

    \n
    2. \n

  2. Use the span remapper processor to define a log attribute as its associated span ID.

    \n
    3. \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources

\n
\n

[string]

\n

Array of source attributes.

default: dd.span_id

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs span remapper. \nAllowed enum values: span-id-remapper

default: span-id-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

A list of tags associated with the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

string

\n

Type of pipeline.

\n
\n \n
\n
" }, "400": { "json": { @@ -435,7 +435,7 @@ ], "tags": [] }, - "html": "
\n
\n
\n
\n

description

\n
\n

string

\n

A description of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

ID of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the pipeline is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_read_only

\n
\n

boolean

\n

Whether or not the pipeline can be edited.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Name of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[ <oneOf>]

\n

Ordered list of processors in this pipeline.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Create custom grok rules to parse the full message or a specific attribute of your raw event.\nFor more information, see the parsing section.

\n
\n
\n
\n
\n
\n

grok [required]

\n
\n

object

\n

Set of rules for the grok parser.

\n
\n
\n
\n
\n
\n

match_rules [required]

\n
\n

string

\n

List of match rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n

support_rules

\n
\n

string

\n

List of support rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

samples

\n
\n

[string]

\n

List of sample logs to test this grok parser.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Name of the log attribute to parse.

default: message

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs grok parser. \nAllowed enum values: grok-parser

default: grok-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

As Datadog receives logs, it timestamps them using the value(s) from any of these default attributes.

\n
    \n

  • timestamp

    \n
    • \n

  • date

    \n
    • \n

  • _timestamp

    \n
    • \n

  • Timestamp

    \n
    • \n

  • eventTime

    \n
    • \n

  • published_date

    \n

    If your logs put their dates in an attribute not in this list,\nuse the log date Remapper Processor to define their date attribute as the official log timestamp.\nThe recognized date formats are ISO8601, UNIX (the milliseconds EPOCH format), and RFC3164.

    \n
    • \n
\n

Note: If your logs don’t contain any of the default attributes\n and you haven’t defined your own date attribute, Datadog timestamps\n the logs with the date it received them.

\n

If multiple log date remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs date remapper. \nAllowed enum values: date-remapper

default: date-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 3

\n
\n

object

\n

Use this Processor if you want to assign some attributes as the official status.

\n

Each incoming status value is mapped as follows.

\n
    \n
  • Integers from 0 to 7 map to the Syslog severity standards
    • \n
  • Strings beginning with emerg or f (case-insensitive) map to emerg (0)
    • \n
  • Strings beginning with a (case-insensitive) map to alert (1)
    • \n
  • Strings beginning with c (case-insensitive) map to critical (2)
    • \n
  • Strings beginning with err (case-insensitive) map to error (3)
    • \n
  • Strings beginning with w (case-insensitive) map to warning (4)
    • \n
  • Strings beginning with n (case-insensitive) map to notice (5)
    • \n
  • Strings beginning with i (case-insensitive) map to info (6)
    • \n
  • Strings beginning with d, trace or verbose (case-insensitive) map to debug (7)
    • \n
  • Strings beginning with o or matching OK or Success (case-insensitive) map to OK
    • \n
  • All others map to info (6)
    • \n
\n

Note: If multiple log status remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs status remapper. \nAllowed enum values: status-remapper

default: status-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 4

\n
\n

object

\n

Use this processor if you want to assign one or more attributes as the official service.

\n

Note: If multiple service remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs service remapper. \nAllowed enum values: service-remapper

default: service-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 5

\n
\n

object

\n

The message is a key attribute in Datadog.\nIt is displayed in the message column of the Log Explorer and you can do full string search on it.\nUse this Processor to define one or more attributes as the official log message.

\n

Note: If multiple log message remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: msg

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs message remapper. \nAllowed enum values: message-remapper

default: message-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 6

\n
\n

object

\n

The remapper processor remaps any source attribute(s) or tag to another target attribute or tag.\nConstraints on the tag/attribute name are explained in the Tag Best Practice documentation.\nSome additional constraints are applied as : or , are not allowed in the target tag/attribute name.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

override_on_conflict

\n
\n

boolean

\n

Override or not the target element if already set,

\n
\n \n
\n
\n
\n
\n
\n

preserve_source

\n
\n

boolean

\n

Remove or preserve the remapped source element.

\n
\n \n
\n
\n
\n
\n
\n

source_type

\n
\n

string

\n

Defines if the sources are from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Final attribute or tag name to remap the sources to.

\n
\n \n
\n
\n
\n
\n
\n

target_format

\n
\n

enum

\n

If the target_type of the remapper is attribute, try to cast the value to a new specific type.\nIf the cast is not possible, the original type is kept. string, integer, or double are the possible types.\nIf the target_type is tag, this parameter may not be specified. \nAllowed enum values: auto,string,integer,double

\n
\n \n
\n
\n
\n
\n
\n

target_type

\n
\n

string

\n

Defines if the final attribute or tag name is from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs attribute remapper. \nAllowed enum values: attribute-remapper

default: attribute-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 7

\n
\n

object

\n

This processor extracts query parameters and other important parameters from a URL.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

normalize_ending_slashes

\n
\n

boolean

\n

Normalize the ending slashes or not.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.url

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.url_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs URL parser. \nAllowed enum values: url-parser

default: url-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 8

\n
\n

object

\n

The User-Agent parser takes a User-Agent attribute and extracts the OS, browser, device, and other user data.\nIt recognizes major bots like the Google Bot, Yahoo Slurp, and Bing.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_encoded

\n
\n

boolean

\n

Define if the source attribute is URL encoded or not.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.useragent

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.useragent_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs User-Agent parser. \nAllowed enum values: user-agent-parser

default: user-agent-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 9

\n
\n

object

\n

Use the Category Processor to add a new attribute (without spaces or special characters in the new attribute name)\nto a log matching a provided search query. Use categories to create groups for an analytical view.\nFor example, URL groups, machine groups, environments, and response time buckets.

\n

Notes:

\n
    \n
  • The syntax of the query is the one of Logs Explorer search bar.\nThe query can be done on any log attribute or tag, whether it is a facet or not.\nWildcards can also be used inside your query.
    • \n
  • Once the log has matched one of the Processor queries, it stops.\nMake sure they are properly ordered in case a log could match several queries.
    • \n
  • The names of the categories must be unique.
    • \n
  • Once defined in the Category Processor, you can map categories to log status using the Log Status Remapper.
    • \n
\n
\n
\n
\n
\n
\n

categories [required]

\n
\n

[object]

\n

Array of filters to match or not a log and their\ncorresponding name to assign a custom value to the log.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Value to assign to the target attribute.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the target attribute which value is defined by the matching category.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs category processor. \nAllowed enum values: category-processor

default: category-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 10

\n
\n

object

\n

Use the Arithmetic Processor to add a new attribute (without spaces or special characters\nin the new attribute name) to a log with the result of the provided formula.\nThis enables you to remap different time attributes with different units into a single attribute,\nor to compute operations on attributes within the same log.

\n

The formula can use parentheses and the basic arithmetic operators -, +, *, /.

\n

By default, the calculation is skipped if an attribute is missing.\nSelect “Replace missing attribute by 0” to automatically populate\nmissing attribute values with 0 to ensure that the calculation is done.\nAn attribute is missing if it is not found in the log attributes,\nor if it cannot be converted to a number.

\n

Notes:

\n
    \n
  • The operator - needs to be space split in the formula as it can also be contained in attribute names.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the formula.
    • \n
  • Results are rounded up to the 9th decimal. For example, if the result of the formula is 0.1234567891,\nthe actual value stored for the attribute is 0.123456789.
    • \n
  • If you need to scale a unit of measure,\nsee Scale Filter.
    • \n
\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Arithmetic operation between one or more log attributes.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of expression by 0, false\nskip the operation if an attribute is missing.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the result of the arithmetic operation.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs arithmetic processor. \nAllowed enum values: arithmetic-processor

default: arithmetic-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 11

\n
\n

object

\n

Use the string builder processor to add a new attribute (without spaces or special characters)\nto a log with the result of the provided template.\nThis enables aggregation of different attributes or raw strings into a single attribute.

\n

The template is defined by both raw text and blocks with the syntax %{attribute_path}.

\n

Notes:

\n
    \n
  • The processor only accepts attributes with values or an array of values in the blocks.
    • \n
  • If an attribute cannot be used (object or array of object),\nit is replaced by an empty string or the entire operation is skipped depending on your selection.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the template.
    • \n
  • Results of the template cannot exceed 256 characters.
    • \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of template by an empty string.\nIf false (default), skips the operation for missing attributes.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

The name of the attribute that contains the result of the template.

\n
\n \n
\n
\n
\n
\n
\n

template [required]

\n
\n

string

\n

A formula with one or more attributes and raw text.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs string builder processor. \nAllowed enum values: string-builder-processor

default: string-builder-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 12

\n
\n

object

\n

Nested Pipelines are pipelines within a pipeline. Use Nested Pipelines to split the processing into two steps.\nFor example, first use a high-level filtering such as team and then a second level of filtering based on the\nintegration, service, or any other tag or attribute.

\n

A pipeline can contain Nested Pipelines and Processors whereas a Nested Pipeline can only contain Processors.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[object]

\n

Ordered list of processors in this pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs pipeline processor. \nAllowed enum values: pipeline

default: pipeline

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 13

\n
\n

object

\n

The GeoIP parser takes an IP address attribute and extracts if available\nthe Continent, Country, Subdivision, and City information in the target attribute path.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: network.client.ip

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: network.client.geoip

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of GeoIP parser. \nAllowed enum values: geo-ip-parser

default: geo-ip-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 14

\n
\n

object

\n

Use the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in the processors mapping table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

default_lookup

\n
\n

string

\n

Value to set the target attribute if the source value is not found in the list.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_table [required]

\n
\n

[string]

\n

Mapping table of values for the source attribute and their associated target attribute values,\nformatted as ["source_key1,target_value1", "source_key2,target_value2"]

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list\nor the default_lookup if not found in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 15

\n
\n

object

\n

Note: Reference Tables are in public beta.\nUse the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in a Reference Table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_enrichment_table [required]

\n
\n

string

\n

Name of the Reference Table for the source attribute and their associated target attribute values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 16

\n
\n

object

\n

There are two ways to improve correlation between application traces and logs.

\n
    \n

  1. Follow the documentation on how to inject a trace ID in the application logs\nand by default log integrations take care of all the rest of the setup.

    \n
    2. \n

  2. Use the Trace remapper processor to define a log attribute as its associated trace ID.

    \n
    3. \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources

\n
\n

[string]

\n

Array of source attributes.

default: dd.trace_id

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs trace remapper. \nAllowed enum values: trace-id-remapper

default: trace-id-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

A list of tags associated with the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

string

\n

Type of pipeline.

\n
\n \n
\n
" + "html": "
\n
\n
\n
\n

description

\n
\n

string

\n

A description of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

ID of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the pipeline is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_read_only

\n
\n

boolean

\n

Whether or not the pipeline can be edited.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Name of the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[ <oneOf>]

\n

Ordered list of processors in this pipeline.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Create custom grok rules to parse the full message or a specific attribute of your raw event.\nFor more information, see the parsing section.

\n
\n
\n
\n
\n
\n

grok [required]

\n
\n

object

\n

Set of rules for the grok parser.

\n
\n
\n
\n
\n
\n

match_rules [required]

\n
\n

string

\n

List of match rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n

support_rules

\n
\n

string

\n

List of support rules for the grok parser, separated by a new line.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

samples

\n
\n

[string]

\n

List of sample logs to test this grok parser.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Name of the log attribute to parse.

default: message

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs grok parser. \nAllowed enum values: grok-parser

default: grok-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

As Datadog receives logs, it timestamps them using the value(s) from any of these default attributes.

\n
    \n

  • timestamp

    \n
    • \n

  • date

    \n
    • \n

  • _timestamp

    \n
    • \n

  • Timestamp

    \n
    • \n

  • eventTime

    \n
    • \n

  • published_date

    \n

    If your logs put their dates in an attribute not in this list,\nuse the log date Remapper Processor to define their date attribute as the official log timestamp.\nThe recognized date formats are ISO8601, UNIX (the milliseconds EPOCH format), and RFC3164.

    \n
    • \n
\n

Note: If your logs don’t contain any of the default attributes\n and you haven’t defined your own date attribute, Datadog timestamps\n the logs with the date it received them.

\n

If multiple log date remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs date remapper. \nAllowed enum values: date-remapper

default: date-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 3

\n
\n

object

\n

Use this Processor if you want to assign some attributes as the official status.

\n

Each incoming status value is mapped as follows.

\n
    \n
  • Integers from 0 to 7 map to the Syslog severity standards
    • \n
  • Strings beginning with emerg or f (case-insensitive) map to emerg (0)
    • \n
  • Strings beginning with a (case-insensitive) map to alert (1)
    • \n
  • Strings beginning with c (case-insensitive) map to critical (2)
    • \n
  • Strings beginning with err (case-insensitive) map to error (3)
    • \n
  • Strings beginning with w (case-insensitive) map to warning (4)
    • \n
  • Strings beginning with n (case-insensitive) map to notice (5)
    • \n
  • Strings beginning with i (case-insensitive) map to info (6)
    • \n
  • Strings beginning with d, trace or verbose (case-insensitive) map to debug (7)
    • \n
  • Strings beginning with o or matching OK or Success (case-insensitive) map to OK
    • \n
  • All others map to info (6)
    • \n
\n

Note: If multiple log status remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs status remapper. \nAllowed enum values: status-remapper

default: status-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 4

\n
\n

object

\n

Use this processor if you want to assign one or more attributes as the official service.

\n

Note: If multiple service remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs service remapper. \nAllowed enum values: service-remapper

default: service-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 5

\n
\n

object

\n

The message is a key attribute in Datadog.\nIt is displayed in the message column of the Log Explorer and you can do full string search on it.\nUse this Processor to define one or more attributes as the official log message.

\n

Note: If multiple log message remapper processors can be applied to a given log,\nonly the first one (according to the pipeline order) is taken into account.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: msg

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs message remapper. \nAllowed enum values: message-remapper

default: message-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 6

\n
\n

object

\n

The remapper processor remaps any source attribute(s) or tag to another target attribute or tag.\nConstraints on the tag/attribute name are explained in the Tag Best Practice documentation.\nSome additional constraints are applied as : or , are not allowed in the target tag/attribute name.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

override_on_conflict

\n
\n

boolean

\n

Override or not the target element if already set,

\n
\n \n
\n
\n
\n
\n
\n

preserve_source

\n
\n

boolean

\n

Remove or preserve the remapped source element.

\n
\n \n
\n
\n
\n
\n
\n

source_type

\n
\n

string

\n

Defines if the sources are from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Final attribute or tag name to remap the sources to.

\n
\n \n
\n
\n
\n
\n
\n

target_format

\n
\n

enum

\n

If the target_type of the remapper is attribute, try to cast the value to a new specific type.\nIf the cast is not possible, the original type is kept. string, integer, or double are the possible types.\nIf the target_type is tag, this parameter may not be specified. \nAllowed enum values: auto,string,integer,double

\n
\n \n
\n
\n
\n
\n
\n

target_type

\n
\n

string

\n

Defines if the final attribute or tag name is from log attribute or tag.

default: attribute

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs attribute remapper. \nAllowed enum values: attribute-remapper

default: attribute-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 7

\n
\n

object

\n

This processor extracts query parameters and other important parameters from a URL.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

normalize_ending_slashes

\n
\n

boolean

\n

Normalize the ending slashes or not.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.url

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.url_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs URL parser. \nAllowed enum values: url-parser

default: url-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 8

\n
\n

object

\n

The User-Agent parser takes a User-Agent attribute and extracts the OS, browser, device, and other user data.\nIt recognizes major bots like the Google Bot, Yahoo Slurp, and Bing.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_encoded

\n
\n

boolean

\n

Define if the source attribute is URL encoded or not.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: http.useragent

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: http.useragent_details

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs User-Agent parser. \nAllowed enum values: user-agent-parser

default: user-agent-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 9

\n
\n

object

\n

Use the Category Processor to add a new attribute (without spaces or special characters in the new attribute name)\nto a log matching a provided search query. Use categories to create groups for an analytical view.\nFor example, URL groups, machine groups, environments, and response time buckets.

\n

Notes:

\n
    \n
  • The syntax of the query is the one of Logs Explorer search bar.\nThe query can be done on any log attribute or tag, whether it is a facet or not.\nWildcards can also be used inside your query.
    • \n
  • Once the log has matched one of the Processor queries, it stops.\nMake sure they are properly ordered in case a log could match several queries.
    • \n
  • The names of the categories must be unique.
    • \n
  • Once defined in the Category Processor, you can map categories to log status using the Log Status Remapper.
    • \n
\n
\n
\n
\n
\n
\n

categories [required]

\n
\n

[object]

\n

Array of filters to match or not a log and their\ncorresponding name to assign a custom value to the log.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Value to assign to the target attribute.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the target attribute which value is defined by the matching category.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs category processor. \nAllowed enum values: category-processor

default: category-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 10

\n
\n

object

\n

Use the Arithmetic Processor to add a new attribute (without spaces or special characters\nin the new attribute name) to a log with the result of the provided formula.\nThis enables you to remap different time attributes with different units into a single attribute,\nor to compute operations on attributes within the same log.

\n

The formula can use parentheses and the basic arithmetic operators -, +, *, /.

\n

By default, the calculation is skipped if an attribute is missing.\nSelect “Replace missing attribute by 0” to automatically populate\nmissing attribute values with 0 to ensure that the calculation is done.\nAn attribute is missing if it is not found in the log attributes,\nor if it cannot be converted to a number.

\n

Notes:

\n
    \n
  • The operator - needs to be space split in the formula as it can also be contained in attribute names.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the formula.
    • \n
  • Results are rounded up to the 9th decimal. For example, if the result of the formula is 0.1234567891,\nthe actual value stored for the attribute is 0.123456789.
    • \n
  • If you need to scale a unit of measure,\nsee Scale Filter.
    • \n
\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Arithmetic operation between one or more log attributes.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of expression by 0, false\nskip the operation if an attribute is missing.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the result of the arithmetic operation.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs arithmetic processor. \nAllowed enum values: arithmetic-processor

default: arithmetic-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 11

\n
\n

object

\n

Use the string builder processor to add a new attribute (without spaces or special characters)\nto a log with the result of the provided template.\nThis enables aggregation of different attributes or raw strings into a single attribute.

\n

The template is defined by both raw text and blocks with the syntax %{attribute_path}.

\n

Notes:

\n
    \n
  • The processor only accepts attributes with values or an array of values in the blocks.
    • \n
  • If an attribute cannot be used (object or array of object),\nit is replaced by an empty string or the entire operation is skipped depending on your selection.
    • \n
  • If the target attribute already exists, it is overwritten by the result of the template.
    • \n
  • Results of the template cannot exceed 256 characters.
    • \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

is_replace_missing

\n
\n

boolean

\n

If true, it replaces all missing attributes of template by an empty string.\nIf false (default), skips the operation for missing attributes.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

The name of the attribute that contains the result of the template.

\n
\n \n
\n
\n
\n
\n
\n

template [required]

\n
\n

string

\n

A formula with one or more attributes and raw text.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs string builder processor. \nAllowed enum values: string-builder-processor

default: string-builder-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 12

\n
\n

object

\n

Nested Pipelines are pipelines within a pipeline. Use Nested Pipelines to split the processing into two steps.\nFor example, first use a high-level filtering such as team and then a second level of filtering based on the\nintegration, service, or any other tag or attribute.

\n

A pipeline can contain Nested Pipelines and Processors whereas a Nested Pipeline can only contain Processors.

\n
\n
\n
\n
\n
\n

filter

\n
\n

object

\n

Filter for logs.

\n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

The filter query.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

processors

\n
\n

[object]

\n

Ordered list of processors in this pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs pipeline processor. \nAllowed enum values: pipeline

default: pipeline

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 13

\n
\n

object

\n

The GeoIP parser takes an IP address attribute and extracts if available\nthe Continent, Country, Subdivision, and City information in the target attribute path.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources [required]

\n
\n

[string]

\n

Array of source attributes.

default: network.client.ip

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the parent attribute that contains all the extracted details from the sources.

default: network.client.geoip

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of GeoIP parser. \nAllowed enum values: geo-ip-parser

default: geo-ip-parser

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 14

\n
\n

object

\n

Use the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in the processors mapping table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

default_lookup

\n
\n

string

\n

Value to set the target attribute if the source value is not found in the list.

\n
\n \n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_table [required]

\n
\n

[string]

\n

Mapping table of values for the source attribute and their associated target attribute values,\nformatted as ["source_key1,target_value1", "source_key2,target_value2"]

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list\nor the default_lookup if not found in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 15

\n
\n

object

\n

Note: Reference Tables are in public beta.\nUse the Lookup Processor to define a mapping between a log attribute\nand a human readable value saved in a Reference Table.\nFor example, you can use the Lookup Processor to map an internal service ID\ninto a human readable service name. Alternatively, you could also use it to check\nif the MAC address that just attempted to connect to the production\nenvironment belongs to your list of stolen machines.

\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

lookup_enrichment_table [required]

\n
\n

string

\n

Name of the Reference Table for the source attribute and their associated target attribute values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

source [required]

\n
\n

string

\n

Source attribute used to perform the lookup.

\n
\n \n
\n
\n
\n
\n
\n

target [required]

\n
\n

string

\n

Name of the attribute that contains the corresponding value in the mapping list.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs lookup processor. \nAllowed enum values: lookup-processor

default: lookup-processor

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 16

\n
\n

object

\n

There are two ways to improve correlation between application traces and logs.

\n
    \n

  1. Follow the documentation on how to inject a trace ID in the application logs\nand by default log integrations take care of all the rest of the setup.

    \n
    2. \n

  2. Use the Trace remapper processor to define a log attribute as its associated trace ID.

    \n
    3. \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources

\n
\n

[string]

\n

Array of source attributes.

default: dd.trace_id

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs trace remapper. \nAllowed enum values: trace-id-remapper

default: trace-id-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 17

\n
\n

object

\n

There are two ways to define correlation between application spans and logs:

\n
    \n

  1. Follow the documentation on how to inject a span ID in the application logs.\nLog integrations automatically handle all remaining setup steps by default.

    \n
    2. \n

  2. Use the span remapper processor to define a log attribute as its associated span ID.

    \n
    3. \n
\n
\n
\n
\n
\n
\n

is_enabled

\n
\n

boolean

\n

Whether or not the processor is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the processor.

\n
\n \n
\n
\n
\n
\n
\n

sources

\n
\n

[string]

\n

Array of source attributes.

default: dd.span_id

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of logs span remapper. \nAllowed enum values: span-id-remapper

default: span-id-remapper

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

A list of tags associated with the pipeline.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

string

\n

Type of pipeline.

\n
\n \n
\n
" } } } \ No newline at end of file diff --git a/content/en/api/v1/logs-pipelines/request.CreateLogsPipeline_2707101123.json b/content/en/api/v1/logs-pipelines/request.CreateLogsPipeline_2707101123.json new file mode 100644 index 0000000000000..070e37c7108e1 --- /dev/null +++ b/content/en/api/v1/logs-pipelines/request.CreateLogsPipeline_2707101123.json @@ -0,0 +1,17 @@ +{ + "filter": { + "query": "source:python" + }, + "name": "testPipeline", + "processors": [ + { + "type": "span-id-remapper", + "is_enabled": true, + "name": "test_filter", + "sources": [ + "dd.span_id" + ] + } + ], + "tags": [] +} \ No newline at end of file diff --git a/data/api/v1/CodeExamples.json b/data/api/v1/CodeExamples.json index c7c269c23902a..47d92d07f923e 100644 --- a/data/api/v1/CodeExamples.json +++ b/data/api/v1/CodeExamples.json @@ -597,6 +597,13 @@ "description": "Send logs returns \"Response from server (always 200 empty JSON).\" response" } ], + "CreateLogsPipeline": [ + { + "group": "logs_pipelines", + "suffix": "_2707101123", + "description": "Create a pipeline with Span Id Remapper returns \"OK\" response" + } + ], "SubmitDistributionPoints": [ { "group": "metrics", diff --git a/data/api/v1/full_spec.yaml b/data/api/v1/full_spec.yaml index e0c9839502821..df808aaac11ce 100644 --- a/data/api/v1/full_spec.yaml +++ b/data/api/v1/full_spec.yaml @@ -6156,6 +6156,7 @@ components: - $ref: '#/components/schemas/LogsLookupProcessor' - $ref: '#/components/schemas/ReferenceTableLogsLookupProcessor' - $ref: '#/components/schemas/LogsTraceRemapper' + - $ref: '#/components/schemas/LogsSpanRemapper' LogsQueryCompute: description: Define computation for a log query. properties: @@ -6267,6 +6268,43 @@ components: x-enum-varnames: - TIME_ASCENDING - TIME_DESCENDING + LogsSpanRemapper: + description: "There are two ways to define correlation between application spans + and logs:\n\n 1. Follow the documentation on [how to inject a span ID in + the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n + \ Log integrations automatically handle all remaining setup steps by default.\n\n + \ 2. Use the span remapper processor to define a log attribute as its associated + span ID." + properties: + is_enabled: + default: false + description: Whether or not the processor is enabled. + type: boolean + name: + description: Name of the processor. + type: string + sources: + default: + - dd.span_id + description: Array of source attributes. + items: + description: Attribute to extract the span ID from. + type: string + type: array + type: + $ref: '#/components/schemas/LogsSpanRemapperType' + required: + - type + type: object + LogsSpanRemapperType: + default: span-id-remapper + description: Type of logs span remapper. + enum: + - span-id-remapper + example: span-id-remapper + type: string + x-enum-varnames: + - SPAN_ID_REMAPPER LogsStatusRemapper: description: "Use this Processor if you want to assign some attributes as the official status.\n\nEach incoming status value is mapped as follows.\n\n - @@ -6382,7 +6420,7 @@ components: - dd.trace_id description: Array of source attributes. items: - description: Attribute to extract the Trace ID from. + description: Attribute to extract the trace ID from. type: string type: array type: diff --git a/data/api/v1/full_spec_deref.json b/data/api/v1/full_spec_deref.json index f8c3262f9608b..42d301abe961b 100644 --- a/data/api/v1/full_spec_deref.json +++ b/data/api/v1/full_spec_deref.json @@ -148939,7 +148939,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -148961,6 +148961,47 @@ "type" ], "type": "object" + }, + { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" } ] }, @@ -149849,7 +149890,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -149871,6 +149912,47 @@ "type" ], "type": "object" + }, + { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" } ] }, @@ -150700,7 +150782,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -150722,6 +150804,47 @@ "type" ], "type": "object" + }, + { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" } ] }, @@ -151601,7 +151724,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -151623,6 +151746,47 @@ "type" ], "type": "object" + }, + { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" } ] }, @@ -151768,6 +151932,59 @@ "TIME_DESCENDING" ] }, + "LogsSpanRemapper": { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" + }, + "LogsSpanRemapperType": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + }, "LogsStatusRemapper": { "description": "Use this Processor if you want to assign some attributes as the official status.\n\nEach incoming status value is mapped as follows.\n\n - Integers from 0 to 7 map to the Syslog severity standards\n - Strings beginning with `emerg` or f (case-insensitive) map to `emerg` (0)\n - Strings beginning with `a` (case-insensitive) map to `alert` (1)\n - Strings beginning with `c` (case-insensitive) map to `critical` (2)\n - Strings beginning with `err` (case-insensitive) map to `error` (3)\n - Strings beginning with `w` (case-insensitive) map to `warning` (4)\n - Strings beginning with `n` (case-insensitive) map to `notice` (5)\n - Strings beginning with `i` (case-insensitive) map to `info` (6)\n - Strings beginning with `d`, `trace` or `verbose` (case-insensitive) map to `debug` (7)\n - Strings beginning with `o` or matching `OK` or `Success` (case-insensitive) map to OK\n - All others map to `info` (6)\n\n **Note:** If multiple log status remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.", "properties": { @@ -151897,7 +152114,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -997725,7 +997942,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -997747,6 +997964,47 @@ "type" ], "type": "object" + }, + { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" } ] }, @@ -998717,7 +998975,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -998739,6 +998997,47 @@ "type" ], "type": "object" + }, + { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" } ] }, @@ -999634,7 +999933,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -999656,6 +999955,47 @@ "type" ], "type": "object" + }, + { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" } ] }, @@ -1000800,7 +1001140,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -1000822,6 +1001162,47 @@ "type" ], "type": "object" + }, + { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" } ] }, @@ -1001833,7 +1002214,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -1001855,6 +1002236,47 @@ "type" ], "type": "object" + }, + { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" } ] }, @@ -1002750,7 +1003172,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -1002772,6 +1003194,47 @@ "type" ], "type": "object" + }, + { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" } ] }, diff --git a/static/resources/json/full_spec_v1.json b/static/resources/json/full_spec_v1.json index f8c3262f9608b..42d301abe961b 100644 --- a/static/resources/json/full_spec_v1.json +++ b/static/resources/json/full_spec_v1.json @@ -148939,7 +148939,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -148961,6 +148961,47 @@ "type" ], "type": "object" + }, + { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" } ] }, @@ -149849,7 +149890,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -149871,6 +149912,47 @@ "type" ], "type": "object" + }, + { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" } ] }, @@ -150700,7 +150782,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -150722,6 +150804,47 @@ "type" ], "type": "object" + }, + { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" } ] }, @@ -151601,7 +151724,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -151623,6 +151746,47 @@ "type" ], "type": "object" + }, + { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" } ] }, @@ -151768,6 +151932,59 @@ "TIME_DESCENDING" ] }, + "LogsSpanRemapper": { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" + }, + "LogsSpanRemapperType": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + }, "LogsStatusRemapper": { "description": "Use this Processor if you want to assign some attributes as the official status.\n\nEach incoming status value is mapped as follows.\n\n - Integers from 0 to 7 map to the Syslog severity standards\n - Strings beginning with `emerg` or f (case-insensitive) map to `emerg` (0)\n - Strings beginning with `a` (case-insensitive) map to `alert` (1)\n - Strings beginning with `c` (case-insensitive) map to `critical` (2)\n - Strings beginning with `err` (case-insensitive) map to `error` (3)\n - Strings beginning with `w` (case-insensitive) map to `warning` (4)\n - Strings beginning with `n` (case-insensitive) map to `notice` (5)\n - Strings beginning with `i` (case-insensitive) map to `info` (6)\n - Strings beginning with `d`, `trace` or `verbose` (case-insensitive) map to `debug` (7)\n - Strings beginning with `o` or matching `OK` or `Success` (case-insensitive) map to OK\n - All others map to `info` (6)\n\n **Note:** If multiple log status remapper processors can be applied to a given log,\n only the first one (according to the pipelines order) is taken into account.", "properties": { @@ -151897,7 +152114,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -997725,7 +997942,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -997747,6 +997964,47 @@ "type" ], "type": "object" + }, + { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" } ] }, @@ -998717,7 +998975,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -998739,6 +998997,47 @@ "type" ], "type": "object" + }, + { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" } ] }, @@ -999634,7 +999933,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -999656,6 +999955,47 @@ "type" ], "type": "object" + }, + { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" } ] }, @@ -1000800,7 +1001140,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -1000822,6 +1001162,47 @@ "type" ], "type": "object" + }, + { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" } ] }, @@ -1001833,7 +1002214,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -1001855,6 +1002236,47 @@ "type" ], "type": "object" + }, + { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" } ] }, @@ -1002750,7 +1003172,7 @@ ], "description": "Array of source attributes.", "items": { - "description": "Attribute to extract the Trace ID from.", + "description": "Attribute to extract the trace ID from.", "type": "string" }, "type": "array" @@ -1002772,6 +1003194,47 @@ "type" ], "type": "object" + }, + { + "description": "There are two ways to define correlation between application spans and logs:\n\n 1. Follow the documentation on [how to inject a span ID in the application logs](https://docs.datadoghq.com/tracing/connect_logs_and_traces).\n Log integrations automatically handle all remaining setup steps by default.\n\n 2. Use the span remapper processor to define a log attribute as its associated span ID.", + "properties": { + "is_enabled": { + "default": false, + "description": "Whether or not the processor is enabled.", + "type": "boolean" + }, + "name": { + "description": "Name of the processor.", + "type": "string" + }, + "sources": { + "default": [ + "dd.span_id" + ], + "description": "Array of source attributes.", + "items": { + "description": "Attribute to extract the span ID from.", + "type": "string" + }, + "type": "array" + }, + "type": { + "default": "span-id-remapper", + "description": "Type of logs span remapper.", + "enum": [ + "span-id-remapper" + ], + "example": "span-id-remapper", + "type": "string", + "x-enum-varnames": [ + "SPAN_ID_REMAPPER" + ] + } + }, + "required": [ + "type" + ], + "type": "object" } ] },