-
Notifications
You must be signed in to change notification settings - Fork 72
/
pipeline.spec.yml
117 lines (113 loc) · 3.56 KB
/
pipeline.spec.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
##
## Describes the specification for an ingest pipeline.
##
spec:
# Everything under here follows JSON schema (https://json-schema.org/), written as YAML for readability
type: object
additionalProperties: false
definitions:
processor:
type: object
additionalProperties: false
maxProperties: 1
properties:
append: { type: object }
attachment: { type: object }
bytes: { type: object }
circle: { type: object }
community_id: { type: object }
convert: { type: object }
csv: { type: object }
date: { type: object }
date_index_name: { type: object }
dissect: { type: object }
dot_expander: { type: object }
drop: { type: object }
# enrich: false # Additional support needed.
fail: { type: object }
fingerprint: { type: object }
# geo_grid: false # Support for geo shape fields needed.
geoip: { type: object }
grok: { type: object }
gsub: { type: object }
html_strip: { type: object }
inference: { type: object }
join: { type: object }
json: { type: object }
kv: { type: object }
lowercase: { type: object }
network_direction: { type: object }
pipeline: { type: object }
redact: { type: object }
registered_domain: { type: object }
remove: { type: object }
rename: { type: object }
# reroute: false # reroute_rules.yml should be used instead.
script: { type: object }
set: { type: object }
# set_security_user: false # Applicable to packages?
sort: { type: object }
split: { type: object }
trim: { type: object }
uppercase: { type: object }
urldecode: { type: object }
uri_parts: { type: object }
user_agent: { type: object }
foreach:
type: object
properties:
processor:
$ref: "#/definitions/processor"
processors:
type: array
items:
$ref: "#/definitions/processor"
if:
contains:
required: [ rename ]
properties:
rename:
properties:
field:
const: "message"
target_field:
const: "event.original"
then:
allOf:
- contains:
required: [ rename ]
properties:
rename:
required: [ if ]
properties:
if:
const: "ctx.event?.original == null"
- contains:
required: [ remove ]
properties:
remove:
required: [ field, ignore_missing, if ]
properties:
field:
const: "message"
ignore_missing:
const: true
if:
const: "ctx.event?.original != null"
properties:
description:
description: Description of the pipeline.
type: string
processors:
description: List of processors that conform the pipeline.
$ref: "#/definitions/processors"
on_failure:
description: List of processors to apply in case of failure.
$ref: "#/definitions/processors"
versions:
- before: 3.1.0
patch:
- op: remove
path: /definitions/processors/if # remove rename processor validation
- op: remove
path: /definitions/processors/then # remove rename processor validation