Datadog Observability API

openapi: 3.0.0
info:
  contact:
    email: support@datadoghq.com
    name: Datadog Support
    url: https://www.datadoghq.com/support/
  description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically.
  title: Datadog Account Observability API
  version: '1.0'
servers:
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: The regional site for Datadog customers.
      enum:
      - datadoghq.com
      - us3.datadoghq.com
      - us5.datadoghq.com
      - ap1.datadoghq.com
      - datadoghq.eu
      - ddog-gov.com
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
- url: '{protocol}://{name}'
  variables:
    name:
      default: api.datadoghq.com
      description: Full site DNS name.
    protocol:
      default: https
      description: The protocol for accessing the API.
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: Any Datadog deployment.
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
security:
- apiKeyAuth: []
  appKeyAuth: []
tags:
- name: Observability
paths:
  /api/v2/remote_config/products/obs_pipelines/pipelines/validate:
    post:
      description: 'Validates a pipeline configuration without creating or updating any resources.

        Returns a list of validation errors, if any.

        '
      operationId: ValidatePipeline
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ObservabilityPipelineSpec'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Validate an Observability Pipeline
      tags:
      - Observability
      x-menu-order: 5
      x-permission:
        operator: OR
        permissions:
        - observability_pipelines_read
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in Preview.'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/usage/observability_pipelines:
    get:
      deprecated: true
      description: 'Get hourly usage for observability pipelines.

        **Note:** This endpoint has been deprecated. Hourly usage data for all products is now available in the [Get hourly usage by product family API](https://docs.datadoghq.com/api/latest/usage-metering/#get-hourly-usage-by-product-family)'
      operationId: GetUsageObservabilityPipelines
      parameters:
      - description: 'Datetime in ISO-8601 format, UTC, precise to hour: `[YYYY-MM-DDThh]` for usage beginning at this hour.'
        in: query
        name: start_hr
        required: true
        schema:
          format: date-time
          type: string
        example: example_value
      - description: 'Datetime in ISO-8601 format, UTC, precise to hour: `[YYYY-MM-DDThh]` for usage ending

          **before** this hour.'
        in: query
        name: end_hr
        required: false
        schema:
          format: date-time
          type: string
        example: example_value
      responses:
        '200':
          content:
            application/json;datetime-format=rfc3339:
              schema:
                $ref: '#/components/schemas/UsageObservabilityPipelinesResponse'
          description: OK
        '400':
          content:
            application/json;datetime-format=rfc3339:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json;datetime-format=rfc3339:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden - User is not authorized
        '429':
          content:
            application/json;datetime-format=rfc3339:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Too many requests
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - usage_read
      summary: Datadog Get Hourly Usage for Observability Pipelines
      tags:
      - Observability
      x-menu-order: 39
      x-permission:
        operator: OR
        permissions:
        - usage_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    ObservabilityPipelineAmazonOpenSearchDestinationType:
      default: amazon_opensearch
      description: The destination type. The value should always be `amazon_opensearch`.
      enum:
      - amazon_opensearch
      example: amazon_opensearch
      type: string
      x-enum-varnames:
      - AMAZON_OPENSEARCH
    ObservabilityPipelineNewRelicDestination:
      description: The `new_relic` destination sends logs to the New Relic platform.
      properties:
        id:
          description: The unique identifier for this component.
          example: new-relic-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - parse-json-processor
          items:
            type: string
          type: array
        region:
          $ref: '#/components/schemas/ObservabilityPipelineNewRelicDestinationRegion'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineNewRelicDestinationType'
      required:
      - id
      - type
      - inputs
      - region
      type: object
    ObservabilityPipelineHttpServerSourceAuthStrategy:
      description: HTTP authentication method.
      enum:
      - none
      - plain
      example: plain
      type: string
      x-enum-varnames:
      - NONE
      - PLAIN
    ObservabilityPipelineSensitiveDataScannerProcessorCustomPattern:
      description: Defines a custom regex-based pattern for identifying sensitive data in logs.
      properties:
        options:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternOptions'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternType'
      required:
      - type
      - options
      type: object
    ObservabilityPipelineRemoveFieldsProcessorType:
      default: remove_fields
      description: The processor type. The value should always be `remove_fields`.
      enum:
      - remove_fields
      example: remove_fields
      type: string
      x-enum-varnames:
      - REMOVE_FIELDS
    ObservabilityPipelineFluentdSource:
      description: The `fluentd` source ingests logs from a Fluentd-compatible service.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
          example: fluent-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineFluentdSourceType'
      required:
      - id
      - type
      type: object
    ObservabilityPipelineRsyslogSource:
      description: The `rsyslog` source listens for logs over TCP or UDP from an `rsyslog` server using the syslog protocol.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: rsyslog-source
          type: string
        mode:
          $ref: '#/components/schemas/ObservabilityPipelineSyslogSourceMode'
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineRsyslogSourceType'
      required:
      - id
      - type
      - mode
      type: object
    ObservabilityPipelineSplunkHecDestinationEncoding:
      description: Encoding format for log events.
      enum:
      - json
      - raw_message
      example: json
      type: string
      x-enum-varnames:
      - JSON
      - RAW_MESSAGE
    ObservabilityPipelineFluentBitSource:
      description: The `fluent_bit` source ingests logs from Fluent Bit.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
          example: fluent-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineFluentBitSourceType'
      required:
      - id
      - type
      type: object
    ObservabilityPipelineRenameFieldsProcessorType:
      default: rename_fields
      description: The processor type. The value should always be `rename_fields`.
      enum:
      - rename_fields
      example: rename_fields
      type: string
      x-enum-varnames:
      - RENAME_FIELDS
    ObservabilityPipelineLogstashSourceType:
      default: logstash
      description: The source type. The value should always be `logstash`.
      enum:
      - logstash
      example: logstash
      type: string
      x-enum-varnames:
      - LOGSTASH
    ObservabilityPipelineSumoLogicSource:
      description: The `sumo_logic` source receives logs from Sumo Logic collectors.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: sumo-logic-source
          type: string
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSumoLogicSourceType'
      required:
      - id
      - type
      type: object
    ObservabilityPipelineGeneratedMetric:
      description: 'Defines a log-based custom metric, including its name, type, filter, value computation strategy,

        and optional grouping fields.

        '
      properties:
        group_by:
          description: Optional fields used to group the metric series.
          example:
          - service
          - env
          items:
            type: string
          type: array
        include:
          description: Datadog filter query to match logs for metric generation.
          example: service:billing
          type: string
        metric_type:
          $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricMetricType'
        name:
          description: Name of the custom metric to be created.
          example: logs.processed
          type: string
        value:
          $ref: '#/components/schemas/ObservabilityPipelineMetricValue'
      required:
      - name
      - include
      - metric_type
      - value
      type: object
    UsageTimeSeriesObject:
      description: Usage timeseries data.
      properties:
        timestamp:
          description: Datetime in ISO-8601 format, UTC. The hour for the usage.
          format: date-time
          type: string
          example: '2026-04-17T12:00:00Z'
        value:
          description: Contains the number measured for the given usage_type during the hour.
          format: int64
          nullable: true
          type: integer
          example: 42
      type: object
    ObservabilityPipelineHttpClientSourceAuthStrategy:
      description: Optional authentication strategy for HTTP requests.
      enum:
      - basic
      - bearer
      example: basic
      type: string
      x-enum-varnames:
      - BASIC
      - BEARER
    ObservabilityPipelineGoogleChronicleDestination:
      description: The `google_chronicle` destination sends logs to Google Chronicle.
      properties:
        auth:
          $ref: '#/components/schemas/ObservabilityPipelineGcpAuth'
        customer_id:
          description: The Google Chronicle customer ID.
          example: abcdefg123456789
          type: string
        encoding:
          $ref: '#/components/schemas/ObservabilityPipelineGoogleChronicleDestinationEncoding'
        id:
          description: The unique identifier for this component.
          example: google-chronicle-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - parse-json-processor
          items:
            type: string
          type: array
        log_type:
          description: The log type metadata associated with the Chronicle destination.
          example: nginx_logs
          type: string
        type:
          $ref: '#/components/schemas/ObservabilityPipelineGoogleChronicleDestinationType'
      required:
      - id
      - type
      - inputs
      - auth
      - customer_id
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorActionHashAction:
      description: Action type that replaces the matched sensitive data with a hashed representation, preserving structure while securing content.
      enum:
      - hash
      example: hash
      type: string
      x-enum-varnames:
      - HASH
    ObservabilityPipelineOcsfMapperProcessorMapping:
      description: Defines how specific events are transformed to OCSF using a mapping configuration.
      properties:
        include:
          description: A Datadog search query used to select the logs that this mapping should apply to.
          example: service:my-service
          type: string
        mapping:
          $ref: '#/components/schemas/ObservabilityPipelineOcsfMapperProcessorMappingMapping'
      required:
      - include
      - mapping
      type: object
    MicrosoftSentinelDestinationType:
      default: microsoft_sentinel
      description: The destination type. The value should always be `microsoft_sentinel`.
      enum:
      - microsoft_sentinel
      example: microsoft_sentinel
      type: string
      x-enum-varnames:
      - MICROSOFT_SENTINEL
    AzureStorageDestination:
      description: The `azure_storage` destination forwards logs to an Azure Blob Storage container.
      properties:
        blob_prefix:
          description: Optional prefix for blobs written to the container.
          example: logs/
          type: string
        container_name:
          description: The name of the Azure Blob Storage container to store logs in.
          example: my-log-container
          type: string
        id:
          description: The unique identifier for this component.
          example: azure-storage-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - processor-id
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/AzureStorageDestinationType'
      required:
      - id
      - type
      - inputs
      - container_name
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorRule:
      description: Defines a rule for detecting sensitive data, including matching pattern, scope, and the action to take.
      properties:
        keyword_options:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorKeywordOptions'
        name:
          description: A name identifying the rule.
          example: Redact Credit Card Numbers
          type: string
        on_match:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorAction'
        pattern:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorPattern'
        scope:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScope'
        tags:
          description: Tags assigned to this rule for filtering and classification.
          example:
          - pii
          - ccn
          items:
            type: string
          type: array
      required:
      - name
      - tags
      - pattern
      - scope
      - on_match
      type: object
    ObservabilityPipelineHttpClientSourceType:
      default: http_client
      description: The source type. The value should always be `http_client`.
      enum:
      - http_client
      example: http_client
      type: string
      x-enum-varnames:
      - HTTP_CLIENT
    ObservabilityPipelineEnrichmentTableFileKeyItemsComparison:
      description: Defines how to compare key fields for enrichment table lookups.
      enum:
      - equals
      example: equals
      type: string
      x-enum-varnames:
      - EQUALS
    ObservabilityPipelineQuotaProcessorLimit:
      description: The maximum amount of data or number of events allowed before the quota is enforced. Can be specified in bytes or events.
      properties:
        enforce:
          $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorLimitEnforceType'
        limit:
          description: The limit for quota enforcement.
          example: 1000
          format: int64
          type: integer
      required:
      - enforce
      - limit
      type: object
    ObservabilityPipelineParseGrokProcessorRuleMatchRule:
      description: 'Defines a Grok parsing rule, which extracts structured fields from log content using named Grok patterns.

        Each rule must have a unique name and a valid Datadog Grok pattern that will be applied to the source field.

        '
      properties:
        name:
          description: The name of the rule.
          example: MyParsingRule
          type: string
        rule:
          description: The definition of the Grok rule.
          example: '%{word:user} connected on %{date("MM/dd/yyyy"):date}'
          type: string
      required:
      - name
      - rule
      type: object
    ObservabilityPipelineKafkaSource:
      description: The `kafka` source ingests data from Apache Kafka topics.
      properties:
        group_id:
          description: Consumer group ID used by the Kafka client.
          example: consumer-group-0
          type: string
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: kafka-source
          type: string
        librdkafka_options:
          description: Optional list of advanced Kafka client configuration options, defined as key-value pairs.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineKafkaSourceLibrdkafkaOption'
          type: array
        sasl:
          $ref: '#/components/schemas/ObservabilityPipelineKafkaSourceSasl'
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        topics:
          description: A list of Kafka topic names to subscribe to. The source ingests messages from each topic specified.
          example:
          - topic1
          - topic2
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineKafkaSourceType'
      required:
      - id
      - type
      - group_id
      - topics
      type: object
    ObservabilityPipelineHttpServerSource:
      description: The `http_server` source collects logs over HTTP POST from external services.
      properties:
        auth_strategy:
          $ref: '#/components/schemas/ObservabilityPipelineHttpServerSourceAuthStrategy'
        decoding:
          $ref: '#/components/schemas/ObservabilityPipelineDecoding'
        id:
          description: Unique ID for the HTTP server source.
          example: http-server-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineHttpServerSourceType'
      required:
      - id
      - type
      - auth_strategy
      - decoding
      type: object
    ObservabilityPipelineRsyslogSourceType:
      default: rsyslog
      description: The source type. The value should always be `rsyslog`.
      enum:
      - rsyslog
      example: rsyslog
      type: string
      x-enum-varnames:
      - RSYSLOG
    ObservabilityPipelineSplunkTcpSource:
      description: 'The `splunk_tcp` source receives logs from a Splunk Universal Forwarder over TCP.

        TLS is supported for secure transmission.

        '
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: splunk-tcp-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSplunkTcpSourceType'
      required:
      - id
      - type
      type: object
    ObservabilityPipelineParseJSONProcessor:
      description: The `parse_json` processor extracts JSON from a specified field and flattens it into the event. This is useful when logs contain embedded JSON as a string.
      properties:
        field:
          description: The name of the log field that contains a JSON string.
          example: message
          type: string
        id:
          description: A unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: parse-json-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineParseJSONProcessorType'
      required:
      - id
      - type
      - include
      - field
      - inputs
      type: object
    ObservabilityPipelineOcsfMappingLibrary:
      description: Predefined library mappings for common log formats.
      enum:
      - CloudTrail Account Change
      - GCP Cloud Audit CreateBucket
      - GCP Cloud Audit CreateSink
      - GCP Cloud Audit SetIamPolicy
      - GCP Cloud Audit UpdateSink
      - Github Audit Log API Activity
      - Google Workspace Admin Audit addPrivilege
      - Microsoft 365 Defender Incident
      - Microsoft 365 Defender UserLoggedIn
      - Okta System Log Authentication
      - Palo Alto Networks Firewall Traffic
      example: CloudTrail Account Change
      type: string
      x-enum-varnames:
      - CLOUDTRAIL_ACCOUNT_CHANGE
      - GCP_CLOUD_AUDIT_CREATEBUCKET
      - GCP_CLOUD_AUDIT_CREATESINK
      - GCP_CLOUD_AUDIT_SETIAMPOLICY
      - GCP_CLOUD_AUDIT_UPDATESINK
      - GITHUB_AUDIT_LOG_API_ACTIVITY
      - GOOGLE_WORKSPACE_ADMIN_AUDIT_ADDPRIVILEGE
      - MICROSOFT_365_DEFENDER_INCIDENT
      - MICROSOFT_365_DEFENDER_USERLOGGEDIN
      - OKTA_SYSTEM_LOG_AUTHENTICATION
      - PALO_ALTO_NETWORKS_FIREWALL_TRAFFIC
    ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternType:
      description: Indicates that a predefined library pattern is used.
      enum:
      - library
      example: library
      type: string
      x-enum-varnames:
      - LIBRARY
    ObservabilityPipelineOpenSearchDestinationType:
      default: opensearch
      description: The destination type. The value should always be `opensearch`.
      enum:
      - opensearch
      example: opensearch
      type: string
      x-enum-varnames:
      - OPENSEARCH
    ObservabilityPipelineSensitiveDataScannerProcessor:
      description: The `sensitive_data_scanner` processor detects and optionally redacts sensitive data in log events.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: sensitive-scanner
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: source:prod
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - parse-json-processor
          items:
            type: string
          type: array
        rules:
          description: A list of rules for identifying and acting on sensitive data patterns.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorRule'
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      - rules
      type: object
    ObservabilityPipelineDatadogLogsDestinationType:
      default: datadog_logs
      description: The destination type. The value should always be `datadog_logs`.
      enum:
      - datadog_logs
      example: datadog_logs
      type: string
      x-enum-varnames:
      - DATADOG_LOGS
    ObservabilityPipelineSensitiveDataScannerProcessorType:
      default: sensitive_data_scanner
      description: The processor type. The value should always be `sensitive_data_scanner`.
      enum:
      - sensitive_data_scanner
      example: sensitive_data_scanner
      type: string
      x-enum-varnames:
      - SENSITIVE_DATA_SCANNER
    ObservabilityPipelineKafkaSourceSasl:
      description: Specifies the SASL mechanism for authenticating with a Kafka cluster.
      properties:
        mechanism:
          $ref: '#/components/schemas/ObservabilityPipelinePipelineKafkaSourceSaslMechanism'
      type: object
    ObservabilityPipelineSplunkHecDestination:
      description: 'The `splunk_hec` destination forwards logs to Splunk using the HTTP Event Collector (HEC).

        '
      properties:
        auto_extract_timestamp:
          description: 'If `true`, Splunk tries to extract timestamps from incoming log events.

            If `false`, Splunk assigns the time the event was received.

            '
          example: true
          type: boolean
        encoding:
          $ref: '#/components/schemas/ObservabilityPipelineSplunkHecDestinationEncoding'
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: splunk-hec-destination
          type: string
        index:
          description: Optional name of the Splunk index where logs are written.
          example: main
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        sourcetype:
          description: The Splunk sourcetype to assign to log events.
          example: custom_sourcetype
          type: string
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSplunkHecDestinationType'
      required:
      - id
      - type
      - inputs
      type: object
    ObservabilityPipelineGeneratedMetricIncrementByFieldStrategy:
      description: Uses a numeric field in the log event as the metric increment.
      enum:
      - increment_by_field
      example: increment_by_field
      type: string
      x-enum-varnames:
      - INCREMENT_BY_FIELD
    ObservabilityPipelineElasticsearchDestination:
      description: The `elasticsearch` destination writes logs to an Elasticsearch cluster.
      properties:
        api_version:
          $ref: '#/components/schemas/ObservabilityPipelineElasticsearchDestinationApiVersion'
        bulk_index:
          description: The index to write logs to in Elasticsearch.
          example: logs-index
          type: string
        id:
          description: The unique identifier for this component.
          example: elasticsearch-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineElasticsearchDestinationType'
      required:
      - id
      - type
      - inputs
      type: object
    ObservabilityPipelineHttpClientSource:
      description: The `http_client` source scrapes logs from HTTP endpoints at regular intervals.
      properties:
        auth_strategy:
          $ref: '#/components/schemas/ObservabilityPipelineHttpClientSourceAuthStrategy'
        decoding:
          $ref: '#/components/schemas/ObservabilityPipelineDecoding'
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: http-client-source
          type: string
        scrape_interval_secs:
          description: The interval (in seconds) between HTTP scrape requests.
          example: 60
          format: int64
          type: integer
        scrape_timeout_secs:
          description: The timeout (in seconds) for each scrape request.
          example: 10
          format: int64
          type: integer
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineHttpClientSourceType'
      required:
      - id
      - type
      - decoding
      type: object
    ObservabilityPipelineSampleProcessor:
      description: The `sample` processor allows probabilistic sampling of logs at a fixed rate.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
          example: sample-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        percentage:
          description: The percentage of logs to sample.
          example: 10
          format: double
          type: number
        rate:
          description: Number of events to sample (1 in N).
          example: 10
          format: int64
          minimum: 1
          type: integer
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSampleProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      type: object
    ObservabilityPipelineSpec:
      description: Input schema representing an observability pipeline configuration. Used in create and validate requests.
      properties:
        data:
          $ref: '#/components/schemas/ObservabilityPipelineSpecData'
      required:
      - data
      type: object
    ObservabilityPipelineGooglePubSubSourceType:
      default: google_pubsub
      description: The source type. The value should always be `google_pubsub`.
      enum:
      - google_pubsub
      example: google_pubsub
      type: stri

# --- truncated at 32 KB (122 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/openapi/datadog-observability-api-openapi.yml