Datadog Observability API

openapi: 3.2.0
info:
  contact:
    email: support@datadoghq.com
    name: Datadog Support
    url: https://www.datadoghq.com/support/
  description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically.
  title: Datadog Observability API
  version: '1.0'
servers:
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: The regional site for Datadog customers.
      enum:
      - datadoghq.com
      - us3.datadoghq.com
      - us5.datadoghq.com
      - ap1.datadoghq.com
      - datadoghq.eu
      - ddog-gov.com
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
- url: '{protocol}://{name}'
  variables:
    name:
      default: api.datadoghq.com
      description: Full site DNS name.
    protocol:
      default: https
      description: The protocol for accessing the API.
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: Any Datadog deployment.
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
security:
- apiKeyAuth: []
  appKeyAuth: []
tags:
- name: Observability
paths:
  /api/v2/remote_config/products/obs_pipelines/pipelines/validate:
    post:
      description: 'Validates a pipeline configuration without creating or updating any resources.

        Returns a list of validation errors, if any.

        '
      operationId: ValidatePipeline
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ObservabilityPipelineSpec'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Validate an Observability Pipeline
      tags:
      - Observability
      x-menu-order: 5
      x-permission:
        operator: OR
        permissions:
        - observability_pipelines_read
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in Preview.'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    ObservabilityPipelineParseGrokProcessorRuleSupportRule:
      description: The Grok helper rule referenced in the parsing rules.
      properties:
        name:
          description: The name of the Grok helper rule.
          example: user
          type: string
        rule:
          description: The definition of the Grok helper rule.
          example: ' %{word:user.name}'
          type: string
      required:
      - name
      - rule
      type: object
    ObservabilityPipelineMetricValue:
      description: Specifies how the value of the generated metric is computed.
      oneOf:
      - $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByOne'
      - $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByField'
    ObservabilityPipelineAddEnvVarsProcessorType:
      default: add_env_vars
      description: The processor type. The value should always be `add_env_vars`.
      enum:
      - add_env_vars
      example: add_env_vars
      type: string
      x-enum-varnames:
      - ADD_ENV_VARS
    ObservabilityPipelineGenerateMetricsProcessorType:
      default: generate_datadog_metrics
      description: The processor type. Always `generate_datadog_metrics`.
      enum:
      - generate_datadog_metrics
      example: generate_datadog_metrics
      type: string
      x-enum-varnames:
      - GENERATE_DATADOG_METRICS
    ObservabilityPipelineGoogleChronicleDestinationEncoding:
      description: The encoding format for the logs sent to Chronicle.
      enum:
      - json
      - raw_message
      example: json
      type: string
      x-enum-varnames:
      - JSON
      - RAW_MESSAGE
    ObservabilityPipelineThrottleProcessor:
      description: The `throttle` processor limits the number of events that pass through over a given time window.
      properties:
        group_by:
          description: Optional list of fields used to group events before the threshold has been reached.
          example:
          - log.user.id
          items:
            type: string
          type: array
        id:
          description: The unique identifier for this processor.
          example: throttle-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: env:prod
          type: string
        inputs:
          description: A list of component IDs whose output is used as the input for this processor.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        threshold:
          description: the number of events allowed in a given time window. Events sent after the threshold has been reached, are dropped.
          example: 1000
          format: int64
          type: integer
        type:
          $ref: '#/components/schemas/ObservabilityPipelineThrottleProcessorType'
        window:
          description: The time window in seconds over which the threshold applies.
          example: 60
          format: double
          type: number
      required:
      - id
      - type
      - include
      - inputs
      - threshold
      - window
      type: object
    ObservabilityPipelineConfig:
      description: Specifies the pipeline's configuration, including its sources, processors, and destinations.
      properties:
        destinations:
          description: A list of destination components where processed logs are sent.
          example:
          - id: datadog-logs-destination
            inputs:
            - filter-processor
            type: datadog_logs
          items:
            $ref: '#/components/schemas/ObservabilityPipelineConfigDestinationItem'
          type: array
        processors:
          description: A list of processors that transform or enrich log data.
          example:
          - id: filter-processor
            include: service:my-service
            inputs:
            - datadog-agent-source
            type: filter
          items:
            $ref: '#/components/schemas/ObservabilityPipelineConfigProcessorItem'
          type: array
        sources:
          description: A list of configured data sources for the pipeline.
          example:
          - id: datadog-agent-source
            type: datadog_agent
          items:
            $ref: '#/components/schemas/ObservabilityPipelineConfigSourceItem'
          type: array
      required:
      - sources
      - destinations
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternType:
      description: Indicates that a predefined library pattern is used.
      enum:
      - library
      example: library
      type: string
      x-enum-varnames:
      - LIBRARY
    ObservabilityPipelineAmazonS3SourceType:
      default: amazon_s3
      description: The source type. Always `amazon_s3`.
      enum:
      - amazon_s3
      example: amazon_s3
      type: string
      x-enum-varnames:
      - AMAZON_S3
    ObservabilityPipelineSyslogNgDestinationType:
      default: syslog_ng
      description: The destination type. The value should always be `syslog_ng`.
      enum:
      - syslog_ng
      example: syslog_ng
      type: string
      x-enum-varnames:
      - SYSLOG_NG
    ObservabilityPipelineTls:
      description: Configuration for enabling TLS encryption between the pipeline component and external services.
      properties:
        ca_file:
          description: Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
          type: string
          example: example_value
        crt_file:
          description: Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
          example: /path/to/cert.crt
          type: string
        key_file:
          description: Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
          type: string
          example: example_value
      required:
      - crt_file
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorKeywordOptions:
      description: Configuration for keywords used to reinforce sensitive data pattern detection.
      properties:
        keywords:
          description: A list of keywords to match near the sensitive pattern.
          example:
          - ssn
          - card
          - account
          items:
            type: string
          type: array
        proximity:
          description: Maximum number of tokens between a keyword and a sensitive value match.
          example: 5
          format: int64
          type: integer
      required:
      - keywords
      - proximity
      type: object
    ObservabilityPipelineRemoveFieldsProcessor:
      description: The `remove_fields` processor deletes specified fields from logs.
      properties:
        fields:
          description: A list of field names to be removed from each log event.
          example:
          - field1
          - field2
          items:
            type: string
          type: array
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: remove-fields-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: The `PipelineRemoveFieldsProcessor` `inputs`.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineRemoveFieldsProcessorType'
      required:
      - id
      - type
      - include
      - fields
      - inputs
      type: object
    ObservabilityPipelineSpec:
      description: Input schema representing an observability pipeline configuration. Used in create and validate requests.
      properties:
        data:
          $ref: '#/components/schemas/ObservabilityPipelineSpecData'
      required:
      - data
      type: object
    ObservabilityPipelineEnrichmentTableFileEncodingType:
      description: Specifies the encoding format (e.g., CSV) used for enrichment tables.
      enum:
      - csv
      example: csv
      type: string
      x-enum-varnames:
      - CSV
    ObservabilityPipelineFilterProcessor:
      description: The `filter` processor allows conditional processing of logs based on a Datadog search query. Logs that match the `include` query are passed through; others are discarded.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
          example: filter-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs should pass through the filter. Logs that match this query continue to downstream components; others are dropped.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineFilterProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      type: object
    ObservabilityPipelineLogstashSource:
      description: The `logstash` source ingests logs from a Logstash forwarder.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: logstash-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineLogstashSourceType'
      required:
      - id
      - type
      type: object
    ObservabilityPipelineDataAttributes:
      description: Defines the pipeline’s name and its components (sources, processors, and destinations).
      properties:
        config:
          $ref: '#/components/schemas/ObservabilityPipelineConfig'
        name:
          description: Name of the pipeline.
          example: Main Observability Pipeline
          type: string
      required:
      - name
      - config
      type: object
    ObservabilityPipelineGoogleCloudStorageDestination:
      description: 'The `google_cloud_storage` destination stores logs in a Google Cloud Storage (GCS) bucket.

        It requires a bucket name, GCP authentication, and metadata fields.

        '
      properties:
        acl:
          $ref: '#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationAcl'
        auth:
          $ref: '#/components/schemas/ObservabilityPipelineGcpAuth'
        bucket:
          description: Name of the GCS bucket.
          example: error-logs
          type: string
        id:
          description: Unique identifier for the destination component.
          example: gcs-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        key_prefix:
          description: Optional prefix for object keys within the GCS bucket.
          type: string
          example: example_value
        metadata:
          description: Custom metadata to attach to each object uploaded to the GCS bucket.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineMetadataEntry'
          type: array
        storage_class:
          $ref: '#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationStorageClass'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationType'
      required:
      - id
      - type
      - inputs
      - bucket
      - auth
      - storage_class
      - acl
      type: object
    ObservabilityPipelineHttpServerSource:
      description: The `http_server` source collects logs over HTTP POST from external services.
      properties:
        auth_strategy:
          $ref: '#/components/schemas/ObservabilityPipelineHttpServerSourceAuthStrategy'
        decoding:
          $ref: '#/components/schemas/ObservabilityPipelineDecoding'
        id:
          description: Unique ID for the HTTP server source.
          example: http-server-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineHttpServerSourceType'
      required:
      - id
      - type
      - auth_strategy
      - decoding
      type: object
    ObservabilityPipelineDatadogAgentSource:
      description: The `datadog_agent` source collects logs from the Datadog Agent.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: datadog-agent-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineDatadogAgentSourceType'
      required:
      - id
      - type
      type: object
    ObservabilityPipelineSampleProcessor:
      description: The `sample` processor allows probabilistic sampling of logs at a fixed rate.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
          example: sample-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        percentage:
          description: The percentage of logs to sample.
          example: 10
          format: double
          type: number
        rate:
          description: Number of events to sample (1 in N).
          example: 10
          format: int64
          minimum: 1
          type: integer
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSampleProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      type: object
    ObservabilityPipelineConfigDestinationItem:
      description: A destination for the pipeline.
      oneOf:
      - $ref: '#/components/schemas/ObservabilityPipelineDatadogLogsDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineAmazonS3Destination'
      - $ref: '#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineSplunkHecDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineSumoLogicDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineElasticsearchDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineRsyslogDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineSyslogNgDestination'
      - $ref: '#/components/schemas/AzureStorageDestination'
      - $ref: '#/components/schemas/MicrosoftSentinelDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineGoogleChronicleDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineNewRelicDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineSentinelOneDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineOpenSearchDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestination'
    ObservabilityPipelineDatadogAgentSourceType:
      default: datadog_agent
      description: The source type. The value should always be `datadog_agent`.
      enum:
      - datadog_agent
      example: datadog_agent
      type: string
      x-enum-varnames:
      - DATADOG_AGENT
    ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions:
      description: Fields to which the scope rule applies.
      properties:
        fields:
          description: The `ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions` `fields`.
          example:
          - ''
          items:
            type: string
          type: array
      required:
      - fields
      type: object
    ObservabilityPipelinePipelineKafkaSourceSaslMechanism:
      description: SASL mechanism used for Kafka authentication.
      enum:
      - PLAIN
      - SCRAM-SHA-256
      - SCRAM-SHA-512
      type: string
      x-enum-varnames:
      - PLAIN
      - SCRAMNOT_SHANOT_256
      - SCRAMNOT_SHANOT_512
    ObservabilityPipelineSensitiveDataScannerProcessorLibraryPattern:
      description: Specifies a pattern from Datadog’s sensitive data detection library to match known sensitive data types.
      properties:
        options:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternOptions'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternType'
      required:
      - type
      - options
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternOptions:
      description: Options for selecting a predefined library pattern and enabling keyword support.
      properties:
        id:
          description: Identifier for a predefined pattern from the sensitive data scanner pattern library.
          example: credit_card
          type: string
        use_recommended_keywords:
          description: Whether to augment the pattern with recommended keywords (optional).
          type: boolean
          example: true
      required:
      - id
      type: object
    ObservabilityPipelineRsyslogDestinationType:
      default: rsyslog
      description: The destination type. The value should always be `rsyslog`.
      enum:
      - rsyslog
      example: rsyslog
      type: string
      x-enum-varnames:
      - RSYSLOG
    ObservabilityPipelineDecoding:
      description: The decoding format used to interpret incoming logs.
      enum:
      - bytes
      - gelf
      - json
      - syslog
      example: json
      type: string
      x-enum-varnames:
      - DECODE_BYTES
      - DECODE_GELF
      - DECODE_JSON
      - DECODE_SYSLOG
    ObservabilityPipelineFluentdSourceType:
      default: fluentd
      description: The source type. The value should always be `fluentd.
      enum:
      - fluentd
      example: fluentd
      type: string
      x-enum-varnames:
      - FLUENTD
    ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptionsDirection:
      description: Indicates whether to redact characters from the first or last part of the matched value.
      enum:
      - first
      - last
      example: last
      type: string
      x-enum-varnames:
      - FIRST
      - LAST
    ObservabilityPipelineKafkaSourceType:
      default: kafka
      description: The source type. The value should always be `kafka`.
      enum:
      - kafka
      example: kafka
      type: string
      x-enum-varnames:
      - KAFKA
    ObservabilityPipelineSensitiveDataScannerProcessorPattern:
      description: Pattern detection configuration for identifying sensitive data using either a custom regex or a library reference.
      oneOf:
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorCustomPattern'
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorLibraryPattern'
    ObservabilityPipelineFluentBitSourceType:
      default: fluent_bit
      description: The source type. The value should always be `fluent_bit`.
      enum:
      - fluent_bit
      example: fluent_bit
      type: string
      x-enum-varnames:
      - FLUENT_BIT
    ObservabilityPipelineQuotaProcessor:
      description: The Quota Processor measures logging traffic for logs that match a specified filter. When the configured daily quota is met, the processor can drop or alert.
      properties:
        drop_events:
          description: If set to `true`, logs that matched the quota filter and sent after the quota has been met are dropped; only logs that did not match the filter query continue through the pipeline.
          example: false
          type: boolean
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
          example: quota-processor
          type: string
        ignore_when_missing_partitions:
          description: If `true`, the processor skips quota checks when partition fields are missing from the logs.
          type: boolean
          example: true
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        limit:
          $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorLimit'
        name:
          description: Name of the quota.
          example: MyQuota
          type: string
        overflow_action:
          $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorOverflowAction'
        overrides:
          description: A list of alternate quota rules that apply to specific sets of events, identified by matching field values. Each override can define a custom limit.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorOverride'
          type: array
        partition_fields:
          description: A list of fields used to segment log traffic for quota enforcement. Quotas are tracked independently by unique combinations of these field values.
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorType'
      required:
      - id
      - type
      - include
      - name
      - drop_events
      - limit
      - inputs
      type: object
    ObservabilityPipelineGooglePubSubSourceType:
      default: google_pubsub
      description: The source type. The value should always be `google_pubsub`.
      enum:
      - google_pubsub
      example: google_pubsub
      type: string
      x-enum-varnames:
      - GOOGLE_PUBSUB
    ObservabilityPipelineGcpAuth:
      description: 'GCP credentials used to authenticate with Google Cloud Storage.

        '
      properties:
        credentials_file:
          description: Path to the GCP service account key file.
          example: /var/secrets/gcp-credentials.json
          type: string
      required:
      - credentials_file
      type: object
    ObservabilityPipelineConfigProcessorItem:
      description: A processor for the pipeline.
      oneOf:
      - $ref: '#/components/schemas/ObservabilityPipelineFilterProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineParseJSONProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineAddFieldsProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineRemoveFieldsProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineRenameFieldsProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineGenerateMetricsProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineSampleProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineOcsfMapperProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineAddEnvVarsProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineDedupeProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineReduceProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineThrottleProcessor'
    ObservabilityPipelineGoogleCloudStorageDestinationAcl:
      description: Access control list setting for objects written to the bucket.
      enum:
      - private
      - project-private
      - public-read
      - authenticated-read
      - bucket-owner-read
      - bucket-owner-full-control
      example: private
      type: string
      x-enum-varnames:
      - PRIVATE
      - PROJECTNOT_PRIVATE
      - PUBLICNOT_READ
      - AUTHENTICATEDNOT_READ
      - BUCKETNOT_OWNERNOT_READ
      - BUCKETNOT_OWNERNOT_FULLNOT_CONTROL
    ObservabilityPipelineSyslogNgSource:
      description: The `syslog_ng` source listens for logs over TCP or UDP from a `syslog-ng` server using the syslog protocol.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: syslog-ng-source
          type: string
        mode:
          $ref: '#/components/schemas/ObservabilityPipelineSyslogSourceMode'
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSyslogNgSourceType'
      required:
      - id
      - type
      - mode
      type: object
    ObservabilityPipelineEnrichmentTableFileSchemaItems:
      description: Describes a single column and its type in an enrichment table schema.
      properties:
        column:
          description: The `items` `column`.
          example: region
          type: string
        type:
          $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileSchemaItemsType'
      required:
      - column
      - type
      type: object
    ObservabilityPipelineRsyslogSource:
      description: The `rsyslog` source listens for logs over TCP or UDP from an `rsyslog` server using the syslog protocol.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: rsyslog-source
          type: string
        mode:
          $ref: '#/components/schemas/ObservabilityPipelineSyslogSourceMode'
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineRsyslogSourceType'
      required:
      - id
      - type
      - mode
      type: object
    ObservabilityPipelineParseGrokProcessor:
      description: The `parse_grok` processor extracts structured fields from unstructured log messages using Grok patterns.
      properties:
        disable_library_rules:
          default: false
          description: If set to `true`, disables the default Grok rules provided by Datadog.
          example: true
          type: boolean
        id:
          description: A unique identifier for this processor.
          example: parse-grok-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        rules:
          description: The list of Grok parsing rules. If multiple matching rules are provided, they are evaluated in order. The first successful match is applied.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessorRule'
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      - rules
      type: object
    ObservabilityPipelineQuotaProcessorLimitEnforceType:
      description: Unit for quota enforcement in bytes for data size or events for count.
      enum:
      - bytes
      - events
      example: bytes
      type: string
      x-enum-varnames:
      - BYTES
      - EVENTS
    ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactAction:
      description: Action type that redacts part of the sensitive data while preserving a configurable number of characters, typically used for masking purposes (e.g., show last 4 digits of a credit card).
      enum:
      - partial_redact
      example: partial_redact
      type: string
      x-enum-varnames:
      - PARTIAL_REDACT
    ObservabilityPipelineRenameFieldsProcessor:
      description: The `rename_fields` processor changes field names.
  

# --- truncated at 32 KB (117 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/openapi/datadog-observability-api-openapi.yml