Grepr Grok Parsing API

openapi: 3.2.0
info:
  title: Grepr Grok Parsing API
  version: 1.0.0
  description: 'Operations tagged Grok Parsing across 2 of this provider''s published API definitions: grepr-openapi.json, grepr.json. Each path carries the servers of the definition it was published in.'
tags:
- description: Utilities for Grok pattern parsing
  name: Grok Parsing
paths:
  /v1/grok/parse:
    post:
      description: Parses a log sample using provided Grok rules and returns the extracted fields and which rule matched.
      operationId: parse_1
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GrokParseRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GrokParseResponse'
          description: Log message parsed successfully.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GrokParseErrors'
          description: Grok parsing rules are invalid or could not be compiled.
        '401':
          description: Unauthorized
      security:
      - grepr-api-key: []
      - grepr-oidc: []
      summary: Validate a log sample
      tags:
      - Grok Parsing
  /v1/grok/parse/batch:
    post:
      description: Parse slog samples using provided Grok rules and returns the extracted fields and which rule matched.
      operationId: parse
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GrokParseBatchRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GrokParseBatchResponse'
          description: Log message parsed successfully.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GrokParseErrors'
          description: Grok parsing rules are invalid or could not be compiled.
        '401':
          description: Unauthorized
      security:
      - grepr-api-key: []
      - grepr-oidc: []
      summary: Validate log samples
      tags:
      - Grok Parsing
components:
  schemas:
    DatadogQueryPredicate:
      properties:
        query:
          default: ''
          description: The datadog query used by the predicate. See https://docs.datadoghq.com/tracing/trace_explorer/query_syntax
          example: service:grepr-service-1
          type: string
        type:
          description: A predicate that checks if an event matches a datadog query.
          enum:
          - datadog-query
          type: string
      required:
      - query
      - type
      type: object
    GrokParseErrors:
      properties:
        errors:
          default: []
          items:
            $ref: '#/components/schemas/GrokRuleErrors'
          type: array
      required:
      - errors
      type: object
    GrokParseRequest:
      properties:
        grokParser:
          $ref: '#/components/schemas/GrokParser'
        logSample:
          description: Log sample to parse using the provided Grok rules.
          example: john id:12345 connected on 11/08/2017 on server XYZ in production
          type: string
      required:
      - grokParser
      - logSample
      type: object
    NewRelicQueryPredicate:
      properties:
        query:
          default: ''
          description: 'The New Relic query used by the predicate. See https://docs.newrelic.com/docs/logs/ui-data/query-syntax-logs/ '
          example: service:grepr-service-1
          type: string
        type:
          description: A predicate that checks if an event matches a New Relic query.
          enum:
          - newrelic-query
          type: string
      required:
      - query
      - type
      type: object
    GrokParseBatchResponse:
      properties:
        results:
          items:
            $ref: '#/components/schemas/GrokParseResponse'
          type: array
      type: object
    GrokParseBatchRequest:
      properties:
        grokParser:
          $ref: '#/components/schemas/GrokParser'
        logSamples:
          default: []
          description: Log sample to parse using the provided Grok rules.
          example: john id:12345 connected on 11/08/2017 on server XYZ in production
          items:
            description: Log sample to parse using the provided Grok rules.
            example: john id:12345 connected on 11/08/2017 on server XYZ in production
            type: string
          maxItems: 2147483647
          minItems: 1
          type: array
      required:
      - grokParser
      - logSamples
      type: object
    MetricEventPredicate:
      properties:
        filterTags:
          additionalProperties:
            default: {}
            description: The set of tags to query for. If unspecified, all tags are queried.
            example:
              env:
              - prod
              service:
              - my-app
            items:
              default: '{}'
              description: The set of tags to query for. If unspecified, all tags are queried.
              example: '{"service":["my-app"],"env":["prod"]}'
              type: string
            type: array
            uniqueItems: true
          default: {}
          description: The set of tags to query for. If unspecified, all tags are queried.
          example:
            env:
            - prod
            service:
            - my-app
          type: object
        metricNames:
          default: []
          description: The names of the metrics to query. Must not be empty.
          example:
          - cpu.load
          - cpu.utilization
          items:
            description: The names of the metrics to query. Must not be empty.
            example: '["cpu.load","cpu.utilization"]'
            type: string
          maxItems: 2147483647
          minItems: 1
          type: array
        query:
          type: string
        type:
          description: A predicate that checks if an event matches a metrics query.
          enum:
          - metric-predicate
          type: string
      required:
      - metricNames
      - query
      - type
      type: object
    GrokParseResponse:
      properties:
        attributes:
          additionalProperties:
            $ref: '#/components/schemas/Any'
          description: JSON object of the matched attributes.
          example:
            connect_date: 11/08/2017
            server:
              env: production
              name: XYZ
            user:
              id: 12345
              name: john
          type: object
        match:
          description: Whether a rule matched the log message.
          type: boolean
        matchingRuleName:
          description: Which rule matched the log message.
          type: string
        tags:
          additionalProperties:
            description: JSON Object of the matched tags.
            example:
              tag1:
              - value1
              - value2
              tag2:
              - value3
            items:
              description: JSON Object of the matched tags.
              example: '{"tag1":["value1","value2"],"tag2":["value3"]}'
              type: string
            type: array
            uniqueItems: true
          description: JSON Object of the matched tags.
          example:
            tag1:
            - value1
            - value2
            tag2:
            - value3
          type: object
        topLevelFields:
          additionalProperties:
            description: JSON object of the top-level fields extracted from the Grok rule. Currently, only severity and eventTimestamp can be extracted as top-level fields.
            example: '{"severity":"9","eventTimestamp":"13201984190509"}'
            type: string
          description: JSON object of the top-level fields extracted from the Grok rule. Currently, only severity and eventTimestamp can be extracted as top-level fields.
          example:
            eventTimestamp: '13201984190509'
            severity: '9'
          type: object
      required:
      - attributes
      - tags
      - topLevelFields
      type: object
    GrokRuleErrors:
      properties:
        rule:
          default: ''
          type: string
        ruleErrors:
          default: []
          items:
            $ref: '#/components/schemas/GrokRuleError'
          type: array
      type: object
    EventPredicate:
      description: Predicate applied to rows before analytical aggregation.
      discriminator:
        mapping:
          and-predicate: '#/components/schemas/AndEventPredicate'
          datadog-query: '#/components/schemas/DatadogQueryPredicate'
          metric-predicate: '#/components/schemas/MetricEventPredicate'
          newrelic-query: '#/components/schemas/NewRelicQueryPredicate'
          nrql-query: '#/components/schemas/NrqlQueryPredicate'
        propertyName: type
      oneOf:
      - $ref: '#/components/schemas/AndEventPredicate'
      - $ref: '#/components/schemas/DatadogQueryPredicate'
      - $ref: '#/components/schemas/MetricEventPredicate'
      - $ref: '#/components/schemas/NewRelicQueryPredicate'
      - $ref: '#/components/schemas/NrqlQueryPredicate'
      properties:
        query:
          type: string
        type:
          type: string
      required:
      - type
      type: object
    GrokParser:
      properties:
        extractAttribute:
          description: Optional attribute to extract. Does nothing if it does not refer to a string attribute. A dotted string, or an array of literal keys.
          oneOf:
          - type: string
          - items:
              type: string
            type: array
        grokHelperRules:
          default: []
          example:
          - user %{word:user.name} id:%{integer:user.id}
          - connection connected on %{date("MM/dd/yyyy"):connect_date}
          - server on server %{notSpace:server.name} in %{notSpace:server.env}
          items:
            example: '["user %{word:user.name} id:%{integer:user.id}","connection connected on %{date(\"MM/dd/yyyy\"):connect_date}","server on server %{notSpace:server.name} in %{notSpace:server.env}"]'
            type: string
          type: array
        grokParsingRules:
          default: []
          description: The Grok parser enriches log events by parsing unstructured text into structured attributes.
          example:
          - MyParsingRule %{user} %{connection} %{server}
          items:
            description: The Grok parser enriches log events by parsing unstructured text into structured attributes.
            example: '["MyParsingRule %{user} %{connection} %{server}"]'
            type: string
          type: array
        name:
          example: operation_name
          pattern: '[a-z0-9_]{1,128}'
          type: string
        predicate:
          $ref: '#/components/schemas/EventPredicate'
        type:
          description: Processes unstructured logs and extracts fields from them using Grok patterns.
          enum:
          - grok-parser
          type: string
      required:
      - name
      - type
      type: object
      x-tags:
      - Transforms
    GrokRuleError:
      properties:
        message:
          default: ''
          type: string
        position:
          format: int32
          type: integer
      type: object
    Any:
      description: A value that can be a primitive (String or number), a list, or a map.
      example:
      - 12
      - a
      - b: 1
      - - 1
        - 2
        - 3
    AndEventPredicate:
      properties:
        queries:
          default: []
          description: List of predicates that must all match for this predicate to match.
          items:
            $ref: '#/components/schemas/EventPredicate'
          maxItems: 2147483647
          minItems: 1
          title: Child predicates
          type: array
        type:
          description: A predicate that matches when every child predicate matches.
          enum:
          - and-predicate
          type: string
      required:
      - queries
      - type
      type: object
    NrqlQueryPredicate:
      properties:
        query:
          default: ''
          description: The Nrql query used by the predicate. See https://docs.newrelic.com/docs/nrql
          example: SELECT * FROM Log WHERE service = 'grepr-service-1'
          type: string
        strict:
          default: true
          description: Whether the query should be parsed in strict mode.
          type: boolean
        type:
          description: A predicate that checks if an event matches an NRQL query.
          enum:
          - nrql-query
          type: string
      required:
      - query
      - type
      type: object
  securitySchemes:
    grepr-api-key:
      in: header
      name: GREPR-API-KEY
      type: apiKey
    grepr-oidc:
      bearerFormat: JWT
      openIdConnectUrl: https://grepr-prod.us.auth0.com/.well-known/openid-configuration
      type: openIdConnect
x-refined-from:
- grepr-openapi.json
- grepr.json
x-tagGroups:
- name: Integrations
  tags:
  - Grepr-hosted Data Warehouse Integration
  - External S3 Data Warehouse Integration
  - Datadog Integration
  - New Relic Integration
  - Splunk Integration
  - Sumo Logic Integration
  - OpenTelemetry Integration
- name: Pipelines
  tags:
  - Jobs
  - Templates
  - Datasets
  - Status Metrics
  - External Triggers
  - Job Actions
  - Triggers
- name: Pipeline Components
  tags:
  - Operations
  - Transforms
  - Sources
  - Sinks
- name: Administration
  tags:
  - Users
  - Teams
  - Roles
  - Permission
  - Invitations
  - Activity Logs
- name: Organization
  tags:
  - Organizations
  - Access Configuration
  - Grepr API Key
  - Service Accounts
  - Signup
- name: Query & Analysis
  tags:
  - Job Anomalies
  - Grok Parsing
  - Query Parsing
  - Validation
- name: System
  tags:
  - Manifest