LogsSchemaProcessor

datadog_api_client::datadogV1::model::model_logs_schema_processor

Struct LogsSchemaProcessor 

Source 
#[non_exhaustive]
pub struct LogsSchemaProcessor {
    pub is_enabled: Option<bool>,
    pub mappers: Vec<LogsSchemaMapper>,
    pub name: String,
    pub schema: LogsSchemaData,
    pub type_: LogsSchemaProcessorType,
    pub additional_properties: BTreeMap<String, Value>,
    /* private fields */
}
Expand description

A processor that has additional validations and checks for a given schema. Currently supported schema types include OCSF.

Fields (Non-exhaustive)§

This struct is marked as non-exhaustive
Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.
§is_enabled: Option<bool>

Whether or not the processor is enabled.

§mappers: Vec<LogsSchemaMapper>

The LogsSchemaProcessor mappers.

§name: String

Name of the processor.

§schema: LogsSchemaData

Configuration of the schema data to use.

§type_: LogsSchemaProcessorType

Type of logs schema processor.

§additional_properties: BTreeMap<String, Value>

Implementations§

Source§

impl LogsSchemaProcessor

Source

pub fn new( mappers: Vec<LogsSchemaMapper>, name: String, schema: LogsSchemaData, type_: LogsSchemaProcessorType, ) -> LogsSchemaProcessor

Examples found in repository?
examples/v1_logs-pipelines_CreateLogsPipeline_501419705.rs (lines 25-209)
21async fn main() {
22    let body = LogsPipeline::new("testSchemaProcessor".to_string())
23        .filter(LogsFilter::new().query("source:python".to_string()))
24        .processors(vec![LogsProcessor::LogsSchemaProcessor(Box::new(
25            LogsSchemaProcessor::new(
26                vec![
27                    LogsSchemaMapper::LogsSchemaCategoryMapper(Box::new(
28                        LogsSchemaCategoryMapper::new(
29                            vec![
30                                LogsSchemaCategoryMapperCategory::new(
31                                    LogsFilter::new().query("@eventName:(*Create*)".to_string()),
32                                    1,
33                                    "Create".to_string(),
34                                ),
35                                LogsSchemaCategoryMapperCategory::new(
36                                    LogsFilter::new().query(
37                                        "@eventName:(ChangePassword OR PasswordUpdated)"
38                                            .to_string(),
39                                    ),
40                                    3,
41                                    "Password Change".to_string(),
42                                ),
43                                LogsSchemaCategoryMapperCategory::new(
44                                    LogsFilter::new().query("@eventName:(*Attach*)".to_string()),
45                                    7,
46                                    "Attach Policy".to_string(),
47                                ),
48                                LogsSchemaCategoryMapperCategory::new(
49                                    LogsFilter::new()
50                                        .query("@eventName:(*Detach* OR *Remove*)".to_string()),
51                                    8,
52                                    "Detach Policy".to_string(),
53                                ),
54                                LogsSchemaCategoryMapperCategory::new(
55                                    LogsFilter::new().query("@eventName:(*Delete*)".to_string()),
56                                    6,
57                                    "Delete".to_string(),
58                                ),
59                                LogsSchemaCategoryMapperCategory::new(
60                                    LogsFilter::new().query("@eventName:*".to_string()),
61                                    99,
62                                    "Other".to_string(),
63                                ),
64                            ],
65                            "activity_id and activity_name".to_string(),
66                            LogsSchemaCategoryMapperTargets::new()
67                                .id("ocsf.activity_id".to_string())
68                                .name("ocsf.activity_name".to_string()),
69                            LogsSchemaCategoryMapperType::SCHEMA_CATEGORY_MAPPER,
70                        )
71                        .fallback(
72                            LogsSchemaCategoryMapperFallback::new()
73                                .sources(BTreeMap::from([(
74                                    "ocsf.activity_name".to_string(),
75                                    vec!["eventName".to_string()],
76                                )]))
77                                .values(BTreeMap::from([
78                                    ("ocsf.activity_id".to_string(), "99".to_string()),
79                                    ("ocsf.activity_name".to_string(), "Other".to_string()),
80                                ])),
81                        ),
82                    )),
83                    LogsSchemaMapper::LogsSchemaCategoryMapper(Box::new(
84                        LogsSchemaCategoryMapper::new(
85                            vec![
86                                LogsSchemaCategoryMapperCategory::new(
87                                    LogsFilter::new().query("-@errorCode:*".to_string()),
88                                    1,
89                                    "Success".to_string(),
90                                ),
91                                LogsSchemaCategoryMapperCategory::new(
92                                    LogsFilter::new().query("@errorCode:*".to_string()),
93                                    2,
94                                    "Failure".to_string(),
95                                ),
96                            ],
97                            "status".to_string(),
98                            LogsSchemaCategoryMapperTargets::new()
99                                .id("ocsf.status_id".to_string())
100                                .name("ocsf.status".to_string()),
101                            LogsSchemaCategoryMapperType::SCHEMA_CATEGORY_MAPPER,
102                        ),
103                    )),
104                    LogsSchemaMapper::LogsSchemaCategoryMapper(Box::new(
105                        LogsSchemaCategoryMapper::new(
106                            vec![LogsSchemaCategoryMapperCategory::new(
107                                LogsFilter::new().query("@eventName:*".to_string()),
108                                1,
109                                "Informational".to_string(),
110                            )],
111                            "Set default severity".to_string(),
112                            LogsSchemaCategoryMapperTargets::new()
113                                .id("ocsf.severity_id".to_string())
114                                .name("ocsf.severity".to_string()),
115                            LogsSchemaCategoryMapperType::SCHEMA_CATEGORY_MAPPER,
116                        ),
117                    )),
118                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
119                        "Map userIdentity to ocsf.user.uid".to_string(),
120                        vec![
121                            "userIdentity.principalId".to_string(),
122                            "responseElements.role.roleId".to_string(),
123                            "responseElements.user.userId".to_string(),
124                        ],
125                        "ocsf.user.uid".to_string(),
126                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
127                    ))),
128                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
129                        "Map userName to ocsf.user.name".to_string(),
130                        vec![
131                            "requestParameters.userName".to_string(),
132                            "responseElements.role.roleName".to_string(),
133                            "requestParameters.roleName".to_string(),
134                            "responseElements.user.userName".to_string(),
135                        ],
136                        "ocsf.user.name".to_string(),
137                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
138                    ))),
139                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
140                        "Map api to ocsf.api".to_string(),
141                        vec!["api".to_string()],
142                        "ocsf.api".to_string(),
143                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
144                    ))),
145                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
146                        "Map user to ocsf.user".to_string(),
147                        vec!["user".to_string()],
148                        "ocsf.user".to_string(),
149                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
150                    ))),
151                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
152                        "Map actor to ocsf.actor".to_string(),
153                        vec!["actor".to_string()],
154                        "ocsf.actor".to_string(),
155                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
156                    ))),
157                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
158                        "Map cloud to ocsf.cloud".to_string(),
159                        vec!["cloud".to_string()],
160                        "ocsf.cloud".to_string(),
161                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
162                    ))),
163                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
164                        "Map http_request to ocsf.http_request".to_string(),
165                        vec!["http_request".to_string()],
166                        "ocsf.http_request".to_string(),
167                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
168                    ))),
169                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
170                        "Map metadata to ocsf.metadata".to_string(),
171                        vec!["metadata".to_string()],
172                        "ocsf.metadata".to_string(),
173                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
174                    ))),
175                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
176                        "Map time to ocsf.time".to_string(),
177                        vec!["time".to_string()],
178                        "ocsf.time".to_string(),
179                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
180                    ))),
181                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
182                        "Map src_endpoint to ocsf.src_endpoint".to_string(),
183                        vec!["src_endpoint".to_string()],
184                        "ocsf.src_endpoint".to_string(),
185                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
186                    ))),
187                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
188                        "Map severity to ocsf.severity".to_string(),
189                        vec!["severity".to_string()],
190                        "ocsf.severity".to_string(),
191                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
192                    ))),
193                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
194                        "Map severity_id to ocsf.severity_id".to_string(),
195                        vec!["severity_id".to_string()],
196                        "ocsf.severity_id".to_string(),
197                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
198                    ))),
199                ],
200                "Apply OCSF schema for 3001".to_string(),
201                LogsSchemaData::new(
202                    "Account Change".to_string(),
203                    3001,
204                    "ocsf".to_string(),
205                    "1.5.0".to_string(),
206                )
207                .profiles(vec!["cloud".to_string(), "datetime".to_string()]),
208                LogsSchemaProcessorType::SCHEMA_PROCESSOR,
209            )
210            .is_enabled(true),
211        ))])
212        .tags(vec![]);
213    let configuration = datadog::Configuration::new();
214    let api = LogsPipelinesAPI::with_config(configuration);
215    let resp = api.create_logs_pipeline(body).await;
216    if let Ok(value) = resp {
217        println!("{:#?}", value);
218    } else {
219        println!("{:#?}", resp.unwrap_err());
220    }
221}
More examples
Hide additional examples
examples/v1_logs-pipelines_CreateLogsPipeline_1745625064.rs (lines 26-246)
22async fn main() {
23    let body = LogsPipeline::new("testSchemaProcessor".to_string())
24        .filter(LogsFilter::new().query("source:python".to_string()))
25        .processors(vec![LogsProcessor::LogsSchemaProcessor(Box::new(
26            LogsSchemaProcessor::new(
27                vec![
28                    LogsSchemaMapper::LogsSchemaCategoryMapper(Box::new(
29                        LogsSchemaCategoryMapper::new(
30                            vec![
31                                LogsSchemaCategoryMapperCategory::new(
32                                    LogsFilter::new().query("@eventName:(*Create*)".to_string()),
33                                    1,
34                                    "Create".to_string(),
35                                ),
36                                LogsSchemaCategoryMapperCategory::new(
37                                    LogsFilter::new().query(
38                                        "@eventName:(ChangePassword OR PasswordUpdated)"
39                                            .to_string(),
40                                    ),
41                                    3,
42                                    "Password Change".to_string(),
43                                ),
44                                LogsSchemaCategoryMapperCategory::new(
45                                    LogsFilter::new().query("@eventName:(*Attach*)".to_string()),
46                                    7,
47                                    "Attach Policy".to_string(),
48                                ),
49                                LogsSchemaCategoryMapperCategory::new(
50                                    LogsFilter::new()
51                                        .query("@eventName:(*Detach* OR *Remove*)".to_string()),
52                                    8,
53                                    "Detach Policy".to_string(),
54                                ),
55                                LogsSchemaCategoryMapperCategory::new(
56                                    LogsFilter::new().query("@eventName:(*Delete*)".to_string()),
57                                    6,
58                                    "Delete".to_string(),
59                                ),
60                                LogsSchemaCategoryMapperCategory::new(
61                                    LogsFilter::new().query("@eventName:*".to_string()),
62                                    99,
63                                    "Other".to_string(),
64                                ),
65                            ],
66                            "activity_id and activity_name".to_string(),
67                            LogsSchemaCategoryMapperTargets::new()
68                                .id("ocsf.activity_id".to_string())
69                                .name("ocsf.activity_name".to_string()),
70                            LogsSchemaCategoryMapperType::SCHEMA_CATEGORY_MAPPER,
71                        )
72                        .fallback(
73                            LogsSchemaCategoryMapperFallback::new()
74                                .sources(BTreeMap::from([(
75                                    "ocsf.activity_name".to_string(),
76                                    vec!["eventName".to_string()],
77                                )]))
78                                .values(BTreeMap::from([
79                                    ("ocsf.activity_id".to_string(), "99".to_string()),
80                                    ("ocsf.activity_name".to_string(), "Other".to_string()),
81                                ])),
82                        ),
83                    )),
84                    LogsSchemaMapper::LogsSchemaCategoryMapper(Box::new(
85                        LogsSchemaCategoryMapper::new(
86                            vec![
87                                LogsSchemaCategoryMapperCategory::new(
88                                    LogsFilter::new().query("-@errorCode:*".to_string()),
89                                    1,
90                                    "Success".to_string(),
91                                ),
92                                LogsSchemaCategoryMapperCategory::new(
93                                    LogsFilter::new().query("@errorCode:*".to_string()),
94                                    2,
95                                    "Failure".to_string(),
96                                ),
97                            ],
98                            "status".to_string(),
99                            LogsSchemaCategoryMapperTargets::new()
100                                .id("ocsf.status_id".to_string())
101                                .name("ocsf.status".to_string()),
102                            LogsSchemaCategoryMapperType::SCHEMA_CATEGORY_MAPPER,
103                        ),
104                    )),
105                    LogsSchemaMapper::LogsSchemaCategoryMapper(Box::new(
106                        LogsSchemaCategoryMapper::new(
107                            vec![LogsSchemaCategoryMapperCategory::new(
108                                LogsFilter::new().query("@eventName:*".to_string()),
109                                1,
110                                "Informational".to_string(),
111                            )],
112                            "Set default severity".to_string(),
113                            LogsSchemaCategoryMapperTargets::new()
114                                .id("ocsf.severity_id".to_string())
115                                .name("ocsf.severity".to_string()),
116                            LogsSchemaCategoryMapperType::SCHEMA_CATEGORY_MAPPER,
117                        ),
118                    )),
119                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
120                        LogsSchemaRemapper::new(
121                            "Map userIdentity to ocsf.user.uid".to_string(),
122                            vec![
123                                "userIdentity.principalId".to_string(),
124                                "responseElements.role.roleId".to_string(),
125                                "responseElements.user.userId".to_string(),
126                            ],
127                            "ocsf.user.uid".to_string(),
128                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
129                        )
130                        .preserve_source(true),
131                    )),
132                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
133                        LogsSchemaRemapper::new(
134                            "Map userName to ocsf.user.name".to_string(),
135                            vec![
136                                "requestParameters.userName".to_string(),
137                                "responseElements.role.roleName".to_string(),
138                                "requestParameters.roleName".to_string(),
139                                "responseElements.user.userName".to_string(),
140                            ],
141                            "ocsf.user.name".to_string(),
142                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
143                        )
144                        .preserve_source(true),
145                    )),
146                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
147                        LogsSchemaRemapper::new(
148                            "Map api to ocsf.api".to_string(),
149                            vec!["api".to_string()],
150                            "ocsf.api".to_string(),
151                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
152                        )
153                        .preserve_source(true),
154                    )),
155                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
156                        LogsSchemaRemapper::new(
157                            "Map user to ocsf.user".to_string(),
158                            vec!["user".to_string()],
159                            "ocsf.user".to_string(),
160                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
161                        )
162                        .preserve_source(true),
163                    )),
164                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
165                        LogsSchemaRemapper::new(
166                            "Map actor to ocsf.actor".to_string(),
167                            vec!["actor".to_string()],
168                            "ocsf.actor".to_string(),
169                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
170                        )
171                        .preserve_source(true),
172                    )),
173                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
174                        LogsSchemaRemapper::new(
175                            "Map cloud to ocsf.cloud".to_string(),
176                            vec!["cloud".to_string()],
177                            "ocsf.cloud".to_string(),
178                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
179                        )
180                        .preserve_source(true),
181                    )),
182                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
183                        LogsSchemaRemapper::new(
184                            "Map http_request to ocsf.http_request".to_string(),
185                            vec!["http_request".to_string()],
186                            "ocsf.http_request".to_string(),
187                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
188                        )
189                        .preserve_source(true),
190                    )),
191                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
192                        LogsSchemaRemapper::new(
193                            "Map metadata to ocsf.metadata".to_string(),
194                            vec!["metadata".to_string()],
195                            "ocsf.metadata".to_string(),
196                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
197                        )
198                        .preserve_source(true),
199                    )),
200                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
201                        LogsSchemaRemapper::new(
202                            "Map time to ocsf.time".to_string(),
203                            vec!["time".to_string()],
204                            "ocsf.time".to_string(),
205                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
206                        )
207                        .preserve_source(true),
208                    )),
209                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
210                        LogsSchemaRemapper::new(
211                            "Map src_endpoint to ocsf.src_endpoint".to_string(),
212                            vec!["src_endpoint".to_string()],
213                            "ocsf.src_endpoint".to_string(),
214                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
215                        )
216                        .preserve_source(true),
217                    )),
218                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
219                        LogsSchemaRemapper::new(
220                            "Map severity to ocsf.severity".to_string(),
221                            vec!["severity".to_string()],
222                            "ocsf.severity".to_string(),
223                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
224                        )
225                        .preserve_source(true),
226                    )),
227                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
228                        LogsSchemaRemapper::new(
229                            "Map severity_id to ocsf.severity_id".to_string(),
230                            vec!["severity_id".to_string()],
231                            "ocsf.severity_id".to_string(),
232                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
233                        )
234                        .preserve_source(true),
235                    )),
236                ],
237                "Apply OCSF schema for 3001".to_string(),
238                LogsSchemaData::new(
239                    "Account Change".to_string(),
240                    3001,
241                    "ocsf".to_string(),
242                    "1.5.0".to_string(),
243                )
244                .profiles(vec!["cloud".to_string(), "datetime".to_string()]),
245                LogsSchemaProcessorType::SCHEMA_PROCESSOR,
246            )
247            .is_enabled(true),
248        ))])
249        .tags(vec![]);
250    let configuration = datadog::Configuration::new();
251    let api = LogsPipelinesAPI::with_config(configuration);
252    let resp = api.create_logs_pipeline(body).await;
253    if let Ok(value) = resp {
254        println!("{:#?}", value);
255    } else {
256        println!("{:#?}", resp.unwrap_err());
257    }
258}
examples/v1_logs-pipelines_CreateLogsPipeline_2256674867.rs (lines 26-246)
22async fn main() {
23    let body = LogsPipeline::new("testSchemaProcessor".to_string())
24        .filter(LogsFilter::new().query("source:python".to_string()))
25        .processors(vec![LogsProcessor::LogsSchemaProcessor(Box::new(
26            LogsSchemaProcessor::new(
27                vec![
28                    LogsSchemaMapper::LogsSchemaCategoryMapper(Box::new(
29                        LogsSchemaCategoryMapper::new(
30                            vec![
31                                LogsSchemaCategoryMapperCategory::new(
32                                    LogsFilter::new().query("@eventName:(*Create*)".to_string()),
33                                    1,
34                                    "Create".to_string(),
35                                ),
36                                LogsSchemaCategoryMapperCategory::new(
37                                    LogsFilter::new().query(
38                                        "@eventName:(ChangePassword OR PasswordUpdated)"
39                                            .to_string(),
40                                    ),
41                                    3,
42                                    "Password Change".to_string(),
43                                ),
44                                LogsSchemaCategoryMapperCategory::new(
45                                    LogsFilter::new().query("@eventName:(*Attach*)".to_string()),
46                                    7,
47                                    "Attach Policy".to_string(),
48                                ),
49                                LogsSchemaCategoryMapperCategory::new(
50                                    LogsFilter::new()
51                                        .query("@eventName:(*Detach* OR *Remove*)".to_string()),
52                                    8,
53                                    "Detach Policy".to_string(),
54                                ),
55                                LogsSchemaCategoryMapperCategory::new(
56                                    LogsFilter::new().query("@eventName:(*Delete*)".to_string()),
57                                    6,
58                                    "Delete".to_string(),
59                                ),
60                                LogsSchemaCategoryMapperCategory::new(
61                                    LogsFilter::new().query("@eventName:*".to_string()),
62                                    99,
63                                    "Other".to_string(),
64                                ),
65                            ],
66                            "activity_id and activity_name".to_string(),
67                            LogsSchemaCategoryMapperTargets::new()
68                                .id("ocsf.activity_id".to_string())
69                                .name("ocsf.activity_name".to_string()),
70                            LogsSchemaCategoryMapperType::SCHEMA_CATEGORY_MAPPER,
71                        )
72                        .fallback(
73                            LogsSchemaCategoryMapperFallback::new()
74                                .sources(BTreeMap::from([(
75                                    "ocsf.activity_name".to_string(),
76                                    vec!["eventName".to_string()],
77                                )]))
78                                .values(BTreeMap::from([
79                                    ("ocsf.activity_id".to_string(), "99".to_string()),
80                                    ("ocsf.activity_name".to_string(), "Other".to_string()),
81                                ])),
82                        ),
83                    )),
84                    LogsSchemaMapper::LogsSchemaCategoryMapper(Box::new(
85                        LogsSchemaCategoryMapper::new(
86                            vec![
87                                LogsSchemaCategoryMapperCategory::new(
88                                    LogsFilter::new().query("-@errorCode:*".to_string()),
89                                    1,
90                                    "Success".to_string(),
91                                ),
92                                LogsSchemaCategoryMapperCategory::new(
93                                    LogsFilter::new().query("@errorCode:*".to_string()),
94                                    2,
95                                    "Failure".to_string(),
96                                ),
97                            ],
98                            "status".to_string(),
99                            LogsSchemaCategoryMapperTargets::new()
100                                .id("ocsf.status_id".to_string())
101                                .name("ocsf.status".to_string()),
102                            LogsSchemaCategoryMapperType::SCHEMA_CATEGORY_MAPPER,
103                        ),
104                    )),
105                    LogsSchemaMapper::LogsSchemaCategoryMapper(Box::new(
106                        LogsSchemaCategoryMapper::new(
107                            vec![LogsSchemaCategoryMapperCategory::new(
108                                LogsFilter::new().query("@eventName:*".to_string()),
109                                1,
110                                "Informational".to_string(),
111                            )],
112                            "Set default severity".to_string(),
113                            LogsSchemaCategoryMapperTargets::new()
114                                .id("ocsf.severity_id".to_string())
115                                .name("ocsf.severity".to_string()),
116                            LogsSchemaCategoryMapperType::SCHEMA_CATEGORY_MAPPER,
117                        ),
118                    )),
119                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
120                        LogsSchemaRemapper::new(
121                            "Map userIdentity to ocsf.user.uid".to_string(),
122                            vec![
123                                "userIdentity.principalId".to_string(),
124                                "responseElements.role.roleId".to_string(),
125                                "responseElements.user.userId".to_string(),
126                            ],
127                            "ocsf.user.uid".to_string(),
128                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
129                        )
130                        .preserve_source(false),
131                    )),
132                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
133                        LogsSchemaRemapper::new(
134                            "Map userName to ocsf.user.name".to_string(),
135                            vec![
136                                "requestParameters.userName".to_string(),
137                                "responseElements.role.roleName".to_string(),
138                                "requestParameters.roleName".to_string(),
139                                "responseElements.user.userName".to_string(),
140                            ],
141                            "ocsf.user.name".to_string(),
142                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
143                        )
144                        .preserve_source(false),
145                    )),
146                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
147                        LogsSchemaRemapper::new(
148                            "Map api to ocsf.api".to_string(),
149                            vec!["api".to_string()],
150                            "ocsf.api".to_string(),
151                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
152                        )
153                        .preserve_source(false),
154                    )),
155                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
156                        LogsSchemaRemapper::new(
157                            "Map user to ocsf.user".to_string(),
158                            vec!["user".to_string()],
159                            "ocsf.user".to_string(),
160                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
161                        )
162                        .preserve_source(false),
163                    )),
164                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
165                        LogsSchemaRemapper::new(
166                            "Map actor to ocsf.actor".to_string(),
167                            vec!["actor".to_string()],
168                            "ocsf.actor".to_string(),
169                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
170                        )
171                        .preserve_source(false),
172                    )),
173                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
174                        LogsSchemaRemapper::new(
175                            "Map cloud to ocsf.cloud".to_string(),
176                            vec!["cloud".to_string()],
177                            "ocsf.cloud".to_string(),
178                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
179                        )
180                        .preserve_source(false),
181                    )),
182                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
183                        LogsSchemaRemapper::new(
184                            "Map http_request to ocsf.http_request".to_string(),
185                            vec!["http_request".to_string()],
186                            "ocsf.http_request".to_string(),
187                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
188                        )
189                        .preserve_source(false),
190                    )),
191                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
192                        LogsSchemaRemapper::new(
193                            "Map metadata to ocsf.metadata".to_string(),
194                            vec!["metadata".to_string()],
195                            "ocsf.metadata".to_string(),
196                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
197                        )
198                        .preserve_source(false),
199                    )),
200                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
201                        LogsSchemaRemapper::new(
202                            "Map time to ocsf.time".to_string(),
203                            vec!["time".to_string()],
204                            "ocsf.time".to_string(),
205                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
206                        )
207                        .preserve_source(false),
208                    )),
209                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
210                        LogsSchemaRemapper::new(
211                            "Map src_endpoint to ocsf.src_endpoint".to_string(),
212                            vec!["src_endpoint".to_string()],
213                            "ocsf.src_endpoint".to_string(),
214                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
215                        )
216                        .preserve_source(false),
217                    )),
218                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
219                        LogsSchemaRemapper::new(
220                            "Map severity to ocsf.severity".to_string(),
221                            vec!["severity".to_string()],
222                            "ocsf.severity".to_string(),
223                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
224                        )
225                        .preserve_source(false),
226                    )),
227                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
228                        LogsSchemaRemapper::new(
229                            "Map severity_id to ocsf.severity_id".to_string(),
230                            vec!["severity_id".to_string()],
231                            "ocsf.severity_id".to_string(),
232                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
233                        )
234                        .preserve_source(false),
235                    )),
236                ],
237                "Apply OCSF schema for 3001".to_string(),
238                LogsSchemaData::new(
239                    "Account Change".to_string(),
240                    3001,
241                    "ocsf".to_string(),
242                    "1.5.0".to_string(),
243                )
244                .profiles(vec!["cloud".to_string(), "datetime".to_string()]),
245                LogsSchemaProcessorType::SCHEMA_PROCESSOR,
246            )
247            .is_enabled(true),
248        ))])
249        .tags(vec![]);
250    let configuration = datadog::Configuration::new();
251    let api = LogsPipelinesAPI::with_config(configuration);
252    let resp = api.create_logs_pipeline(body).await;
253    if let Ok(value) = resp {
254        println!("{:#?}", value);
255    } else {
256        println!("{:#?}", resp.unwrap_err());
257    }
258}
Source

pub fn is_enabled(self, value: bool) -> Self

Examples found in repository?
examples/v1_logs-pipelines_CreateLogsPipeline_501419705.rs (line 210)
21async fn main() {
22    let body = LogsPipeline::new("testSchemaProcessor".to_string())
23        .filter(LogsFilter::new().query("source:python".to_string()))
24        .processors(vec![LogsProcessor::LogsSchemaProcessor(Box::new(
25            LogsSchemaProcessor::new(
26                vec![
27                    LogsSchemaMapper::LogsSchemaCategoryMapper(Box::new(
28                        LogsSchemaCategoryMapper::new(
29                            vec![
30                                LogsSchemaCategoryMapperCategory::new(
31                                    LogsFilter::new().query("@eventName:(*Create*)".to_string()),
32                                    1,
33                                    "Create".to_string(),
34                                ),
35                                LogsSchemaCategoryMapperCategory::new(
36                                    LogsFilter::new().query(
37                                        "@eventName:(ChangePassword OR PasswordUpdated)"
38                                            .to_string(),
39                                    ),
40                                    3,
41                                    "Password Change".to_string(),
42                                ),
43                                LogsSchemaCategoryMapperCategory::new(
44                                    LogsFilter::new().query("@eventName:(*Attach*)".to_string()),
45                                    7,
46                                    "Attach Policy".to_string(),
47                                ),
48                                LogsSchemaCategoryMapperCategory::new(
49                                    LogsFilter::new()
50                                        .query("@eventName:(*Detach* OR *Remove*)".to_string()),
51                                    8,
52                                    "Detach Policy".to_string(),
53                                ),
54                                LogsSchemaCategoryMapperCategory::new(
55                                    LogsFilter::new().query("@eventName:(*Delete*)".to_string()),
56                                    6,
57                                    "Delete".to_string(),
58                                ),
59                                LogsSchemaCategoryMapperCategory::new(
60                                    LogsFilter::new().query("@eventName:*".to_string()),
61                                    99,
62                                    "Other".to_string(),
63                                ),
64                            ],
65                            "activity_id and activity_name".to_string(),
66                            LogsSchemaCategoryMapperTargets::new()
67                                .id("ocsf.activity_id".to_string())
68                                .name("ocsf.activity_name".to_string()),
69                            LogsSchemaCategoryMapperType::SCHEMA_CATEGORY_MAPPER,
70                        )
71                        .fallback(
72                            LogsSchemaCategoryMapperFallback::new()
73                                .sources(BTreeMap::from([(
74                                    "ocsf.activity_name".to_string(),
75                                    vec!["eventName".to_string()],
76                                )]))
77                                .values(BTreeMap::from([
78                                    ("ocsf.activity_id".to_string(), "99".to_string()),
79                                    ("ocsf.activity_name".to_string(), "Other".to_string()),
80                                ])),
81                        ),
82                    )),
83                    LogsSchemaMapper::LogsSchemaCategoryMapper(Box::new(
84                        LogsSchemaCategoryMapper::new(
85                            vec![
86                                LogsSchemaCategoryMapperCategory::new(
87                                    LogsFilter::new().query("-@errorCode:*".to_string()),
88                                    1,
89                                    "Success".to_string(),
90                                ),
91                                LogsSchemaCategoryMapperCategory::new(
92                                    LogsFilter::new().query("@errorCode:*".to_string()),
93                                    2,
94                                    "Failure".to_string(),
95                                ),
96                            ],
97                            "status".to_string(),
98                            LogsSchemaCategoryMapperTargets::new()
99                                .id("ocsf.status_id".to_string())
100                                .name("ocsf.status".to_string()),
101                            LogsSchemaCategoryMapperType::SCHEMA_CATEGORY_MAPPER,
102                        ),
103                    )),
104                    LogsSchemaMapper::LogsSchemaCategoryMapper(Box::new(
105                        LogsSchemaCategoryMapper::new(
106                            vec![LogsSchemaCategoryMapperCategory::new(
107                                LogsFilter::new().query("@eventName:*".to_string()),
108                                1,
109                                "Informational".to_string(),
110                            )],
111                            "Set default severity".to_string(),
112                            LogsSchemaCategoryMapperTargets::new()
113                                .id("ocsf.severity_id".to_string())
114                                .name("ocsf.severity".to_string()),
115                            LogsSchemaCategoryMapperType::SCHEMA_CATEGORY_MAPPER,
116                        ),
117                    )),
118                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
119                        "Map userIdentity to ocsf.user.uid".to_string(),
120                        vec![
121                            "userIdentity.principalId".to_string(),
122                            "responseElements.role.roleId".to_string(),
123                            "responseElements.user.userId".to_string(),
124                        ],
125                        "ocsf.user.uid".to_string(),
126                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
127                    ))),
128                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
129                        "Map userName to ocsf.user.name".to_string(),
130                        vec![
131                            "requestParameters.userName".to_string(),
132                            "responseElements.role.roleName".to_string(),
133                            "requestParameters.roleName".to_string(),
134                            "responseElements.user.userName".to_string(),
135                        ],
136                        "ocsf.user.name".to_string(),
137                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
138                    ))),
139                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
140                        "Map api to ocsf.api".to_string(),
141                        vec!["api".to_string()],
142                        "ocsf.api".to_string(),
143                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
144                    ))),
145                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
146                        "Map user to ocsf.user".to_string(),
147                        vec!["user".to_string()],
148                        "ocsf.user".to_string(),
149                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
150                    ))),
151                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
152                        "Map actor to ocsf.actor".to_string(),
153                        vec!["actor".to_string()],
154                        "ocsf.actor".to_string(),
155                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
156                    ))),
157                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
158                        "Map cloud to ocsf.cloud".to_string(),
159                        vec!["cloud".to_string()],
160                        "ocsf.cloud".to_string(),
161                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
162                    ))),
163                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
164                        "Map http_request to ocsf.http_request".to_string(),
165                        vec!["http_request".to_string()],
166                        "ocsf.http_request".to_string(),
167                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
168                    ))),
169                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
170                        "Map metadata to ocsf.metadata".to_string(),
171                        vec!["metadata".to_string()],
172                        "ocsf.metadata".to_string(),
173                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
174                    ))),
175                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
176                        "Map time to ocsf.time".to_string(),
177                        vec!["time".to_string()],
178                        "ocsf.time".to_string(),
179                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
180                    ))),
181                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
182                        "Map src_endpoint to ocsf.src_endpoint".to_string(),
183                        vec!["src_endpoint".to_string()],
184                        "ocsf.src_endpoint".to_string(),
185                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
186                    ))),
187                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
188                        "Map severity to ocsf.severity".to_string(),
189                        vec!["severity".to_string()],
190                        "ocsf.severity".to_string(),
191                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
192                    ))),
193                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(LogsSchemaRemapper::new(
194                        "Map severity_id to ocsf.severity_id".to_string(),
195                        vec!["severity_id".to_string()],
196                        "ocsf.severity_id".to_string(),
197                        LogsSchemaRemapperType::SCHEMA_REMAPPER,
198                    ))),
199                ],
200                "Apply OCSF schema for 3001".to_string(),
201                LogsSchemaData::new(
202                    "Account Change".to_string(),
203                    3001,
204                    "ocsf".to_string(),
205                    "1.5.0".to_string(),
206                )
207                .profiles(vec!["cloud".to_string(), "datetime".to_string()]),
208                LogsSchemaProcessorType::SCHEMA_PROCESSOR,
209            )
210            .is_enabled(true),
211        ))])
212        .tags(vec![]);
213    let configuration = datadog::Configuration::new();
214    let api = LogsPipelinesAPI::with_config(configuration);
215    let resp = api.create_logs_pipeline(body).await;
216    if let Ok(value) = resp {
217        println!("{:#?}", value);
218    } else {
219        println!("{:#?}", resp.unwrap_err());
220    }
221}
More examples
Hide additional examples
examples/v1_logs-pipelines_CreateLogsPipeline_1745625064.rs (line 247)
22async fn main() {
23    let body = LogsPipeline::new("testSchemaProcessor".to_string())
24        .filter(LogsFilter::new().query("source:python".to_string()))
25        .processors(vec![LogsProcessor::LogsSchemaProcessor(Box::new(
26            LogsSchemaProcessor::new(
27                vec![
28                    LogsSchemaMapper::LogsSchemaCategoryMapper(Box::new(
29                        LogsSchemaCategoryMapper::new(
30                            vec![
31                                LogsSchemaCategoryMapperCategory::new(
32                                    LogsFilter::new().query("@eventName:(*Create*)".to_string()),
33                                    1,
34                                    "Create".to_string(),
35                                ),
36                                LogsSchemaCategoryMapperCategory::new(
37                                    LogsFilter::new().query(
38                                        "@eventName:(ChangePassword OR PasswordUpdated)"
39                                            .to_string(),
40                                    ),
41                                    3,
42                                    "Password Change".to_string(),
43                                ),
44                                LogsSchemaCategoryMapperCategory::new(
45                                    LogsFilter::new().query("@eventName:(*Attach*)".to_string()),
46                                    7,
47                                    "Attach Policy".to_string(),
48                                ),
49                                LogsSchemaCategoryMapperCategory::new(
50                                    LogsFilter::new()
51                                        .query("@eventName:(*Detach* OR *Remove*)".to_string()),
52                                    8,
53                                    "Detach Policy".to_string(),
54                                ),
55                                LogsSchemaCategoryMapperCategory::new(
56                                    LogsFilter::new().query("@eventName:(*Delete*)".to_string()),
57                                    6,
58                                    "Delete".to_string(),
59                                ),
60                                LogsSchemaCategoryMapperCategory::new(
61                                    LogsFilter::new().query("@eventName:*".to_string()),
62                                    99,
63                                    "Other".to_string(),
64                                ),
65                            ],
66                            "activity_id and activity_name".to_string(),
67                            LogsSchemaCategoryMapperTargets::new()
68                                .id("ocsf.activity_id".to_string())
69                                .name("ocsf.activity_name".to_string()),
70                            LogsSchemaCategoryMapperType::SCHEMA_CATEGORY_MAPPER,
71                        )
72                        .fallback(
73                            LogsSchemaCategoryMapperFallback::new()
74                                .sources(BTreeMap::from([(
75                                    "ocsf.activity_name".to_string(),
76                                    vec!["eventName".to_string()],
77                                )]))
78                                .values(BTreeMap::from([
79                                    ("ocsf.activity_id".to_string(), "99".to_string()),
80                                    ("ocsf.activity_name".to_string(), "Other".to_string()),
81                                ])),
82                        ),
83                    )),
84                    LogsSchemaMapper::LogsSchemaCategoryMapper(Box::new(
85                        LogsSchemaCategoryMapper::new(
86                            vec![
87                                LogsSchemaCategoryMapperCategory::new(
88                                    LogsFilter::new().query("-@errorCode:*".to_string()),
89                                    1,
90                                    "Success".to_string(),
91                                ),
92                                LogsSchemaCategoryMapperCategory::new(
93                                    LogsFilter::new().query("@errorCode:*".to_string()),
94                                    2,
95                                    "Failure".to_string(),
96                                ),
97                            ],
98                            "status".to_string(),
99                            LogsSchemaCategoryMapperTargets::new()
100                                .id("ocsf.status_id".to_string())
101                                .name("ocsf.status".to_string()),
102                            LogsSchemaCategoryMapperType::SCHEMA_CATEGORY_MAPPER,
103                        ),
104                    )),
105                    LogsSchemaMapper::LogsSchemaCategoryMapper(Box::new(
106                        LogsSchemaCategoryMapper::new(
107                            vec![LogsSchemaCategoryMapperCategory::new(
108                                LogsFilter::new().query("@eventName:*".to_string()),
109                                1,
110                                "Informational".to_string(),
111                            )],
112                            "Set default severity".to_string(),
113                            LogsSchemaCategoryMapperTargets::new()
114                                .id("ocsf.severity_id".to_string())
115                                .name("ocsf.severity".to_string()),
116                            LogsSchemaCategoryMapperType::SCHEMA_CATEGORY_MAPPER,
117                        ),
118                    )),
119                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
120                        LogsSchemaRemapper::new(
121                            "Map userIdentity to ocsf.user.uid".to_string(),
122                            vec![
123                                "userIdentity.principalId".to_string(),
124                                "responseElements.role.roleId".to_string(),
125                                "responseElements.user.userId".to_string(),
126                            ],
127                            "ocsf.user.uid".to_string(),
128                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
129                        )
130                        .preserve_source(true),
131                    )),
132                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
133                        LogsSchemaRemapper::new(
134                            "Map userName to ocsf.user.name".to_string(),
135                            vec![
136                                "requestParameters.userName".to_string(),
137                                "responseElements.role.roleName".to_string(),
138                                "requestParameters.roleName".to_string(),
139                                "responseElements.user.userName".to_string(),
140                            ],
141                            "ocsf.user.name".to_string(),
142                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
143                        )
144                        .preserve_source(true),
145                    )),
146                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
147                        LogsSchemaRemapper::new(
148                            "Map api to ocsf.api".to_string(),
149                            vec!["api".to_string()],
150                            "ocsf.api".to_string(),
151                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
152                        )
153                        .preserve_source(true),
154                    )),
155                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
156                        LogsSchemaRemapper::new(
157                            "Map user to ocsf.user".to_string(),
158                            vec!["user".to_string()],
159                            "ocsf.user".to_string(),
160                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
161                        )
162                        .preserve_source(true),
163                    )),
164                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
165                        LogsSchemaRemapper::new(
166                            "Map actor to ocsf.actor".to_string(),
167                            vec!["actor".to_string()],
168                            "ocsf.actor".to_string(),
169                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
170                        )
171                        .preserve_source(true),
172                    )),
173                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
174                        LogsSchemaRemapper::new(
175                            "Map cloud to ocsf.cloud".to_string(),
176                            vec!["cloud".to_string()],
177                            "ocsf.cloud".to_string(),
178                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
179                        )
180                        .preserve_source(true),
181                    )),
182                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
183                        LogsSchemaRemapper::new(
184                            "Map http_request to ocsf.http_request".to_string(),
185                            vec!["http_request".to_string()],
186                            "ocsf.http_request".to_string(),
187                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
188                        )
189                        .preserve_source(true),
190                    )),
191                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
192                        LogsSchemaRemapper::new(
193                            "Map metadata to ocsf.metadata".to_string(),
194                            vec!["metadata".to_string()],
195                            "ocsf.metadata".to_string(),
196                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
197                        )
198                        .preserve_source(true),
199                    )),
200                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
201                        LogsSchemaRemapper::new(
202                            "Map time to ocsf.time".to_string(),
203                            vec!["time".to_string()],
204                            "ocsf.time".to_string(),
205                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
206                        )
207                        .preserve_source(true),
208                    )),
209                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
210                        LogsSchemaRemapper::new(
211                            "Map src_endpoint to ocsf.src_endpoint".to_string(),
212                            vec!["src_endpoint".to_string()],
213                            "ocsf.src_endpoint".to_string(),
214                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
215                        )
216                        .preserve_source(true),
217                    )),
218                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
219                        LogsSchemaRemapper::new(
220                            "Map severity to ocsf.severity".to_string(),
221                            vec!["severity".to_string()],
222                            "ocsf.severity".to_string(),
223                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
224                        )
225                        .preserve_source(true),
226                    )),
227                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
228                        LogsSchemaRemapper::new(
229                            "Map severity_id to ocsf.severity_id".to_string(),
230                            vec!["severity_id".to_string()],
231                            "ocsf.severity_id".to_string(),
232                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
233                        )
234                        .preserve_source(true),
235                    )),
236                ],
237                "Apply OCSF schema for 3001".to_string(),
238                LogsSchemaData::new(
239                    "Account Change".to_string(),
240                    3001,
241                    "ocsf".to_string(),
242                    "1.5.0".to_string(),
243                )
244                .profiles(vec!["cloud".to_string(), "datetime".to_string()]),
245                LogsSchemaProcessorType::SCHEMA_PROCESSOR,
246            )
247            .is_enabled(true),
248        ))])
249        .tags(vec![]);
250    let configuration = datadog::Configuration::new();
251    let api = LogsPipelinesAPI::with_config(configuration);
252    let resp = api.create_logs_pipeline(body).await;
253    if let Ok(value) = resp {
254        println!("{:#?}", value);
255    } else {
256        println!("{:#?}", resp.unwrap_err());
257    }
258}
examples/v1_logs-pipelines_CreateLogsPipeline_2256674867.rs (line 247)
22async fn main() {
23    let body = LogsPipeline::new("testSchemaProcessor".to_string())
24        .filter(LogsFilter::new().query("source:python".to_string()))
25        .processors(vec![LogsProcessor::LogsSchemaProcessor(Box::new(
26            LogsSchemaProcessor::new(
27                vec![
28                    LogsSchemaMapper::LogsSchemaCategoryMapper(Box::new(
29                        LogsSchemaCategoryMapper::new(
30                            vec![
31                                LogsSchemaCategoryMapperCategory::new(
32                                    LogsFilter::new().query("@eventName:(*Create*)".to_string()),
33                                    1,
34                                    "Create".to_string(),
35                                ),
36                                LogsSchemaCategoryMapperCategory::new(
37                                    LogsFilter::new().query(
38                                        "@eventName:(ChangePassword OR PasswordUpdated)"
39                                            .to_string(),
40                                    ),
41                                    3,
42                                    "Password Change".to_string(),
43                                ),
44                                LogsSchemaCategoryMapperCategory::new(
45                                    LogsFilter::new().query("@eventName:(*Attach*)".to_string()),
46                                    7,
47                                    "Attach Policy".to_string(),
48                                ),
49                                LogsSchemaCategoryMapperCategory::new(
50                                    LogsFilter::new()
51                                        .query("@eventName:(*Detach* OR *Remove*)".to_string()),
52                                    8,
53                                    "Detach Policy".to_string(),
54                                ),
55                                LogsSchemaCategoryMapperCategory::new(
56                                    LogsFilter::new().query("@eventName:(*Delete*)".to_string()),
57                                    6,
58                                    "Delete".to_string(),
59                                ),
60                                LogsSchemaCategoryMapperCategory::new(
61                                    LogsFilter::new().query("@eventName:*".to_string()),
62                                    99,
63                                    "Other".to_string(),
64                                ),
65                            ],
66                            "activity_id and activity_name".to_string(),
67                            LogsSchemaCategoryMapperTargets::new()
68                                .id("ocsf.activity_id".to_string())
69                                .name("ocsf.activity_name".to_string()),
70                            LogsSchemaCategoryMapperType::SCHEMA_CATEGORY_MAPPER,
71                        )
72                        .fallback(
73                            LogsSchemaCategoryMapperFallback::new()
74                                .sources(BTreeMap::from([(
75                                    "ocsf.activity_name".to_string(),
76                                    vec!["eventName".to_string()],
77                                )]))
78                                .values(BTreeMap::from([
79                                    ("ocsf.activity_id".to_string(), "99".to_string()),
80                                    ("ocsf.activity_name".to_string(), "Other".to_string()),
81                                ])),
82                        ),
83                    )),
84                    LogsSchemaMapper::LogsSchemaCategoryMapper(Box::new(
85                        LogsSchemaCategoryMapper::new(
86                            vec![
87                                LogsSchemaCategoryMapperCategory::new(
88                                    LogsFilter::new().query("-@errorCode:*".to_string()),
89                                    1,
90                                    "Success".to_string(),
91                                ),
92                                LogsSchemaCategoryMapperCategory::new(
93                                    LogsFilter::new().query("@errorCode:*".to_string()),
94                                    2,
95                                    "Failure".to_string(),
96                                ),
97                            ],
98                            "status".to_string(),
99                            LogsSchemaCategoryMapperTargets::new()
100                                .id("ocsf.status_id".to_string())
101                                .name("ocsf.status".to_string()),
102                            LogsSchemaCategoryMapperType::SCHEMA_CATEGORY_MAPPER,
103                        ),
104                    )),
105                    LogsSchemaMapper::LogsSchemaCategoryMapper(Box::new(
106                        LogsSchemaCategoryMapper::new(
107                            vec![LogsSchemaCategoryMapperCategory::new(
108                                LogsFilter::new().query("@eventName:*".to_string()),
109                                1,
110                                "Informational".to_string(),
111                            )],
112                            "Set default severity".to_string(),
113                            LogsSchemaCategoryMapperTargets::new()
114                                .id("ocsf.severity_id".to_string())
115                                .name("ocsf.severity".to_string()),
116                            LogsSchemaCategoryMapperType::SCHEMA_CATEGORY_MAPPER,
117                        ),
118                    )),
119                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
120                        LogsSchemaRemapper::new(
121                            "Map userIdentity to ocsf.user.uid".to_string(),
122                            vec![
123                                "userIdentity.principalId".to_string(),
124                                "responseElements.role.roleId".to_string(),
125                                "responseElements.user.userId".to_string(),
126                            ],
127                            "ocsf.user.uid".to_string(),
128                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
129                        )
130                        .preserve_source(false),
131                    )),
132                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
133                        LogsSchemaRemapper::new(
134                            "Map userName to ocsf.user.name".to_string(),
135                            vec![
136                                "requestParameters.userName".to_string(),
137                                "responseElements.role.roleName".to_string(),
138                                "requestParameters.roleName".to_string(),
139                                "responseElements.user.userName".to_string(),
140                            ],
141                            "ocsf.user.name".to_string(),
142                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
143                        )
144                        .preserve_source(false),
145                    )),
146                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
147                        LogsSchemaRemapper::new(
148                            "Map api to ocsf.api".to_string(),
149                            vec!["api".to_string()],
150                            "ocsf.api".to_string(),
151                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
152                        )
153                        .preserve_source(false),
154                    )),
155                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
156                        LogsSchemaRemapper::new(
157                            "Map user to ocsf.user".to_string(),
158                            vec!["user".to_string()],
159                            "ocsf.user".to_string(),
160                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
161                        )
162                        .preserve_source(false),
163                    )),
164                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
165                        LogsSchemaRemapper::new(
166                            "Map actor to ocsf.actor".to_string(),
167                            vec!["actor".to_string()],
168                            "ocsf.actor".to_string(),
169                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
170                        )
171                        .preserve_source(false),
172                    )),
173                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
174                        LogsSchemaRemapper::new(
175                            "Map cloud to ocsf.cloud".to_string(),
176                            vec!["cloud".to_string()],
177                            "ocsf.cloud".to_string(),
178                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
179                        )
180                        .preserve_source(false),
181                    )),
182                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
183                        LogsSchemaRemapper::new(
184                            "Map http_request to ocsf.http_request".to_string(),
185                            vec!["http_request".to_string()],
186                            "ocsf.http_request".to_string(),
187                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
188                        )
189                        .preserve_source(false),
190                    )),
191                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
192                        LogsSchemaRemapper::new(
193                            "Map metadata to ocsf.metadata".to_string(),
194                            vec!["metadata".to_string()],
195                            "ocsf.metadata".to_string(),
196                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
197                        )
198                        .preserve_source(false),
199                    )),
200                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
201                        LogsSchemaRemapper::new(
202                            "Map time to ocsf.time".to_string(),
203                            vec!["time".to_string()],
204                            "ocsf.time".to_string(),
205                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
206                        )
207                        .preserve_source(false),
208                    )),
209                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
210                        LogsSchemaRemapper::new(
211                            "Map src_endpoint to ocsf.src_endpoint".to_string(),
212                            vec!["src_endpoint".to_string()],
213                            "ocsf.src_endpoint".to_string(),
214                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
215                        )
216                        .preserve_source(false),
217                    )),
218                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
219                        LogsSchemaRemapper::new(
220                            "Map severity to ocsf.severity".to_string(),
221                            vec!["severity".to_string()],
222                            "ocsf.severity".to_string(),
223                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
224                        )
225                        .preserve_source(false),
226                    )),
227                    LogsSchemaMapper::LogsSchemaRemapper(Box::new(
228                        LogsSchemaRemapper::new(
229                            "Map severity_id to ocsf.severity_id".to_string(),
230                            vec!["severity_id".to_string()],
231                            "ocsf.severity_id".to_string(),
232                            LogsSchemaRemapperType::SCHEMA_REMAPPER,
233                        )
234                        .preserve_source(false),
235                    )),
236                ],
237                "Apply OCSF schema for 3001".to_string(),
238                LogsSchemaData::new(
239                    "Account Change".to_string(),
240                    3001,
241                    "ocsf".to_string(),
242                    "1.5.0".to_string(),
243                )
244                .profiles(vec!["cloud".to_string(), "datetime".to_string()]),
245                LogsSchemaProcessorType::SCHEMA_PROCESSOR,
246            )
247            .is_enabled(true),
248        ))])
249        .tags(vec![]);
250    let configuration = datadog::Configuration::new();
251    let api = LogsPipelinesAPI::with_config(configuration);
252    let resp = api.create_logs_pipeline(body).await;
253    if let Ok(value) = resp {
254        println!("{:#?}", value);
255    } else {
256        println!("{:#?}", resp.unwrap_err());
257    }
258}
Source

pub fn additional_properties(self, value: BTreeMap<String, Value>) -> Self

Trait Implementations§

Source§

impl Clone for LogsSchemaProcessor

Source§

fn clone(&self) -> LogsSchemaProcessor

Returns a duplicate of the value. Read more
1.0.0 · Source§

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source. Read more
Source§

impl Debug for LogsSchemaProcessor

Source§

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter. Read more
Source§

impl<'de> Deserialize<'de> for LogsSchemaProcessor

Source§

fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
where D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer. Read more
Source§

impl PartialEq for LogsSchemaProcessor

Source§

fn eq(&self, other: &LogsSchemaProcessor) -> bool

Tests for self and other values to be equal, and is used by ==.
1.0.0 · Source§

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.
Source§

impl Serialize for LogsSchemaProcessor

Source§

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>
where __S: Serializer,

Serialize this value into the given Serde serializer. Read more
Source§

impl StructuralPartialEq for LogsSchemaProcessor

Auto Trait Implementations§

Blanket Implementations§

Source§

impl<T> Any for T
where T: 'static + ?Sized,

Source§

fn type_id(&self) -> TypeId

Gets the TypeId of self. Read more
Source§

impl<T> Borrow<T> for T
where T: ?Sized,

Source§

fn borrow(&self) -> &T

Immutably borrows from an owned value. Read more
Source§

impl<T> BorrowMut<T> for T
where T: ?Sized,

Source§

fn borrow_mut(&mut self) -> &mut T

Mutably borrows from an owned value. Read more
Source§

impl<T> CloneToUninit for T
where T: Clone,

Source§

unsafe fn clone_to_uninit(&self, dest: *mut u8)

🔬This is a nightly-only experimental API. (clone_to_uninit)
Performs copy-assignment from self to dest. Read more
Source§

impl<T> From<T> for T

Source§

fn from(t: T) -> T

Returns the argument unchanged.

Source§

impl<T> Instrument for T

Source§

fn instrument(self, span: Span) -> Instrumented<Self>

Instruments this type with the provided Span, returning an Instrumented wrapper. Read more
Source§

fn in_current_span(self) -> Instrumented<Self>

Instruments this type with the current Span, returning an Instrumented wrapper. Read more
Source§

impl<T, U> Into<U> for T
where U: From<T>,

Source§

fn into(self) -> U

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

Source§

impl<T> ToOwned for T
where T: Clone,

Source§

type Owned = T

The resulting type after obtaining ownership.
Source§

fn to_owned(&self) -> T

Creates owned data from borrowed data, usually by cloning. Read more
Source§

fn clone_into(&self, target: &mut T)

Uses borrowed data to replace owned data, usually by cloning. Read more
Source§

impl<T, U> TryFrom<U> for T
where U: Into<T>,

Source§

type Error = Infallible

The type returned in the event of a conversion error.
Source§

fn try_from(value: U) -> Result<T, <T as TryFrom<U>>::Error>

Performs the conversion.
Source§

impl<T, U> TryInto<U> for T
where U: TryFrom<T>,

Source§

type Error = <U as TryFrom<T>>::Error

The type returned in the event of a conversion error.
Source§

fn try_into(self) -> Result<U, <U as TryFrom<T>>::Error>

Performs the conversion.
Source§

impl<V, T> VZip<V> for T
where V: MultiLane<T>,

Source§

fn vzip(self) -> V

Source§

impl<T> WithSubscriber for T

Source§

fn with_subscriber<S>(self, subscriber: S) -> WithDispatch<Self>
where S: Into<Dispatch>,

Attaches the provided Subscriber to this type, returning a WithDispatch wrapper. Read more
Source§

fn with_current_subscriber(self) -> WithDispatch<Self>

Attaches the current default Subscriber to this type, returning a WithDispatch wrapper. Read more
Source§

impl<T> DeserializeOwned for T
where T: for<'de> Deserialize<'de>,

Source§

impl<T> ErasedDestructor for T
where T: 'static,