@@ -6182,6 +6182,190 @@ components:
61826182 type: string
61836183 x-enum-varnames:
61846184 - ARITHMETIC_PROCESSOR
6185+ LogsArrayMapArithmeticSubProcessor:
6186+ description: |-
6187+ An arithmetic sub-processor for use inside an array-map processor.
6188+ Unlike the top-level arithmetic processor, `is_enabled` is not supported.
6189+ properties:
6190+ expression:
6191+ description: Arithmetic operation to perform.
6192+ example: ""
6193+ type: string
6194+ is_replace_missing:
6195+ default: false
6196+ description: Replace missing attribute values with 0.
6197+ type: boolean
6198+ name:
6199+ description: Name of the sub-processor.
6200+ type: string
6201+ target:
6202+ description: Target attribute path for the result.
6203+ example: ""
6204+ type: string
6205+ type:
6206+ $ref: "#/components/schemas/LogsArithmeticProcessorType"
6207+ required:
6208+ - expression
6209+ - target
6210+ - type
6211+ type: object
6212+ LogsArrayMapAttributeRemapper:
6213+ description: |-
6214+ An attribute remapper sub-processor for use inside an array-map processor.
6215+ Unlike the top-level attribute remapper, `is_enabled`, `source_type`, and
6216+ `target_type` are not supported.
6217+ properties:
6218+ name:
6219+ description: Name of the sub-processor.
6220+ type: string
6221+ override_on_conflict:
6222+ default: false
6223+ description: Override the target element if already set.
6224+ type: boolean
6225+ preserve_source:
6226+ default: false
6227+ description: Remove or preserve the remapped source element.
6228+ type: boolean
6229+ sources:
6230+ description: Array of source attribute paths.
6231+ example:
6232+ - ""
6233+ items:
6234+ type: string
6235+ type: array
6236+ target:
6237+ description: Target attribute path.
6238+ example: ""
6239+ type: string
6240+ target_format:
6241+ $ref: "#/components/schemas/TargetFormatType"
6242+ type:
6243+ $ref: "#/components/schemas/LogsAttributeRemapperType"
6244+ required:
6245+ - sources
6246+ - target
6247+ - type
6248+ type: object
6249+ LogsArrayMapCategorySubProcessor:
6250+ description: |-
6251+ A category sub-processor for use inside an array-map processor.
6252+ Unlike the top-level category processor, `is_enabled` is not supported.
6253+ properties:
6254+ categories:
6255+ description: Array of filters to match against a log and the corresponding value to assign.
6256+ items:
6257+ $ref: "#/components/schemas/LogsCategoryProcessorCategory"
6258+ type: array
6259+ name:
6260+ description: Name of the sub-processor.
6261+ type: string
6262+ target:
6263+ description: Target attribute path for the category value.
6264+ example: ""
6265+ type: string
6266+ type:
6267+ $ref: "#/components/schemas/LogsCategoryProcessorType"
6268+ required:
6269+ - categories
6270+ - target
6271+ - type
6272+ type: object
6273+ LogsArrayMapProcessor:
6274+ description: |-
6275+ The array-map processor transforms each element of a source array by applying
6276+ sub-processors in order and collecting the results into a target array.
6277+ Results can be written to a new array, to the source array (in-place), or to
6278+ an existing target array. Sub-processors can read from `$sourceElem.<field>`
6279+ (object element field), bare `$sourceElem` (primitive element), or any parent
6280+ log attribute path. Sub-processors write to `$targetElem.<field>` (object
6281+ output field) or bare `$targetElem` (primitive output).
6282+ properties:
6283+ is_enabled:
6284+ default: false
6285+ description: Whether or not the processor is enabled.
6286+ type: boolean
6287+ name:
6288+ description: Name of the processor.
6289+ type: string
6290+ preserve_source:
6291+ default: true
6292+ description: |-
6293+ When `false` and `source != target`, the source attribute is removed after
6294+ processing. Cannot be `false` when `source == target`.
6295+ type: boolean
6296+ processors:
6297+ description: |-
6298+ Sub-processors applied to each element. Allowed types: `attribute-remapper`,
6299+ `string-builder-processor`, `arithmetic-processor`, `category-processor`.
6300+ items:
6301+ $ref: "#/components/schemas/LogsArrayMapSubProcessor"
6302+ type: array
6303+ source:
6304+ description: |-
6305+ Attribute path of the source array. Elements are read-only via `$sourceElem`
6306+ inside sub-processors.
6307+ example: detail.resource.s3BucketDetails
6308+ type: string
6309+ target:
6310+ description: |-
6311+ Attribute path of the output array. Sub-processors write to `$targetElem`
6312+ (or `$targetElem.<field>`) to build each output element.
6313+ example: ocsf.resources
6314+ type: string
6315+ type:
6316+ $ref: "#/components/schemas/LogsArrayMapProcessorType"
6317+ required:
6318+ - source
6319+ - target
6320+ - processors
6321+ - type
6322+ type: object
6323+ LogsArrayMapProcessorType:
6324+ default: array-map-processor
6325+ description: Type of logs array-map processor.
6326+ enum:
6327+ - array-map-processor
6328+ example: array-map-processor
6329+ type: string
6330+ x-enum-varnames:
6331+ - ARRAY_MAP_PROCESSOR
6332+ LogsArrayMapStringBuilderSubProcessor:
6333+ description: |-
6334+ A string builder sub-processor for use inside an array-map processor.
6335+ Unlike the top-level string builder processor, `is_enabled` is not supported.
6336+ properties:
6337+ is_replace_missing:
6338+ default: false
6339+ description: Replace missing attribute values with an empty string.
6340+ type: boolean
6341+ name:
6342+ description: Name of the sub-processor.
6343+ type: string
6344+ target:
6345+ description: Target attribute path for the result.
6346+ example: ""
6347+ type: string
6348+ template:
6349+ description: Formula with one or more attributes and raw text.
6350+ example: ""
6351+ type: string
6352+ type:
6353+ $ref: "#/components/schemas/LogsStringBuilderProcessorType"
6354+ required:
6355+ - template
6356+ - target
6357+ - type
6358+ type: object
6359+ LogsArrayMapSubProcessor:
6360+ description: |-
6361+ A sub-processor used inside an array-map processor.
6362+ Allowed types: `attribute-remapper`, `string-builder-processor`,
6363+ `arithmetic-processor`, `category-processor`.
6364+ oneOf:
6365+ - $ref: "#/components/schemas/LogsArrayMapAttributeRemapper"
6366+ - $ref: "#/components/schemas/LogsArrayMapArithmeticSubProcessor"
6367+ - $ref: "#/components/schemas/LogsArrayMapStringBuilderSubProcessor"
6368+ - $ref: "#/components/schemas/LogsArrayMapCategorySubProcessor"
61856369 LogsArrayProcessor:
61866370 description: |-
61876371 A processor for extracting, aggregating, or transforming values from JSON arrays within your logs.
@@ -7237,6 +7421,7 @@ components:
72377421 - $ref: "#/components/schemas/LogsDecoderProcessor"
72387422 - $ref: "#/components/schemas/LogsSchemaProcessor"
72397423 - $ref: "#/components/schemas/LogsExcludeAttributeProcessor"
7424+ - $ref: "#/components/schemas/LogsArrayMapProcessor"
72407425 LogsQueryCompute:
72417426 description: Define computation for a log query.
72427427 properties:
0 commit comments