Add Obs Pipeline Grok processor updates to OpenAPI Spec

.generator/schemas/v2/openapi.yaml

@@ -67723,6 +67723,10 @@ components:
         The `parse_grok` processor extracts structured fields from unstructured log messages using Grok patterns.
 
         **Supported pipeline types:** logs
+      example:
+        id: "parse-grok-processor"
+        include: "service:my-service"
+        type: "parse_grok"
       properties:
         disable_library_rules:
           default: false
@@ -67735,6 +67739,11 @@ components:
           description: Indicates whether the processor is enabled.
           example: true
           type: boolean
+        field:
+          default: "message"
+          description: The log field to parse with the Grok rules.
+          example: "message"
+          type: string
         id:
           description: A unique identifier for this processor.
           example: "parse-grok-processor"
@@ -67744,9 +67753,9 @@ components:
           example: "service:my-service"
           type: string
         rules:
-          description: The list of Grok parsing rules. If multiple matching rules are provided, they are evaluated in order. The first successful match is applied.
+          description: The list of Grok parsing rules selected by either source field or include query.
           items:
-            $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorRule"
+            $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorRuleItem"
           type: array
         type:
           $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorType"
@@ -67758,6 +67767,37 @@ components:
         - enabled
       type: object
       x-pipeline-types: [logs]
+    ObservabilityPipelineParseGrokProcessorIncludeRule:
+      description: |-
+        A Grok parsing rule selected using the `include` query. Each rule defines how to extract structured fields
+        from logs matching a Datadog search query.
+      properties:
+        include:
+          description: A Datadog search query used to determine which logs this Grok rule targets.
+          example: "service:my-service"
+          type: string
+        match_rules:
+          description: |-
+            A list of Grok parsing rules that define how to extract fields from matching logs.
+            Each rule must contain a name and a valid Grok pattern.
+          example:
+            - name: "MyParsingRule"
+              rule: '%{word:user} connected on %{date("MM/dd/yyyy"):date}'
+          items:
+            $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorRuleMatchRule"
+          type: array
+        support_rules:
+          description: A list of Grok helper rules that can be referenced by the parsing rules.
+          example:
+            - name: "user"
+              rule: "%{word:user.name}"
+          items:
+            $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorRuleSupportRule"
+          type: array
+      required:
+        - include
+        - match_rules
+      type: object
     ObservabilityPipelineParseGrokProcessorRule:
       description: |-
         A Grok parsing rule used in the `parse_grok` processor. Each rule defines how to extract structured fields
@@ -67790,6 +67830,11 @@ components:
         - source
         - match_rules
       type: object
+    ObservabilityPipelineParseGrokProcessorRuleItem:
+      description: A single Grok parsing rule, selected by either source field or include query.
+      oneOf:
+        - $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorRule"
+        - $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorIncludeRule"
     ObservabilityPipelineParseGrokProcessorRuleMatchRule:
       description: |-
         Defines a Grok parsing rule, which extracts structured fields from log content using named Grok patterns.

cassettes/v2/Observability-Pipelines_4170000189/Validate-an-observability-pipeline-with-parse-grok-processor-include-rules-returns-OK-res_1095681196/frozen.json

@@ -0,0 +1 @@
+"2026-06-29T20:01:05.978Z"

cassettes/v2/Observability-Pipelines_4170000189/Validate-an-observability-pipeline-with-parse-grok-processor-include-rules-returns-OK-res_1095681196/recording.har

@@ -0,0 +1,67 @@
+{
+  "log": {
+    "_recordingName": "Observability Pipelines/Validate an observability pipeline with parse grok processor include rules returns \"OK\" response",
+    "creator": {
+      "comment": "persister:fs",
+      "name": "Polly.JS",
+      "version": "6.0.5"
+    },
+    "entries": [
+      {
+        "_id": "b8062fd7f4eded7f70d16663f84d35bf",
+        "_order": 0,
+        "cache": {},
+        "request": {
+          "bodySize": 613,
+          "cookies": [],
+          "headers": [
+            {
+              "_fromType": "array",
+              "name": "accept",
+              "value": "application/json"
+            },
+            {
+              "_fromType": "array",
+              "name": "content-type",
+              "value": "application/json"
+            }
+          ],
+          "headersSize": 583,
+          "httpVersion": "HTTP/1.1",
+          "method": "POST",
+          "postData": {
+            "mimeType": "application/json",
+            "params": [],
+            "text": "{\"data\":{\"attributes\":{\"config\":{\"destinations\":[{\"id\":\"datadog-logs-destination\",\"inputs\":[\"my-processor-group\"],\"type\":\"datadog_logs\"}],\"processor_groups\":[{\"enabled\":true,\"id\":\"my-processor-group\",\"include\":\"service:my-service\",\"inputs\":[\"datadog-agent-source\"],\"processors\":[{\"enabled\":true,\"field\":\"content\",\"id\":\"parse-grok-processor\",\"include\":\"*\",\"rules\":[{\"include\":\"service:foo\",\"match_rules\":[{\"name\":\"MyParsingRule\",\"rule\":\"%{word:user}\"}]}],\"type\":\"parse_grok\"}]}],\"sources\":[{\"id\":\"datadog-agent-source\",\"type\":\"datadog_agent\"}]},\"name\":\"Pipeline with Parse Grok Include Rules\"},\"type\":\"pipelines\"}}"
+          },
+          "queryString": [],
+          "url": "https://api.datadoghq.com/api/v2/obs-pipelines/pipelines/validate"
+        },
+        "response": {
+          "bodySize": 14,
+          "content": {
+            "mimeType": "application/vnd.api+json",
+            "size": 14,
+            "text": "{\"errors\":[]}\n"
+          },
+          "cookies": [],
+          "headers": [
+            {
+              "name": "content-type",
+              "value": "application/vnd.api+json"
+            }
+          ],
+          "headersSize": 670,
+          "httpVersion": "HTTP/1.1",
+          "redirectURL": "",
+          "status": 200,
+          "statusText": "OK"
+        },
+        "startedDateTime": "2026-06-29T20:01:05.981Z",
+        "time": 87
+      }
+    ],
+    "pages": [],
+    "version": "1.2"
+  }
+}

cassettes/v2/Observability-Pipelines_4170000189/Validate-an-observability-pipeline-with-parse-grok-processor-source-rules-returns-OK-resp_4220453075/frozen.json

@@ -0,0 +1 @@
+"2026-06-29T18:24:15.839Z"

cassettes/v2/Observability-Pipelines_4170000189/Validate-an-observability-pipeline-with-parse-grok-processor-source-rules-returns-OK-resp_4220453075/recording.har

@@ -0,0 +1,67 @@
+{
+  "log": {
+    "_recordingName": "Observability Pipelines/Validate an observability pipeline with parse grok processor source rules returns \"OK\" response",
+    "creator": {
+      "comment": "persister:fs",
+      "name": "Polly.JS",
+      "version": "6.0.5"
+    },
+    "entries": [
+      {
+        "_id": "bca7a00b7717b67f43936397923b1e3c",
+        "_order": 0,
+        "cache": {},
+        "request": {
+          "bodySize": 589,
+          "cookies": [],
+          "headers": [
+            {
+              "_fromType": "array",
+              "name": "accept",
+              "value": "application/json"
+            },
+            {
+              "_fromType": "array",
+              "name": "content-type",
+              "value": "application/json"
+            }
+          ],
+          "headersSize": 583,
+          "httpVersion": "HTTP/1.1",
+          "method": "POST",
+          "postData": {
+            "mimeType": "application/json",
+            "params": [],
+            "text": "{\"data\":{\"attributes\":{\"config\":{\"destinations\":[{\"id\":\"datadog-logs-destination\",\"inputs\":[\"my-processor-group\"],\"type\":\"datadog_logs\"}],\"processor_groups\":[{\"enabled\":true,\"id\":\"my-processor-group\",\"include\":\"service:my-service\",\"inputs\":[\"datadog-agent-source\"],\"processors\":[{\"enabled\":true,\"id\":\"parse-grok-processor\",\"include\":\"*\",\"rules\":[{\"match_rules\":[{\"name\":\"MyParsingRule\",\"rule\":\"%{word:user}\"}],\"source\":\"message\"}],\"type\":\"parse_grok\"}]}],\"sources\":[{\"id\":\"datadog-agent-source\",\"type\":\"datadog_agent\"}]},\"name\":\"Pipeline with Parse Grok Source Rules\"},\"type\":\"pipelines\"}}"
+          },
+          "queryString": [],
+          "url": "https://api.datadoghq.com/api/v2/obs-pipelines/pipelines/validate"
+        },
+        "response": {
+          "bodySize": 14,
+          "content": {
+            "mimeType": "application/vnd.api+json",
+            "size": 14,
+            "text": "{\"errors\":[]}\n"
+          },
+          "cookies": [],
+          "headers": [
+            {
+              "name": "content-type",
+              "value": "application/vnd.api+json"
+            }
+          ],
+          "headersSize": 670,
+          "httpVersion": "HTTP/1.1",
+          "redirectURL": "",
+          "status": 200,
+          "statusText": "OK"
+        },
+        "startedDateTime": "2026-06-29T18:24:15.841Z",
+        "time": 168
+      }
+    ],
+    "pages": [],
+    "version": "1.2"
+  }
+}

examples/v2/observability-pipelines/ValidatePipeline_3345949653.ts

@@ -0,0 +1,70 @@
+/**
+ * Validate an observability pipeline with parse grok processor source rules returns "OK" response
+ */
+
+import { client, v2 } from "@datadog/datadog-api-client";
+
+const configuration = client.createConfiguration();
+const apiInstance = new v2.ObservabilityPipelinesApi(configuration);
+
+const params: v2.ObservabilityPipelinesApiValidatePipelineRequest = {
+  body: {
+    data: {
+      attributes: {
+        config: {
+          destinations: [
+            {
+              id: "datadog-logs-destination",
+              inputs: ["my-processor-group"],
+              type: "datadog_logs",
+            },
+          ],
+          processorGroups: [
+            {
+              enabled: true,
+              id: "my-processor-group",
+              include: "service:my-service",
+              inputs: ["datadog-agent-source"],
+              processors: [
+                {
+                  enabled: true,
+                  id: "parse-grok-processor",
+                  include: "*",
+                  type: "parse_grok",
+                  rules: [
+                    {
+                      source: "message",
+                      matchRules: [
+                        {
+                          name: "MyParsingRule",
+                          rule: "%{word:user}",
+                        },
+                      ],
+                    },
+                  ],
+                },
+              ],
+            },
+          ],
+          sources: [
+            {
+              id: "datadog-agent-source",
+              type: "datadog_agent",
+            },
+          ],
+        },
+        name: "Pipeline with Parse Grok Source Rules",
+      },
+      type: "pipelines",
+    },
+  },
+};
+
+apiInstance
+  .validatePipeline(params)
+  .then((data: v2.ValidationResponse) => {
+    console.log(
+      "API called successfully. Returned data: " + JSON.stringify(data)
+    );
+  })
+  .catch((error: any) => console.error(error));

examples/v2/observability-pipelines/ValidatePipeline_3928499240.ts

@@ -0,0 +1,71 @@
+/**
+ * Validate an observability pipeline with parse grok processor include rules returns "OK" response
+ */
+
+import { client, v2 } from "@datadog/datadog-api-client";
+
+const configuration = client.createConfiguration();
+const apiInstance = new v2.ObservabilityPipelinesApi(configuration);
+
+const params: v2.ObservabilityPipelinesApiValidatePipelineRequest = {
+  body: {
+    data: {
+      attributes: {
+        config: {
+          destinations: [
+            {
+              id: "datadog-logs-destination",
+              inputs: ["my-processor-group"],
+              type: "datadog_logs",
+            },
+          ],
+          processorGroups: [
+            {
+              enabled: true,
+              id: "my-processor-group",
+              include: "service:my-service",
+              inputs: ["datadog-agent-source"],
+              processors: [
+                {
+                  enabled: true,
+                  id: "parse-grok-processor",
+                  include: "*",
+                  type: "parse_grok",
+                  field: "content",
+                  rules: [
+                    {
+                      include: "service:foo",
+                      matchRules: [
+                        {
+                          name: "MyParsingRule",
+                          rule: "%{word:user}",
+                        },
+                      ],
+                    },
+                  ],
+                },
+              ],
+            },
+          ],
+          sources: [
+            {
+              id: "datadog-agent-source",
+              type: "datadog_agent",
+            },
+          ],
+        },
+        name: "Pipeline with Parse Grok Include Rules",
+      },
+      type: "pipelines",
+    },
+  },
+};
+
+apiInstance
+  .validatePipeline(params)
+  .then((data: v2.ValidationResponse) => {
+    console.log(
+      "API called successfully. Returned data: " + JSON.stringify(data)
+    );
+  })
+  .catch((error: any) => console.error(error));

features/v2/observability_pipelines.feature

@@ -295,6 +295,22 @@ Feature: Observability Pipelines
     Then the response status is 200 OK
     And the response "errors" has length 0
 
+  @team:DataDog/observability-pipelines
+  Scenario: Validate an observability pipeline with parse grok processor include rules returns "OK" response
+    Given new "ValidatePipeline" request
+    And body with value {"data": {"attributes": {"config": {"destinations": [{"id": "datadog-logs-destination", "inputs": ["my-processor-group"], "type": "datadog_logs"}], "processor_groups": [{"enabled": true, "id": "my-processor-group", "include": "service:my-service", "inputs": ["datadog-agent-source"], "processors": [{"enabled": true, "id": "parse-grok-processor", "include": "*", "type": "parse_grok", "field": "content", "rules": [{"include": "service:foo", "match_rules": [{"name": "MyParsingRule", "rule": "%{word:user}"}]}]}]}], "sources": [{"id": "datadog-agent-source", "type": "datadog_agent"}]}, "name": "Pipeline with Parse Grok Include Rules"}, "type": "pipelines"}}
+    When the request is sent
+    Then the response status is 200 OK
+    And the response "errors" has length 0
+
+  @team:DataDog/observability-pipelines
+  Scenario: Validate an observability pipeline with parse grok processor source rules returns "OK" response
+    Given new "ValidatePipeline" request
+    And body with value {"data": {"attributes": {"config": {"destinations": [{"id": "datadog-logs-destination", "inputs": ["my-processor-group"], "type": "datadog_logs"}], "processor_groups": [{"enabled": true, "id": "my-processor-group", "include": "service:my-service", "inputs": ["datadog-agent-source"], "processors": [{"enabled": true, "id": "parse-grok-processor", "include": "*", "type": "parse_grok", "rules": [{"source": "message", "match_rules": [{"name": "MyParsingRule", "rule": "%{word:user}"}]}]}]}], "sources": [{"id": "datadog-agent-source", "type": "datadog_agent"}]}, "name": "Pipeline with Parse Grok Source Rules"}, "type": "pipelines"}}
+    When the request is sent
+    Then the response status is 200 OK
+    And the response "errors" has length 0
+
   @team:DataDog/observability-pipelines
   Scenario: Validate an observability pipeline with source secret key returns "OK" response
     Given new "ValidatePipeline" request