Skip to content

Commit 037e7db

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Add OpenAPI documentation for keep_unmatched field in ocsf mapper processor (DataDog#3838)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent e03f449 commit 037e7db

6 files changed

Lines changed: 163 additions & 7 deletions

File tree

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44855,6 +44855,11 @@ components:
4485544855
targets.
4485644856
example: service:my-service
4485744857
type: string
44858+
keep_unmatched:
44859+
description: Whether to keep an event that does not match any of the mapping
44860+
filters.
44861+
example: false
44862+
type: boolean
4485844863
mappings:
4485944864
description: A list of mapping rules to convert events to the OCSF format.
4486044865
items:

‎api/datadogV2/model_observability_pipeline_ocsf_mapper_processor.go‎

Lines changed: 42 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ type ObservabilityPipelineOcsfMapperProcessor struct {
2222
Id string `json:"id"`
2323
// A Datadog search query used to determine which logs this processor targets.
2424
Include string `json:"include"`
25+
// Whether to keep an event that does not match any of the mapping filters.
26+
KeepUnmatched *bool `json:"keep_unmatched,omitempty"`
2527
// A list of mapping rules to convert events to the OCSF format.
2628
Mappings []ObservabilityPipelineOcsfMapperProcessorMapping `json:"mappings"`
2729
// The processor type. The value should always be `ocsf_mapper`.
@@ -152,6 +154,34 @@ func (o *ObservabilityPipelineOcsfMapperProcessor) SetInclude(v string) {
152154
o.Include = v
153155
}
154156

157+
// GetKeepUnmatched returns the KeepUnmatched field value if set, zero value otherwise.
158+
func (o *ObservabilityPipelineOcsfMapperProcessor) GetKeepUnmatched() bool {
159+
if o == nil || o.KeepUnmatched == nil {
160+
var ret bool
161+
return ret
162+
}
163+
return *o.KeepUnmatched
164+
}
165+
166+
// GetKeepUnmatchedOk returns a tuple with the KeepUnmatched field value if set, nil otherwise
167+
// and a boolean to check if the value has been set.
168+
func (o *ObservabilityPipelineOcsfMapperProcessor) GetKeepUnmatchedOk() (*bool, bool) {
169+
if o == nil || o.KeepUnmatched == nil {
170+
return nil, false
171+
}
172+
return o.KeepUnmatched, true
173+
}
174+
175+
// HasKeepUnmatched returns a boolean if a field has been set.
176+
func (o *ObservabilityPipelineOcsfMapperProcessor) HasKeepUnmatched() bool {
177+
return o != nil && o.KeepUnmatched != nil
178+
}
179+
180+
// SetKeepUnmatched gets a reference to the given bool and assigns it to the KeepUnmatched field.
181+
func (o *ObservabilityPipelineOcsfMapperProcessor) SetKeepUnmatched(v bool) {
182+
o.KeepUnmatched = &v
183+
}
184+
155185
// GetMappings returns the Mappings field value.
156186
func (o *ObservabilityPipelineOcsfMapperProcessor) GetMappings() []ObservabilityPipelineOcsfMapperProcessorMapping {
157187
if o == nil {
@@ -210,6 +240,9 @@ func (o ObservabilityPipelineOcsfMapperProcessor) MarshalJSON() ([]byte, error)
210240
toSerialize["enabled"] = o.Enabled
211241
toSerialize["id"] = o.Id
212242
toSerialize["include"] = o.Include
243+
if o.KeepUnmatched != nil {
244+
toSerialize["keep_unmatched"] = o.KeepUnmatched
245+
}
213246
toSerialize["mappings"] = o.Mappings
214247
toSerialize["type"] = o.Type
215248

@@ -222,12 +255,13 @@ func (o ObservabilityPipelineOcsfMapperProcessor) MarshalJSON() ([]byte, error)
222255
// UnmarshalJSON deserializes the given payload.
223256
func (o *ObservabilityPipelineOcsfMapperProcessor) UnmarshalJSON(bytes []byte) (err error) {
224257
all := struct {
225-
DisplayName *string `json:"display_name,omitempty"`
226-
Enabled *bool `json:"enabled"`
227-
Id *string `json:"id"`
228-
Include *string `json:"include"`
229-
Mappings *[]ObservabilityPipelineOcsfMapperProcessorMapping `json:"mappings"`
230-
Type *ObservabilityPipelineOcsfMapperProcessorType `json:"type"`
258+
DisplayName *string `json:"display_name,omitempty"`
259+
Enabled *bool `json:"enabled"`
260+
Id *string `json:"id"`
261+
Include *string `json:"include"`
262+
KeepUnmatched *bool `json:"keep_unmatched,omitempty"`
263+
Mappings *[]ObservabilityPipelineOcsfMapperProcessorMapping `json:"mappings"`
264+
Type *ObservabilityPipelineOcsfMapperProcessorType `json:"type"`
231265
}{}
232266
if err = datadog.Unmarshal(bytes, &all); err != nil {
233267
return datadog.Unmarshal(bytes, &o.UnparsedObject)
@@ -249,7 +283,7 @@ func (o *ObservabilityPipelineOcsfMapperProcessor) UnmarshalJSON(bytes []byte) (
249283
}
250284
additionalProperties := make(map[string]interface{})
251285
if err = datadog.Unmarshal(bytes, &additionalProperties); err == nil {
252-
datadog.DeleteKeys(additionalProperties, &[]string{"display_name", "enabled", "id", "include", "mappings", "type"})
286+
datadog.DeleteKeys(additionalProperties, &[]string{"display_name", "enabled", "id", "include", "keep_unmatched", "mappings", "type"})
253287
} else {
254288
return err
255289
}
@@ -259,6 +293,7 @@ func (o *ObservabilityPipelineOcsfMapperProcessor) UnmarshalJSON(bytes []byte) (
259293
o.Enabled = *all.Enabled
260294
o.Id = *all.Id
261295
o.Include = *all.Include
296+
o.KeepUnmatched = all.KeepUnmatched
262297
o.Mappings = *all.Mappings
263298
if !all.Type.IsValid() {
264299
hasInvalidField = true

‎examples/v2/observability-pipelines/ValidatePipeline_3067748504.go‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
// Validate an observability pipeline with OCSF mapper keep_unmatched returns "OK" response
2+
3+
package main
4+
5+
import (
6+
"context"
7+
"encoding/json"
8+
"fmt"
9+
"os"
10+
11+
"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
12+
"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
13+
)
14+
15+
func main() {
16+
body := datadogV2.ObservabilityPipelineSpec{
17+
Data: datadogV2.ObservabilityPipelineSpecData{
18+
Attributes: datadogV2.ObservabilityPipelineDataAttributes{
19+
Config: datadogV2.ObservabilityPipelineConfig{
20+
Destinations: []datadogV2.ObservabilityPipelineConfigDestinationItem{
21+
datadogV2.ObservabilityPipelineConfigDestinationItem{
22+
ObservabilityPipelineDatadogLogsDestination: &datadogV2.ObservabilityPipelineDatadogLogsDestination{
23+
Id: "datadog-logs-destination",
24+
Inputs: []string{
25+
"my-processor-group",
26+
},
27+
Type: datadogV2.OBSERVABILITYPIPELINEDATADOGLOGSDESTINATIONTYPE_DATADOG_LOGS,
28+
}},
29+
},
30+
ProcessorGroups: []datadogV2.ObservabilityPipelineConfigProcessorGroup{
31+
{
32+
Enabled: true,
33+
Id: "my-processor-group",
34+
Include: "service:my-service",
35+
Inputs: []string{
36+
"datadog-agent-source",
37+
},
38+
Processors: []datadogV2.ObservabilityPipelineConfigProcessorItem{
39+
datadogV2.ObservabilityPipelineConfigProcessorItem{
40+
ObservabilityPipelineOcsfMapperProcessor: &datadogV2.ObservabilityPipelineOcsfMapperProcessor{
41+
Enabled: true,
42+
Id: "ocsf-mapper-processor",
43+
Include: "service:my-service",
44+
Type: datadogV2.OBSERVABILITYPIPELINEOCSFMAPPERPROCESSORTYPE_OCSF_MAPPER,
45+
KeepUnmatched: datadog.PtrBool(true),
46+
Mappings: []datadogV2.ObservabilityPipelineOcsfMapperProcessorMapping{
47+
{
48+
Include: "source:cloudtrail",
49+
Mapping: datadogV2.ObservabilityPipelineOcsfMapperProcessorMappingMapping{
50+
ObservabilityPipelineOcsfMappingLibrary: datadogV2.OBSERVABILITYPIPELINEOCSFMAPPINGLIBRARY_CLOUDTRAIL_ACCOUNT_CHANGE.Ptr()},
51+
},
52+
},
53+
}},
54+
},
55+
},
56+
},
57+
Sources: []datadogV2.ObservabilityPipelineConfigSourceItem{
58+
datadogV2.ObservabilityPipelineConfigSourceItem{
59+
ObservabilityPipelineDatadogAgentSource: &datadogV2.ObservabilityPipelineDatadogAgentSource{
60+
Id: "datadog-agent-source",
61+
Type: datadogV2.OBSERVABILITYPIPELINEDATADOGAGENTSOURCETYPE_DATADOG_AGENT,
62+
}},
63+
},
64+
},
65+
Name: "OCSF Mapper Keep Unmatched Pipeline",
66+
},
67+
Type: "pipelines",
68+
},
69+
}
70+
ctx := datadog.NewDefaultContext(context.Background())
71+
configuration := datadog.NewConfiguration()
72+
apiClient := datadog.NewAPIClient(configuration)
73+
api := datadogV2.NewObservabilityPipelinesApi(apiClient)
74+
resp, r, err := api.ValidatePipeline(ctx, body)
75+
76+
if err != nil {
77+
fmt.Fprintf(os.Stderr, "Error when calling `ObservabilityPipelinesApi.ValidatePipeline`: %v\n", err)
78+
fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
79+
}
80+
81+
responseContent, _ := json.MarshalIndent(resp, "", " ")
82+
fmt.Fprintf(os.Stdout, "Response from `ObservabilityPipelinesApi.ValidatePipeline`:\n%s\n", responseContent)
83+
}

‎tests/scenarios/cassettes/TestScenarios/v2/Feature_Observability_Pipelines/Scenario_Validate_an_observability_pipeline_with_OCSF_mapper_keep_unmatched_returns_OK_response.freeze‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2026-03-16T13:02:49.264Z

‎tests/scenarios/cassettes/TestScenarios/v2/Feature_Observability_Pipelines/Scenario_Validate_an_observability_pipeline_with_OCSF_mapper_keep_unmatched_returns_OK_response.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
interactions:
2+
- request:
3+
body: |
4+
{"data":{"attributes":{"config":{"destinations":[{"id":"datadog-logs-destination","inputs":["my-processor-group"],"type":"datadog_logs"}],"processor_groups":[{"enabled":true,"id":"my-processor-group","include":"service:my-service","inputs":["datadog-agent-source"],"processors":[{"enabled":true,"id":"ocsf-mapper-processor","include":"service:my-service","keep_unmatched":true,"mappings":[{"include":"source:cloudtrail","mapping":"CloudTrail Account Change"}],"type":"ocsf_mapper"}]}],"sources":[{"id":"datadog-agent-source","type":"datadog_agent"}]},"name":"OCSF Mapper Keep Unmatched Pipeline"},"type":"pipelines"}}
5+
form: {}
6+
headers:
7+
Accept:
8+
- application/json
9+
Content-Type:
10+
- application/json
11+
id: 0
12+
method: POST
13+
url: https://api.datadoghq.com/api/v2/obs-pipelines/pipelines/validate
14+
response:
15+
body: '{"errors":[]}
16+
17+
'
18+
code: 200
19+
duration: 0ms
20+
headers:
21+
Content-Type:
22+
- application/vnd.api+json
23+
status: 200 OK
24+
version: 2

‎tests/scenarios/features/v2/observability_pipelines.feature‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,14 @@ Feature: Observability Pipelines
191191
When the request is sent
192192
Then the response status is 400 Bad Request
193193

194+
@team:DataDog/observability-pipelines
195+
Scenario: Validate an observability pipeline with OCSF mapper keep_unmatched returns "OK" response
196+
Given new "ValidatePipeline" request
197+
And body with value {"data": {"attributes": {"config": {"destinations": [{"id": "datadog-logs-destination", "inputs": ["my-processor-group"], "type": "datadog_logs"}], "processor_groups": [{"enabled": true, "id": "my-processor-group", "include": "service:my-service", "inputs": ["datadog-agent-source"], "processors": [{"enabled": true, "id": "ocsf-mapper-processor", "include": "service:my-service", "type": "ocsf_mapper", "keep_unmatched": true, "mappings": [{"include": "source:cloudtrail", "mapping": "CloudTrail Account Change"}]}]}], "sources": [{"id": "datadog-agent-source", "type": "datadog_agent"}]}, "name": "OCSF Mapper Keep Unmatched Pipeline"}, "type": "pipelines"}}
198+
When the request is sent
199+
Then the response status is 200 OK
200+
And the response "errors" has length 0
201+
194202
@team:DataDog/observability-pipelines
195203
Scenario: Validate an observability pipeline with OCSF mapper library mapping returns "OK" response
196204
Given new "ValidatePipeline" request

0 commit comments

Comments
 (0)