Skip to content

Commit 1813823

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Add OpenAPI documentation for keep_unmatched field in ocsf mapper processor (#1376)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent 5a1e1fc commit 1813823

6 files changed

+169
-0
lines changed

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44855,6 +44855,11 @@ components:
4485544855
targets.
4485644856
example: service:my-service
4485744857
type: string
44858+
keep_unmatched:
44859+
description: Whether to keep an event that does not match any of the mapping
44860+
filters.
44861+
example: false
44862+
type: boolean
4485844863
mappings:
4485944864
description: A list of mapping rules to convert events to the OCSF format.
4486044865
items:

‎examples/v2_observability-pipelines_ValidatePipeline_3067748504.rs‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
// Validate an observability pipeline with OCSF mapper keep_unmatched returns "OK"
2+
// response
3+
use datadog_api_client::datadog;
4+
use datadog_api_client::datadogV2::api_observability_pipelines::ObservabilityPipelinesAPI;
5+
use datadog_api_client::datadogV2::model::ObservabilityPipelineConfig;
6+
use datadog_api_client::datadogV2::model::ObservabilityPipelineConfigDestinationItem;
7+
use datadog_api_client::datadogV2::model::ObservabilityPipelineConfigProcessorGroup;
8+
use datadog_api_client::datadogV2::model::ObservabilityPipelineConfigProcessorItem;
9+
use datadog_api_client::datadogV2::model::ObservabilityPipelineConfigSourceItem;
10+
use datadog_api_client::datadogV2::model::ObservabilityPipelineDataAttributes;
11+
use datadog_api_client::datadogV2::model::ObservabilityPipelineDatadogAgentSource;
12+
use datadog_api_client::datadogV2::model::ObservabilityPipelineDatadogAgentSourceType;
13+
use datadog_api_client::datadogV2::model::ObservabilityPipelineDatadogLogsDestination;
14+
use datadog_api_client::datadogV2::model::ObservabilityPipelineDatadogLogsDestinationType;
15+
use datadog_api_client::datadogV2::model::ObservabilityPipelineOcsfMapperProcessor;
16+
use datadog_api_client::datadogV2::model::ObservabilityPipelineOcsfMapperProcessorMapping;
17+
use datadog_api_client::datadogV2::model::ObservabilityPipelineOcsfMapperProcessorMappingMapping;
18+
use datadog_api_client::datadogV2::model::ObservabilityPipelineOcsfMapperProcessorType;
19+
use datadog_api_client::datadogV2::model::ObservabilityPipelineOcsfMappingLibrary;
20+
use datadog_api_client::datadogV2::model::ObservabilityPipelineSpec;
21+
use datadog_api_client::datadogV2::model::ObservabilityPipelineSpecData;
22+
23+
#[tokio::main]
24+
async fn main() {
25+
let body =
26+
ObservabilityPipelineSpec::new(
27+
ObservabilityPipelineSpecData::new(
28+
ObservabilityPipelineDataAttributes::new(
29+
ObservabilityPipelineConfig::new(
30+
vec![
31+
ObservabilityPipelineConfigDestinationItem::ObservabilityPipelineDatadogLogsDestination(
32+
Box::new(
33+
ObservabilityPipelineDatadogLogsDestination::new(
34+
"datadog-logs-destination".to_string(),
35+
vec!["my-processor-group".to_string()],
36+
ObservabilityPipelineDatadogLogsDestinationType::DATADOG_LOGS,
37+
),
38+
),
39+
)
40+
],
41+
vec![
42+
ObservabilityPipelineConfigSourceItem::ObservabilityPipelineDatadogAgentSource(
43+
Box::new(
44+
ObservabilityPipelineDatadogAgentSource::new(
45+
"datadog-agent-source".to_string(),
46+
ObservabilityPipelineDatadogAgentSourceType::DATADOG_AGENT,
47+
),
48+
),
49+
)
50+
],
51+
).processor_groups(
52+
vec![
53+
ObservabilityPipelineConfigProcessorGroup::new(
54+
true,
55+
"my-processor-group".to_string(),
56+
"service:my-service".to_string(),
57+
vec!["datadog-agent-source".to_string()],
58+
vec![
59+
ObservabilityPipelineConfigProcessorItem::ObservabilityPipelineOcsfMapperProcessor(
60+
Box::new(
61+
ObservabilityPipelineOcsfMapperProcessor::new(
62+
true,
63+
"ocsf-mapper-processor".to_string(),
64+
"service:my-service".to_string(),
65+
vec![
66+
ObservabilityPipelineOcsfMapperProcessorMapping::new(
67+
"source:cloudtrail".to_string(),
68+
ObservabilityPipelineOcsfMapperProcessorMappingMapping
69+
::ObservabilityPipelineOcsfMappingLibrary(
70+
Box::new(
71+
ObservabilityPipelineOcsfMappingLibrary
72+
::CLOUDTRAIL_ACCOUNT_CHANGE,
73+
),
74+
),
75+
)
76+
],
77+
ObservabilityPipelineOcsfMapperProcessorType::OCSF_MAPPER,
78+
).keep_unmatched(true),
79+
),
80+
)
81+
],
82+
)
83+
],
84+
),
85+
"OCSF Mapper Keep Unmatched Pipeline".to_string(),
86+
),
87+
"pipelines".to_string(),
88+
),
89+
);
90+
let configuration = datadog::Configuration::new();
91+
let api = ObservabilityPipelinesAPI::with_config(configuration);
92+
let resp = api.validate_pipeline(body).await;
93+
if let Ok(value) = resp {
94+
println!("{:#?}", value);
95+
} else {
96+
println!("{:#?}", resp.unwrap_err());
97+
}
98+
}

‎src/datadogV2/model/model_observability_pipeline_ocsf_mapper_processor.rs‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@ pub struct ObservabilityPipelineOcsfMapperProcessor {
2525
/// A Datadog search query used to determine which logs this processor targets.
2626
#[serde(rename = "include")]
2727
pub include: String,
28+
/// Whether to keep an event that does not match any of the mapping filters.
29+
#[serde(rename = "keep_unmatched")]
30+
pub keep_unmatched: Option<bool>,
2831
/// A list of mapping rules to convert events to the OCSF format.
2932
#[serde(rename = "mappings")]
3033
pub mappings: Vec<crate::datadogV2::model::ObservabilityPipelineOcsfMapperProcessorMapping>,
@@ -51,6 +54,7 @@ impl ObservabilityPipelineOcsfMapperProcessor {
5154
enabled,
5255
id,
5356
include,
57+
keep_unmatched: None,
5458
mappings,
5559
type_,
5660
additional_properties: std::collections::BTreeMap::new(),
@@ -63,6 +67,11 @@ impl ObservabilityPipelineOcsfMapperProcessor {
6367
self
6468
}
6569

70+
pub fn keep_unmatched(mut self, value: bool) -> Self {
71+
self.keep_unmatched = Some(value);
72+
self
73+
}
74+
6675
pub fn additional_properties(
6776
mut self,
6877
value: std::collections::BTreeMap<String, serde_json::Value>,
@@ -93,6 +102,7 @@ impl<'de> Deserialize<'de> for ObservabilityPipelineOcsfMapperProcessor {
93102
let mut enabled: Option<bool> = None;
94103
let mut id: Option<String> = None;
95104
let mut include: Option<String> = None;
105+
let mut keep_unmatched: Option<bool> = None;
96106
let mut mappings: Option<
97107
Vec<crate::datadogV2::model::ObservabilityPipelineOcsfMapperProcessorMapping>,
98108
> = None;
@@ -123,6 +133,13 @@ impl<'de> Deserialize<'de> for ObservabilityPipelineOcsfMapperProcessor {
123133
"include" => {
124134
include = Some(serde_json::from_value(v).map_err(M::Error::custom)?);
125135
}
136+
"keep_unmatched" => {
137+
if v.is_null() {
138+
continue;
139+
}
140+
keep_unmatched =
141+
Some(serde_json::from_value(v).map_err(M::Error::custom)?);
142+
}
126143
"mappings" => {
127144
mappings = Some(serde_json::from_value(v).map_err(M::Error::custom)?);
128145
}
@@ -155,6 +172,7 @@ impl<'de> Deserialize<'de> for ObservabilityPipelineOcsfMapperProcessor {
155172
enabled,
156173
id,
157174
include,
175+
keep_unmatched,
158176
mappings,
159177
type_,
160178
additional_properties,

‎tests/scenarios/cassettes/v2/observability_pipelines/Validate-an-observability-pipeline-with-OCSF-mapper-keep-unmatched-returns-OK-response.frozen‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2026-03-16T13:02:49.264Z

‎tests/scenarios/cassettes/v2/observability_pipelines/Validate-an-observability-pipeline-with-OCSF-mapper-keep-unmatched-returns-OK-response.json‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"http_interactions": [
3+
{
4+
"request": {
5+
"body": {
6+
"string": "{\"data\":{\"attributes\":{\"config\":{\"destinations\":[{\"id\":\"datadog-logs-destination\",\"inputs\":[\"my-processor-group\"],\"type\":\"datadog_logs\"}],\"processor_groups\":[{\"enabled\":true,\"id\":\"my-processor-group\",\"include\":\"service:my-service\",\"inputs\":[\"datadog-agent-source\"],\"processors\":[{\"enabled\":true,\"id\":\"ocsf-mapper-processor\",\"include\":\"service:my-service\",\"keep_unmatched\":true,\"mappings\":[{\"include\":\"source:cloudtrail\",\"mapping\":\"CloudTrail Account Change\"}],\"type\":\"ocsf_mapper\"}]}],\"sources\":[{\"id\":\"datadog-agent-source\",\"type\":\"datadog_agent\"}]},\"name\":\"OCSF Mapper Keep Unmatched Pipeline\"},\"type\":\"pipelines\"}}",
7+
"encoding": null
8+
},
9+
"headers": {
10+
"Accept": [
11+
"application/json"
12+
],
13+
"Content-Type": [
14+
"application/json"
15+
]
16+
},
17+
"method": "post",
18+
"uri": "https://api.datadoghq.com/api/v2/obs-pipelines/pipelines/validate"
19+
},
20+
"response": {
21+
"body": {
22+
"string": "{\"errors\":[]}\n",
23+
"encoding": null
24+
},
25+
"headers": {
26+
"Content-Type": [
27+
"application/vnd.api+json"
28+
]
29+
},
30+
"status": {
31+
"code": 200,
32+
"message": "OK"
33+
}
34+
},
35+
"recorded_at": "Mon, 16 Mar 2026 13:02:49 GMT"
36+
}
37+
],
38+
"recorded_with": "VCR 6.0.0"
39+
}

‎tests/scenarios/features/v2/observability_pipelines.feature‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,14 @@ Feature: Observability Pipelines
191191
When the request is sent
192192
Then the response status is 400 Bad Request
193193

194+
@team:DataDog/observability-pipelines
195+
Scenario: Validate an observability pipeline with OCSF mapper keep_unmatched returns "OK" response
196+
Given new "ValidatePipeline" request
197+
And body with value {"data": {"attributes": {"config": {"destinations": [{"id": "datadog-logs-destination", "inputs": ["my-processor-group"], "type": "datadog_logs"}], "processor_groups": [{"enabled": true, "id": "my-processor-group", "include": "service:my-service", "inputs": ["datadog-agent-source"], "processors": [{"enabled": true, "id": "ocsf-mapper-processor", "include": "service:my-service", "type": "ocsf_mapper", "keep_unmatched": true, "mappings": [{"include": "source:cloudtrail", "mapping": "CloudTrail Account Change"}]}]}], "sources": [{"id": "datadog-agent-source", "type": "datadog_agent"}]}, "name": "OCSF Mapper Keep Unmatched Pipeline"}, "type": "pipelines"}}
198+
When the request is sent
199+
Then the response status is 200 OK
200+
And the response "errors" has length 0
201+
194202
@team:DataDog/observability-pipelines
195203
Scenario: Validate an observability pipeline with OCSF mapper library mapping returns "OK" response
196204
Given new "ValidatePipeline" request

0 commit comments

Comments
 (0)