Skip to content

Commit 09838e2

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Add OpenAPI documentation for keep_unmatched field in ocsf mapper processor (#3718)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent 844a164 commit 09838e2

File tree

6 files changed

+155
-0
lines changed

6 files changed

+155
-0
lines changed

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44855,6 +44855,11 @@ components:
4485544855
targets.
4485644856
example: service:my-service
4485744857
type: string
44858+
keep_unmatched:
44859+
description: Whether to keep an event that does not match any of the mapping
44860+
filters.
44861+
example: false
44862+
type: boolean
4485844863
mappings:
4485944864
description: A list of mapping rules to convert events to the OCSF format.
4486044865
items:

‎cassettes/v2/Observability-Pipelines_4170000189/Validate-an-observability-pipeline-with-OCSF-mapper-keep_unmatched-returns-OK-response_1718208362/frozen.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2026-03-16T13:02:49.264Z"

‎cassettes/v2/Observability-Pipelines_4170000189/Validate-an-observability-pipeline-with-OCSF-mapper-keep_unmatched-returns-OK-response_1718208362/recording.har‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"log": {
3+
"_recordingName": "Observability Pipelines/Validate an observability pipeline with OCSF mapper keep_unmatched returns \"OK\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "f5433095b6695a37c1e8c7de43d95c58",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 617,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "application/json"
22+
},
23+
{
24+
"_fromType": "array",
25+
"name": "content-type",
26+
"value": "application/json"
27+
}
28+
],
29+
"headersSize": 582,
30+
"httpVersion": "HTTP/1.1",
31+
"method": "POST",
32+
"postData": {
33+
"mimeType": "application/json",
34+
"params": [],
35+
"text": "{\"data\":{\"attributes\":{\"config\":{\"destinations\":[{\"id\":\"datadog-logs-destination\",\"inputs\":[\"my-processor-group\"],\"type\":\"datadog_logs\"}],\"processor_groups\":[{\"enabled\":true,\"id\":\"my-processor-group\",\"include\":\"service:my-service\",\"inputs\":[\"datadog-agent-source\"],\"processors\":[{\"enabled\":true,\"id\":\"ocsf-mapper-processor\",\"include\":\"service:my-service\",\"keep_unmatched\":true,\"mappings\":[{\"include\":\"source:cloudtrail\",\"mapping\":\"CloudTrail Account Change\"}],\"type\":\"ocsf_mapper\"}]}],\"sources\":[{\"id\":\"datadog-agent-source\",\"type\":\"datadog_agent\"}]},\"name\":\"OCSF Mapper Keep Unmatched Pipeline\"},\"type\":\"pipelines\"}}"
36+
},
37+
"queryString": [],
38+
"url": "https://api.datadoghq.com/api/v2/obs-pipelines/pipelines/validate"
39+
},
40+
"response": {
41+
"bodySize": 14,
42+
"content": {
43+
"mimeType": "application/vnd.api+json",
44+
"size": 14,
45+
"text": "{\"errors\":[]}\n"
46+
},
47+
"cookies": [],
48+
"headers": [
49+
{
50+
"name": "content-type",
51+
"value": "application/vnd.api+json"
52+
}
53+
],
54+
"headersSize": 370,
55+
"httpVersion": "HTTP/1.1",
56+
"redirectURL": "",
57+
"status": 200,
58+
"statusText": "OK"
59+
},
60+
"startedDateTime": "2026-03-16T13:02:50.118Z",
61+
"time": 99
62+
}
63+
],
64+
"pages": [],
65+
"version": "1.2"
66+
}
67+
}

‎examples/v2/observability-pipelines/ValidatePipeline_3067748504.ts‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
/**
2+
* Validate an observability pipeline with OCSF mapper keep_unmatched returns "OK" response
3+
*/
4+
5+
import { client, v2 } from "@datadog/datadog-api-client";
6+
7+
const configuration = client.createConfiguration();
8+
const apiInstance = new v2.ObservabilityPipelinesApi(configuration);
9+
10+
const params: v2.ObservabilityPipelinesApiValidatePipelineRequest = {
11+
body: {
12+
data: {
13+
attributes: {
14+
config: {
15+
destinations: [
16+
{
17+
id: "datadog-logs-destination",
18+
inputs: ["my-processor-group"],
19+
type: "datadog_logs",
20+
},
21+
],
22+
processorGroups: [
23+
{
24+
enabled: true,
25+
id: "my-processor-group",
26+
include: "service:my-service",
27+
inputs: ["datadog-agent-source"],
28+
processors: [
29+
{
30+
enabled: true,
31+
id: "ocsf-mapper-processor",
32+
include: "service:my-service",
33+
type: "ocsf_mapper",
34+
keepUnmatched: true,
35+
mappings: [
36+
{
37+
include: "source:cloudtrail",
38+
mapping: "CloudTrail Account Change",
39+
},
40+
],
41+
},
42+
],
43+
},
44+
],
45+
sources: [
46+
{
47+
id: "datadog-agent-source",
48+
type: "datadog_agent",
49+
},
50+
],
51+
},
52+
name: "OCSF Mapper Keep Unmatched Pipeline",
53+
},
54+
type: "pipelines",
55+
},
56+
},
57+
};
58+
59+
apiInstance
60+
.validatePipeline(params)
61+
.then((data: v2.ValidationResponse) => {
62+
console.log(
63+
"API called successfully. Returned data: " + JSON.stringify(data)
64+
);
65+
})
66+
.catch((error: any) => console.error(error));

‎features/v2/observability_pipelines.feature‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,14 @@ Feature: Observability Pipelines
191191
When the request is sent
192192
Then the response status is 400 Bad Request
193193

194+
@team:DataDog/observability-pipelines
195+
Scenario: Validate an observability pipeline with OCSF mapper keep_unmatched returns "OK" response
196+
Given new "ValidatePipeline" request
197+
And body with value {"data": {"attributes": {"config": {"destinations": [{"id": "datadog-logs-destination", "inputs": ["my-processor-group"], "type": "datadog_logs"}], "processor_groups": [{"enabled": true, "id": "my-processor-group", "include": "service:my-service", "inputs": ["datadog-agent-source"], "processors": [{"enabled": true, "id": "ocsf-mapper-processor", "include": "service:my-service", "type": "ocsf_mapper", "keep_unmatched": true, "mappings": [{"include": "source:cloudtrail", "mapping": "CloudTrail Account Change"}]}]}], "sources": [{"id": "datadog-agent-source", "type": "datadog_agent"}]}, "name": "OCSF Mapper Keep Unmatched Pipeline"}, "type": "pipelines"}}
198+
When the request is sent
199+
Then the response status is 200 OK
200+
And the response "errors" has length 0
201+
194202
@team:DataDog/observability-pipelines
195203
Scenario: Validate an observability pipeline with OCSF mapper library mapping returns "OK" response
196204
Given new "ValidatePipeline" request

‎packages/datadog-api-client-v2/models/ObservabilityPipelineOcsfMapperProcessor.ts‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,10 @@ export class ObservabilityPipelineOcsfMapperProcessor {
3030
* A Datadog search query used to determine which logs this processor targets.
3131
*/
3232
"include": string;
33+
/**
34+
* Whether to keep an event that does not match any of the mapping filters.
35+
*/
36+
"keepUnmatched"?: boolean;
3337
/**
3438
* A list of mapping rules to convert events to the OCSF format.
3539
*/
@@ -74,6 +78,10 @@ export class ObservabilityPipelineOcsfMapperProcessor {
7478
type: "string",
7579
required: true,
7680
},
81+
keepUnmatched: {
82+
baseName: "keep_unmatched",
83+
type: "boolean",
84+
},
7785
mappings: {
7886
baseName: "mappings",
7987
type: "Array<ObservabilityPipelineOcsfMapperProcessorMapping>",

0 commit comments

Comments
 (0)