Skip to content

Commit 9490b3e

Browse files
Nate Smalleyclaude
andcommitted
pipelines: migrate 91 transform_ocsf entries into push/pull/ structure
Moves 91 community pipeline directories from pipelines/community/transform_ocsf/<name>/ into the ingest-mode-first taxonomy introduced in #59: pipelines/push/syslog/<vendor>/<product>/ 57 entries pipelines/pull/api/<vendor>/<product>/ 29 entries pipelines/pull/object_store/<vendor>/<product>/ 5 entries The mode bucket is determined by each entry's ingest_mode field (backfilled in #61). The vendor and product split is derived per entry from the upstream parser binding and vendor/product convention; collisions across the cluster (Cisco Meraki, Fortinet, Cloudflare, Zscaler, Microsoft, etc.) are disambiguated with explicit product-name overrides documented in .reorg-prep/inventory/transform_ocsf_migration_plan.tsv. History is preserved on every entry (git mv). What stays in pipelines/community/transform_ocsf/ (15 entries): - Generic / template / unknown-vendor entries: agent_metrics_logs, generic_access_logs, inngate_gateway_logs, json_generic_logs, json_nested_kv_logs, leef_template_logs, log4shell_detection_logs, mail_server_logs, microservice_tracing_logs, sample_test_logs, spam_detection_logs, sql_database_logs, syslog_space_delimited_logs, vpc_logs, jruby_application_logs. What is NOT in this PR (intentional): - 23 entries scheduled for removal in #62 (broken-legacy, 7) and #63 (first-party ingestion paths, 16) are NOT moved; they remain in transform_ocsf/ until those PRs merge. This PR has no overlap or conflict with #62/#63 -- merge order does not matter. - No serializer logic, no metadata.yaml content, and no pipeline JSON content was modified. Every change is a directory rename. - No naming-consistency cleanup (e.g., paloalto_* -> palo_alto/*) is applied yet; that is a separate follow-up. The pipelines/push/{syslog,hec}/ and pipelines/pull/{api,object_store}/ directories are now populated -- the empty scaffolding from #59 finally has content. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent af61b53 commit 9490b3e

354 files changed

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

pipelines/community/transform_ocsf/axonius_asset_logs/axonius_asset_logs.json renamed to pipelines/pull/api/axonius/assets/axonius_asset_logs.json

File renamed without changes.

pipelines/community/transform_ocsf/axonius_asset_logs/metadata.yaml renamed to pipelines/pull/api/axonius/assets/metadata.yaml

File renamed without changes.

pipelines/community/transform_ocsf/axonius_asset_logs/sample.json renamed to pipelines/pull/api/axonius/assets/sample.json

File renamed without changes.

pipelines/community/transform_ocsf/axonius_asset_logs/serializer.lua renamed to pipelines/pull/api/axonius/assets/serializer.lua

File renamed without changes.

pipelines/community/transform_ocsf/cloudflare_general_logs/cloudflare_general_logs.json renamed to pipelines/pull/api/cloudflare/general/cloudflare_general_logs.json

File renamed without changes.

pipelines/community/transform_ocsf/cloudflare_general_logs/metadata.yaml renamed to pipelines/pull/api/cloudflare/general/metadata.yaml

File renamed without changes.

pipelines/community/transform_ocsf/cloudflare_general_logs/sample.json renamed to pipelines/pull/api/cloudflare/general/sample.json

File renamed without changes.

pipelines/community/transform_ocsf/cloudflare_general_logs/serializer.lua renamed to pipelines/pull/api/cloudflare/general/serializer.lua

File renamed without changes.

pipelines/community/transform_ocsf/cloudflare_logs/cloudflare_logs.json renamed to pipelines/pull/api/cloudflare/logs/cloudflare_logs.json

File renamed without changes.

pipelines/community/transform_ocsf/cloudflare_logs/metadata.yaml renamed to pipelines/pull/api/cloudflare/logs/metadata.yaml

File renamed without changes.

0 commit comments

Comments
 (0)