@grepr/cli 1.11.5-69ac4ea → 1.11.5-7cd07ac

package/build/dist/docs-index/{83fc8dc2-771a-493a-a763-5de39de4f2ce.txt → 175eea21-b236-4b91-848d-d86d9a2303a2.txt}

@@ -26,7 +26,7 @@ The log reducer divides incoming log events into fixed-duration, tumbling window
 If the reducer cannot find a matching pattern for a message, the message passes through unmodified. Reasons that the reducer cannot find a pattern include:
 
 * The clustering process is unable to extract patterns from messages.
-* The log message field is empty or null.
+* The selected inputs contain neither message tokens nor attribute structure to group by. See [Choose which fields form a pattern](/transforms/reducer/configuration#structured-configuration).
 * The message matches a configured exception rule that prevents it from being reduced.
 
 To learn more about the transformations the reducer applies to messages and how to modify its default behavior, see [Configure the log reducer in a Grepr pipeline](/transforms/reducer/configuration).

package/build/dist/docs-index/{91107ed3-ab9e-4742-afc1-937a0793bade.txt → 345af280-8f4d-4fad-ba5e-9fcdad33ba54.txt}

@@ -57,6 +57,49 @@ To have the reducer prepend a prefix to each summary message that indicates the
 
 Clear **Add repeat count prefix to summary messages** if your downstream system needs to parse the summary message body without changes. For example, if summary messages use JSON formatting, the leading prefix would cause a syntax error.
 
+### Choose which fields form a pattern \[#structured-configuration]
+
+To reduce logs whose useful information is in attributes, on the reducer step of your pipeline, click **Edit** on the **Patterns** card. Use **Build patterns from** to select the fields that determine patterns:
+
+| Build patterns from | Behavior |
+| --- | --- |
+| **Message only** | Uses only the message. Empty messages pass through without reduction. This is the default. |
+| **Message, or attributes when empty** | Uses the message when it is nonempty, otherwise the selected attributes. Summaries of empty-message events have a null message. |
+| **Attributes only** | Ignores the message for pattern matching. Generated summaries have a null message; original samples and exceptions retain their messages. |
+| **Message and attributes** | Uses the selected attribute structure for exact grouping and combines message tokens with any attribute-value tokens for similarity. Summaries contain only the message text, and events with an empty message produce summaries with a null message. |
+
+When attributes participate, their selected key structure must match exactly. Key order does not matter. Adding a selected key, changing nesting, or changing a null field to a populated scalar separates patterns. When the message is read from an attribute that holds a string, that attribute does not participate either: it is used as the message or, with **Attributes only**, ignored along with the message. An attribute holding anything else, such as an object body, provides no message and participates like any other attribute.
+
+With the default, **Message only**, attributes are not used. The attribute settings below appear when you set **Build patterns from** to an option that uses attributes.
+
+Use **Attribute values** to choose how selected attributes affect similarity scoring:
+
+* **Compare values**: Use values as part of the similarity calculations. A mask applies to a value only when it matches the entire value.
+* **Ignore values**: Attribute values are not used for similarity scoring.
+
+### Include or exclude attribute subtrees \[#attribute-prefixes]
+
+Use **Include attributes** and **Exclude attributes** to select the attribute structure and values that participate in pattern matching. Enter each attribute path the same way as in the **Fields** dialog: `@` followed by the path in dot notation, or a JSON array for a key that contains a dot. For example, `@request.headers` selects the nested `request.headers` subtree, while `@["request.headers"]` selects a top-level key containing a literal dot.
+
+Leave the include field empty to include all attributes. Exclusions take precedence over includes. Prefixes select complete subtrees and address keys inside array elements without an array index. Excluded fields, ancestors containing only excluded fields, and array elements containing only excluded fields contribute neither structure nor value tokens. Selected containers that are empty in the event remain part of the shape.
+
+These settings affect pattern matching. They do not remove attributes from events or change their configured merge strategies. An excluded attribute can still be an explicit grouping value. If no message tokens or selected attribute structure remain, the event passes through.
+
+For example, this reducer configuration uses request keys for matching while requiring the excluded tenant value to match exactly:
+
+```json
+{
+  "type": "log-reducer",
+  "tokenizationInput": "ATTRIBUTES_ONLY",
+  "attributeTokenization": "KEYS_ONLY",
+  "includedAttributePrefixes": [["request"]],
+  "excludedAttributePrefixes": [["request", "tenant_id"], ["request", "trace_id"]],
+  "partitionByAttributePaths": [["request", "tenant_id"]]
+}
+```
+
+The `pattern-matcher` operation supports the same API settings and preserves the messages of forwarded events. Both operations default `tokenizationInput` to `MESSAGE_ONLY`, which is **Message only**, so attributes are not used. When attributes are used, `attributeTokenization` defaults to `KEYS_AND_VALUES`, which is **Compare values**, and empty attribute lists select every attribute.
+
 ## Configure a sampling strategy \[#sampling-configuration]
 
 The **Sampling Configuration** section controls whether and how additional raw messages are forwarded for a pattern after the minimum number of samples is reached in the current aggregation window. To configure the sampling strategy for a reducer, in the **Sampling strategy** menu, select one of the following options:
@@ -130,7 +173,7 @@ To modify the delimiter list:
 
 ## Configure how attributes are merged \[#attribute-configuration]
 
-To group log messages, the log reducer uses only the text in the `message` field. However, because of the possible variability of the attribute values associated with the grouped messages, the reducer provides multiple strategies to merge them.
+The log reducer groups events using the configured [pattern inputs](#structured-configuration). Attribute values can differ within a group, so the reducer provides multiple strategies to merge them. These merge strategies also apply to attributes excluded from pattern matching.
 
 To control how the reducer combines attributes, you use the **Attribute Configuration** section to specify merge strategies for individual attribute paths and configure a default strategy that applies to any attribute path without an explicit configuration.
 
@@ -213,6 +256,10 @@ With Window-Based Logarithmic sampling, a larger logarithm base forwards fewer a
 
 Masks are regular expressions that identify variable parts of a log message, such as timestamps, IDs, or IP addresses, and replace them with specific tokens before clustering. This normalizes messages that differ only in those values so they can be grouped into the same pattern.
 
+### Why are my JSON-only or fully structured logs not being reduced?
+
+On the Patterns card, set Build patterns from to 'Message, or attributes when empty', 'Attributes only', or 'Message and attributes'. The default, 'Message only', passes empty-message events through without reduction. Selected attribute keys define exact grouping boundaries. With 'Compare values', selected values also participate in similarity matching; with 'Ignore values', they do not. Summaries of patterns without message text have a null message.
+
 ### Can I add my own masks?
 
 Yes. Click Add Custom Mask in the Mask Configuration section. The mask name must contain only lowercase letters, be no more than 50 characters long, and be unique across all masks in the reducer. Then enter the regular expression pattern to apply.

package/build/dist/docs-index/{fa26819f-d6a4-40cf-95c6-ef3602c39264.txt → 3e35aca4-4a4f-42aa-846f-de7b25393e2e.txt}

@@ -19,6 +19,9 @@
 - name: payload (required)
   type: `AgentConfigPayload`
 
+- name: state (optional)
+  type: enum: `ACTIVE`, `PAUSED`, `DELETED`
+
 - name: updatedAt (required)
   type: string
 

package/build/dist/docs-index/416a6270-8a03-4f92-96eb-a7cb274be302.txt

@@ -0,0 +1,38 @@
+# Pause or resume an agent
+
+**PUT** `/v1/agents/{id}/state`
+
+**Operation ID**: `setState`
+**Summary**: Pause or resume an agent
+Sets the agent to PAUSED or ACTIVE. A paused agent runs no investigations: signals from every source are dropped, manual starts and resumes are refused, and queued investigations wait until the agent is resumed. Pipelines keep marking new patterns as sent, so after resuming, the agent usually reacts only to patterns that are new since then.
+
+## Tags
+- Agents
+## Parameters
+
+- **id** (required) - path
+  - Type: string
+
+## Request Body
+
+**Content-Type**: `application/json`
+
+**Schema**: `StateChangeRequest`
+
+## Responses
+
+### 204
+
+State set (or already set)
+
+### 400
+
+The state is not ACTIVE or PAUSED
+
+### 401
+
+Unauthorized
+
+### 404
+
+Agent not found

package/build/dist/docs-index/68a742b6-1888-4aaa-a2a5-adef6899c5c6.txt

@@ -0,0 +1,14 @@
+# AgentPipelineSubscription
+
+**Type**: `object`
+
+## Properties
+
+- name: jobId (required)
+  type: string
+
+- name: pausedAt (optional)
+  type: string
+
+- name: subscribedAt (required)
+  type: string

package/build/dist/docs-index/c41cabc0-ea84-439f-b9b8-640777637a75.txt

@@ -0,0 +1,8 @@
+# StateChangeRequest
+
+**Type**: `object`
+
+## Properties
+
+- name: state (required)
+  type: enum: `ACTIVE`, `PAUSED`