@grepr/cli 1.12.7 → 1.14.3-5fb972a

package/build/dist/docs-index/20af90e2-e3e3-49f9-bf38-ad04c2447e63.txt

@@ -1,301 +0,0 @@
-Configure the Grepr log reducer to reduce the volume of logs forwarded to your observability vendor while preserving access to your raw logs.
-
-# Configure the log reducer in a Grepr pipeline
-
-This page describes the transformations the log reducer applies to incoming log messages and how to configure them to meet your requirements. When you create log reduction pipelines, Grepr adds a log reducer with default settings that control how log messages are aggregated, grouped, tokenized, and summarized. These settings are suitable for many log-processing workloads, but you can modify these settings to meet your requirements through the Grepr UI, the REST API, or the Grepr CLI. This page describes each setting and how to configure the setting in the UI. For the API documentation, see the [LogReducer API specification](/apis/api-spec#schema/LogReducer). For the CLI, see [The Grepr CLI](/cli).
-
-The log reducer transforms logs into summarized events through a multi-step process. The reducer divides the incoming log stream into consecutive *aggregation windows* and produces summaries for each window separately. An aggregation window is a fixed-duration, tumbling window over which the reducer counts and aggregates the messages that match each pattern. Tumbling windows are contiguous and non-overlapping, so each log belongs to exactly one window. The aggregation window is two minutes by default.
-
-> To change the aggregation window duration, you must use the Grepr REST API. You cannot use the Grepr UI to change the window duration. Before changing this value, Grepr recommends contacting <support@grepr.ai> for guidance.
-
-The following describes the core steps in this process and includes links with details on changing the default behavior for each step:
-
-* Masking replaces dynamic values such as timestamps, IDs, and IP addresses with specific tokens. By normalizing values that represent the same entity but might differ slightly in format or content, masking prevents them from being split incorrectly in the next step. See [Enable grouping of dynamic fields by assigning common tokens](#mask-configuration).
-* Tokenizing breaks log messages into tokens based on configurable delimiters, creating a structured representation optimized for grouping. See [Configure delimiters used to split log messages](#delimiter-configuration).
-* Grouping uses similarity metrics to group messages into patterns. A configurable similarity threshold determines how closely messages must match to be considered part of the same pattern. You can use grouping to retain the values of important fields by excluding them from aggregation. See [Configure how messages are grouped](#grouping-configuration).
-* Sampling sends a configurable number of raw sample messages per pattern. This number is referred to as the *deduplication threshold* throughout this documentation. After this threshold is reached, you can configure the reducer to stop forwarding that pattern until the end of the aggregation window, or use logarithmic sampling. See [Configure a sampling strategy](#sampling-configuration).
-* Summarizing generates, at the end of each aggregation window, concise summaries of aggregated messages that matched an identified pattern. For details on the fields included in the summarized output events, see [Summary message metadata](/transforms/reducer#summary-metadata).
-
-To modify the configuration settings in the UI, on the overview page for your pipeline, click **Reducer** in the left-hand navigation menu to open the **Edit Reducer** dialog. The dialog contains a form to configure **Grouping Configuration**, **Aggregation Configuration**, **Sampling Configuration**, **Mask Configuration**, **Delimiter Configuration**, and **Attribute Configuration** values. The following sections describe these settings.
-
-## Configure how messages are grouped \[#grouping-configuration]
-
-Grouping controls how incoming messages are partitioned into independent groups before pattern detection, and the level of similarity messages must meet to be considered part of the same pattern.
-
-### Group messages by a field \[#group-by-configuration]
-
-Messages are aggregated separately for each unique combination of values across the fields you group on, so patterns from different services, hosts, or other dimensions are never merged. Grouping on `service`, `host`, and the `http.url.path` attribute aggregates messages independently for each unique combination of those three values.
-
-To group on a field, on the pipeline's **Reducer** step, click **Edit** on the **Fields** card, find the field, and set its behavior to **Match or split**. A field with this behavior is kept out of aggregation, so messages whose values for it differ are never merged into one pattern.
-
-Attribute paths are written with an `@` prefix and dot notation for nested attributes, such as `@http.url.path`. Tag keys are written as the key name alone.
-
-Use grouping to retain the values of important fields by excluding them from aggregation, such as high-cardinality identifiers like user IDs. To keep a field that is currently inside the message, parse it into an attribute or a tag with the **JSON Parser** or **Grok Parser** step earlier in the pipeline, then group on that field. See [Transform JSON strings into JSON objects](/transforms/json-parsing) and [Parse log messages to enrich log events with the Grok parser](/transforms/grok).
-
-Grouping also decides how a summary can be routed, because a summary carries the tag values of the fields it was grouped on. To use grouping to send each group's logs to a different destination, see [_](/solution-guides/route-logs-to-several-accounts).
-
-### Similarity threshold (%)
-
-The similarity threshold controls how close a set of tokens must be to an existing pattern for the reducer to consider the message a match for that pattern. To set this threshold, enter a whole number from 20 to 100. This value represents the percentage of tokens that must match between the incoming message and the pattern.
-
-* A higher value requires a closer match to group messages into the same pattern. Higher values produce more distinct patterns, each containing fewer of the tokens defined by [regular expression masks](#mask-configuration), and reduce volume less aggressively.
-* A lower value allows grouping messages with more variation into the same pattern. Lower values lead to greater reduction, but the resulting summary messages contain more mask-defined tokens.
-
-## Configure how messages are aggregated \[#aggregation-configuration]
-
-The **Aggregation Configuration** section controls how many raw messages are forwarded before aggregation begins for a pattern and how summary messages are formatted.
-
-### Minimum number of samples
-
-To set a *deduplication threshold* for messages, in the **Minimum number of samples** field, enter a whole number of two or greater. This value is the minimum count of messages matching a pattern that the reducer forwards as raw messages inside a single aggregation window before it begins aggregating additional matches into a summary message. Until this threshold is reached, unaggregated messages are forwarded to your sinks.
-
-Use a lower value to begin aggregation sooner and maximize volume reduction. Use a higher value when a pattern has a higher threshold for the number of duplicate messages to forward before beginning aggregation.
-
-### Add repeat count prefix to summary messages
-
-To have the reducer prepend a prefix to each summary message that indicates the number of raw messages aggregated and the duration of the aggregation period, select **Add repeat count prefix to summary messages**.
-
-Clear **Add repeat count prefix to summary messages** if your downstream system needs to parse the summary message body without changes. For example, if summary messages use JSON formatting, the leading prefix would cause a syntax error.
-
-### Choose which fields form a pattern \[#structured-configuration]
-
-To reduce logs whose useful information is in attributes, on the reducer step of your pipeline, click **Edit** on the **Patterns** card. Use **Build patterns from** to select the fields that determine patterns:
-
-| Build patterns from | Behavior |
-| --- | --- |
-| **Message only** | Uses only the message. Empty messages pass through without reduction. This is the default. |
-| **Message, or attributes when empty** | Uses the message when it is nonempty, otherwise the selected attributes. Summaries of empty-message events have a null message. |
-| **Attributes only** | Ignores the message for pattern matching. Generated summaries have a null message; original samples and exceptions retain their messages. |
-| **Message and attributes** | Uses the selected attribute structure for exact grouping and combines message tokens with any attribute-value tokens for similarity. Summaries contain only the message text, and events with an empty message produce summaries with a null message. |
-
-When attributes participate, their selected key structure must match exactly. Key order does not matter. Adding a selected key, changing nesting, or changing a null field to a populated scalar separates patterns. When the message is read from an attribute that holds a string, that attribute does not participate either: it is used as the message or, with **Attributes only**, ignored along with the message. An attribute holding anything else, such as an object body, provides no message and participates like any other attribute.
-
-With the default, **Message only**, attributes are not used. The attribute settings below appear when you set **Build patterns from** to an option that uses attributes.
-
-Use **Attribute values** to choose how selected attributes affect similarity scoring:
-
-* **Compare values**: Use values as part of the similarity calculations. A mask applies to a value only when it matches the entire value.
-* **Ignore values**: Attribute values are not used for similarity scoring.
-
-### Include or exclude attribute subtrees \[#attribute-prefixes]
-
-Use **Include attributes** and **Exclude attributes** to select the attribute structure and values that participate in pattern matching. Enter each attribute path the same way as in the **Fields** dialog: `@` followed by the path in dot notation, or a JSON array for a key that contains a dot. For example, `@request.headers` selects the nested `request.headers` subtree, while `@["request.headers"]` selects a top-level key containing a literal dot.
-
-Leave the include field empty to include all attributes. Exclusions take precedence over includes. Prefixes select complete subtrees and address keys inside array elements without an array index. Excluded fields, ancestors containing only excluded fields, and array elements containing only excluded fields contribute neither structure nor value tokens. Selected containers that are empty in the event remain part of the shape.
-
-These settings affect pattern matching. They do not remove attributes from events or change their configured merge strategies. An excluded attribute can still be an explicit grouping value. If no message tokens or selected attribute structure remain, the event passes through.
-
-For example, this reducer configuration uses request keys for matching while requiring the excluded tenant value to match exactly:
-
-```json
-{
-  "type": "log-reducer",
-  "tokenizationInput": "ATTRIBUTES_ONLY",
-  "attributeTokenization": "KEYS_ONLY",
-  "includedAttributePrefixes": [["request"]],
-  "excludedAttributePrefixes": [["request", "tenant_id"], ["request", "trace_id"]],
-  "partitionByAttributePaths": [["request", "tenant_id"]]
-}
-```
-
-The `pattern-matcher` operation supports the same API settings and preserves the messages of forwarded events. Both operations default `tokenizationInput` to `MESSAGE_ONLY`, which is **Message only**, so attributes are not used. When attributes are used, `attributeTokenization` defaults to `KEYS_AND_VALUES`, which is **Compare values**, and empty attribute lists select every attribute.
-
-## Configure a sampling strategy \[#sampling-configuration]
-
-The **Sampling Configuration** section controls whether and how additional raw messages are forwarded for a pattern after the minimum number of samples is reached in the current aggregation window. To configure the sampling strategy for a reducer, in the **Sampling strategy** menu, select one of the following options:
-
-### No Additional Sampling
-
-During each aggregation window, Grepr passes through a configurable number of sample messages for each pattern before beginning aggregation. After the deduplication threshold is reached for a specific pattern, Grepr stops sending messages for that pattern until the end of the aggregation window, at which point a summary is emitted. This ensures that a minimum number of raw messages always pass through unmodified. Low-frequency messages that usually contain important troubleshooting information pass through unmodified.
-
-While this default behavior maximizes reduction, the actual count of messages seen at the vendor is independent of the number of original raw messages. Instead, the count is based on the messages summarized in each aggregation window. Features in external log aggregators that depend on message counts by pattern, such as Datadog's "top patterns" capability, might not work as expected. To address this, select the following logarithmic sampling option.
-
-### Window-Based Logarithmic
-
-With logarithmic sampling, high-volume patterns that occur in the aggregation window are sampled more heavily than low-volume patterns.
-
-When you select this option, to configure the rate of additional sampling, enter a whole number of two or greater in the **Logarithm Base** field. The reducer process uses this base value to increase the sample size logarithmically. For example, if the base is set to two and the deduplication threshold is set to four, Grepr sends one additional sample message when the number of messages in the aggregation window first exceeds two raised to the power of the deduplication threshold + 1 (`2^5 or 32`). Additional samples are then sent at the 64th, 128th, 256th, and subsequent messages. This ensures that an unexpectedly large increase in messages matching a pattern still appears as an increase in message count at the vendor, but with a logarithmically smaller magnitude.
-
-## Enable grouping of dynamic fields by assigning common tokens \[#mask-configuration]
-
-The **Mask Configuration** section defines the regular expression masks that the reducer uses to replace variable parts of a log message, such as timestamps, IDs, or IP addresses, with specific tokens before the message is tokenized and grouped. Masking normalizes variable content so that messages that differ only in these values are grouped into the same pattern.
-
-The reducer ships with the following default masks. Each appears as a row in the **Mask Configuration** section and can be enabled, disabled, edited, or reset to its original pattern:
-
-| Mask | Default state | Description |
-| --- | --- | --- |
-| `timestamp` | Enabled | Matches many timestamp formats, such as `2024-04-26T15:30:45.123Z`, `26/04/2024 15:30:45`, or `15:30:45`. |
-| `ipport` | Enabled | Matches IPv4 addresses and optional ports, such as `192.168.0.1` or `192.168.0.1:8080`. |
-| `number` | Enabled | Matches integers and decimal numbers up to 100 digits. |
-| `uuid` | Enabled | Matches UUIDs, such as `123e4567-e89b-12d3-a456-426614174000`. |
-| `awsarn` | Disabled | Matches AWS ARNs. |
-| `awstoken` | Disabled | Matches AWS session tokens. |
-
-For each mask row, you can:
-
-* Select or clear the checkbox on the left to enable or disable the mask. Only enabled masks are applied to incoming messages.
-* Click **Edit** to display the regular expression for the mask and modify the pattern. The pattern field cannot be empty.
-* For default masks, click the restore icon to reset the pattern to its original value.
-* For custom masks, click the delete icon to remove the mask.
-
-### Enable grouping of non-default formats by assigning custom tokens
-
-To ensure the correct grouping of fields with formats that aren't handled by the default masks, you can create custom masks. For example, you might have a field with values that include delimiter characters, and you need to prevent the reducer from splitting the single field on those delimiters.
-
-When you add a custom mask, you must enter a name for the mask that:
-
-* Contains only lowercase alphabetic characters. Spaces, digits, and symbols are not allowed.
-* Is no more than 50 characters long.
-* Is unique across all masks in this reducer.
-
-Enter the mask in the **Regular Expression Pattern** text box. A custom mask pattern supports the following common regular expression constructs:
-
-* Literal characters and character classes, such as `[a-z]`, along with predefined classes such as `\d`, `\w`, and `\s`.
-* Quantifiers, such as `*`, `+`, `?`, and `{n,m}`.
-* Alternation with `|` and grouping with `(` and `)`.
-* Anchors and word boundaries, such as `^`, `$`, and `\b`.
-
-> Custom mask patterns do not support lookahead or lookbehind assertions or backreferences. A pattern that uses one of these constructs passes the validation in the form but prevents the reducer from processing messages. To confirm that a custom mask matches the values you expect, test the pattern against sample messages.
-
-## Configure delimiters used to split log messages \[#delimiter-configuration]
-
-The **Delimiter Configuration** section defines the characters that the reducer uses to split a log message into tokens during clustering. After masking, the reducer splits each message into tokens using these characters and then calculates similarity against known patterns. Characters that are not in the delimiter list are treated as part of a token.
-
-The default delimiter set contains common punctuation and whitespace characters: `:`, `#`, `[`, `]`, `(`, `)`, `{`, `}`, `|`, `,`, `;`, `"`, `'`, space, `\t`, `\n`, and `\r`.
-
-> The default set intentionally omits `@` and `.` so that email addresses and dotted identifiers, such as fully qualified class names, are not split across tokens.
-
-To modify the delimiter list:
-
-* To remove a delimiter, hover over its chip in the delimiter list and click the delete icon that appears.
-* To add a delimiter, enter the character in the **Add delimiter** field and click **Add** or press **Enter**. For control characters, enter the escape sequence: `\t` for tab, `\n` for newline, `\r` for carriage return, `\b` for backspace, `\f` for form feed, `\v` for vertical tab, or `\0` for null. Duplicate delimiters are rejected.
-* To restore the default delimiter set, click **Reset to Defaults**.
-
-## Configure how attributes are merged \[#attribute-configuration]
-
-The log reducer groups events using the configured [pattern inputs](#structured-configuration). Attribute values can differ within a group, so the reducer provides multiple strategies to merge them. These merge strategies also apply to attributes excluded from pattern matching.
-
-To control how the reducer combines attributes, you use the **Attribute Configuration** section to specify merge strategies for individual attribute paths and configure a default strategy that applies to any attribute path without an explicit configuration.
-
-The reducer supports the following merge strategy types:
-
-| Strategy | Behavior |
-| --- | --- |
-| **Exact Match** | If all aggregated messages have the same value for the attribute, the summary preserves that value. If they differ, the summary stores a wildcard, `*`. |
-| **Sample** | Collects up to a configured **Sample Limit** of values from the aggregated messages. When the limit is reached, additional values are dropped. |
-| **Preserve All** | Collects every distinct or repeated value from the aggregated messages, up to a configured **Preserve Limit**. When the incoming data exceeds the limit, the reducer emits the current summary and starts a new one, rather than dropping values. |
-| **Sum** | Sums numeric values across aggregated messages and stores the result as a scalar number. Non-numeric values are ignored. Collections of numbers are summed element by element. |
-| **Min** | Keeps the minimum numeric value across aggregated messages. Non-numeric values are ignored. |
-| **Max** | Keeps the maximum numeric value across aggregated messages. Non-numeric values are ignored. |
-| **Average** | Computes the arithmetic mean of numeric values across aggregated messages. Non-numeric values are ignored. |
-
-To see examples and learn more about the merge strategies, see [Merge strategy examples](/transforms/reducer/configuration/merge-strategy-examples).
-
-### Configure merge strategies
-
-To add a merge strategy, in the **Attribute merging strategies** section, click the plus (+) icon. Select a strategy from the **Strategy** menu and enter the target attribute path. If any part of the target path uses dot notation, enter the target path using dot notation, such as `http.response.bytes`, or a JSON array, such as `["http", "response", "bytes"]`. Each entry must have a non-empty path, and each path must be unique within the list.
-
-When you select **Sample** or **Preserve All**, you can configure the following settings:
-
-* **Sample Limit** or **Preserve Limit**: A whole number that's one or greater. These values cap the size of the collected values. **Sample** defaults to 10 and **Preserve All** defaults to 1000.
-* **Keep unique values only**: When selected, the reducer stores the collected values as a set and discards duplicates. When cleared, the reducer stores the values as a list and preserves duplicates.
-
-When you configure more than one strategy for the same attribute path, the reducer writes a separate attribute in the summary for each strategy, using a suffix such as `_sum`, `_avg`, or `_min`. The first strategy in the list also writes to the base attribute name. For example, configuring **Sum** and then **Average** for `bytes_sent` produces `bytes_sent_sum`, which is also written to `bytes_sent`, and `bytes_sent_avg`. To change the order in which strategies are applied, drag them in the list.
-
-> Adding multiple strategies, whether to a specific path or the default, adds additional attributes to the summary and requires more processing per message. Use multiple strategies only when your analytics or dashboards need more than one aggregated form of the same attribute.
-
-Each strategy type can be used only once per attribute path.
-
-### Configure the default strategy
-
-The **Default Strategy** section defines the strategies that apply to every attribute path that is not configured under **Attribute merging strategies**. You must configure at least one default strategy. **Exact Match** is the default.
-
-As with path-specific strategies, you can add multiple default strategies. When you add multiple default strategies, each strategy produces a suffixed attribute in the summary, and the first strategy also writes to the base attribute name.
-
-## Send new-pattern signals to AI agents \[#agent-signals]
-
-The reducer identifies the patterns in your logs, which also makes it the first place a pattern that has never occurred before becomes visible. You can have the pipeline report each new pattern to your Grepr AI agents, so an agent investigates behavior that is new in your systems without you writing an alert for it first.
-
-To turn this on, on the reducer step of your pipeline, open the **Advanced** settings and select **Emit new-pattern signals to AI agents**.
-
-Turning it on emits nothing by itself. A signal reaches an agent only when that agent is subscribed to the pipeline, and Grepr refuses a subscription to a pipeline that has this setting off. So turn it on first, then subscribe the agent.
-
-Each pattern signals an agent once rather than on every occurrence, for as long as the reducer keeps that pattern in its state, so a pattern that keeps matching does not keep starting investigations. To learn how signals reach an agent and how to bound the volume, see [_](/ai-agents/subscriptions).
-
-## Frequently Asked Questions
-
-### What is the aggregation window?
-
-The aggregation window is a fixed-duration, tumbling window over which the reducer counts and aggregates the messages that match each pattern. The reducer divides the incoming log stream into consecutive windows and produces a summary separately for each window. The window is two minutes by default. You cannot change the window duration in the Grepr UI; you must use the REST API, and Grepr recommends contacting support for guidance before changing it.
-
-### How do I prevent messages from different services being aggregated together?
-
-Add the tag key that identifies each service, such as service or env, to the Group-by values field. The reducer aggregates messages independently for each unique combination of group-by values, so patterns from different services are never merged.
-
-### What does the similarity threshold control?
-
-The similarity threshold is the percentage of tokens that must match between an incoming message and an existing pattern for the message to be considered part of that pattern. Higher values produce more distinct patterns and less aggressive reduction. Lower values produce broader patterns and more aggressive reduction, at the cost of more mask-defined tokens in each summary.
-
-### Why should I raise the minimum number of samples?
-
-The minimum number of samples is how many raw matching messages are forwarded for a pattern in an aggregation window before aggregation begins. Raise it when you want more raw samples of each pattern to be sent to your observability backend. Lower it to begin aggregation sooner and reduce more volume.
-
-### When should I disable the repeat count prefix?
-
-Disable the repeat count prefix when downstream systems parse the summary message body directly, such as when summary messages contain JSON. The prefix would otherwise prepend non-JSON text and break parsing.
-
-### What's the difference between the two sampling strategies?
-
-No Additional Sampling stops forwarding raw messages for a pattern as soon as the minimum number of samples has been reached in an aggregation window. Window-Based Logarithmic continues to forward additional raw samples at a logarithmically decreasing rate, preserving more visibility into high-volume patterns.
-
-### How does the logarithm base affect sampling?
-
-With Window-Based Logarithmic sampling, a larger logarithm base forwards fewer additional samples as message volume grows, and a smaller base forwards more. The base must be at least two.
-
-### What are masks and why does the reducer apply them?
-
-Masks are regular expressions that identify variable parts of a log message, such as timestamps, IDs, or IP addresses, and replace them with specific tokens before clustering. This normalizes messages that differ only in those values so they can be grouped into the same pattern.
-
-### Why are my JSON-only or fully structured logs not being reduced?
-
-On the Patterns card, set Build patterns from to 'Message, or attributes when empty', 'Attributes only', or 'Message and attributes'. The default, 'Message only', passes empty-message events through without reduction. Selected attribute keys define exact grouping boundaries. With 'Compare values', selected values also participate in similarity matching; with 'Ignore values', they do not. Summaries of patterns without message text have a null message.
-
-### Can I add my own masks?
-
-Yes. Click Add Custom Mask in the Mask Configuration section. The mask name must contain only lowercase letters, be no more than 50 characters long, and be unique across all masks in the reducer. Then enter the regular expression pattern to apply.
-
-### Which regular expression features can I use in a custom mask?
-
-A custom mask pattern supports common regular expression constructs, including literal characters and character classes such as \[a-z], \d, \w, and \s; quantifiers such as \*, +, ?, and {n,m}; alternation and grouping; and anchors and word boundaries such as ^, $, and \b. Lookahead and lookbehind assertions and backreferences are not supported. A pattern that uses an unsupported construct passes the form's validation but prevents the reducer from processing messages, so test a custom pattern against sample messages.
-
-### What are delimiters and when should I change them?
-
-Delimiters are the characters the reducer uses to split messages into tokens during clustering. The defaults cover common punctuation and whitespace but omit @ and . so email addresses and dotted identifiers are not split. Change the list when your log format uses other separators, such as a custom field delimiter.
-
-### How do I add a tab, newline, or carriage return delimiter?
-
-Enter the escape sequence in the Add delimiter field: \t for tab, \n for newline, or \r for carriage return. Additional control-character escape sequences, including \b, \f, \v, and \0, are also supported.
-
-### What does each attribute merge strategy do?
-
-Exact Match keeps a single value if all messages agree and stores a wildcard otherwise. Sample collects up to a limit of values and drops overflow. Preserve All collects every value up to a limit and emits the current summary when the limit would be exceeded. Sum, Min, Max, and Average compute the corresponding aggregation over numeric values, ignoring non-numeric values.
-
-### What is the difference between Sample and Preserve All?
-
-Sample stops collecting once its limit is reached and discards any further values in the same summary. Preserve All emits the current summary and starts a new one when adding more values would exceed its limit, so no value is discarded. Sample has a lower default limit; Preserve All has a higher default limit.
-
-### When does the 'Keep unique values only' checkbox matter?
-
-For Sample and Preserve All strategies, it controls how collected values are stored. When selected, values are stored as a set and duplicates are discarded. When cleared, values are stored as a list, and duplicates are preserved.
-
-### How do I target a specific attribute with its own strategy?
-
-Add an entry under Attribute merging strategies, enter the attribute path using dot notation or a JSON array, and configure one or more strategies. Paths must be unique within the list, and each entry must have a non-empty path.
-
-### What happens when I select multiple strategies for the same attribute?
-
-The reducer produces a separate attribute in the summary for each strategy, suffixed with the strategy name, such as _sum or _avg. The first strategy in the list also writes to the base attribute name. Each strategy type can be used only once per attribute path.
-
-### What does the default strategy apply to?
-
-The default strategy applies to every attribute path that does not have an explicit entry in Attribute merging strategies. Exact Match is the default, but you can configure one or more other strategies. As with path-specific strategies, additional default strategies produce suffixed attributes and require more processing.

package/build/dist/docs-index/211fa895-7a66-4b0c-9572-0624c87549e1.json

@@ -1 +0,0 @@
-{"docType":"schema"}

package/build/dist/docs-index/211fa895-7a66-4b0c-9572-0624c87549e1.txt

@@ -1,24 +0,0 @@
-# WriteS3DataWarehouse
-
-**Type**: `object`
-
-## Properties
-
-- name: name (required)
-  type: string
-  description: Name of the integration.
-
-- name: payload (required)
-  type: `S3DataWarehouse`
-
-- name: teamIds (optional)
-  type: array of string
-  description: The team IDs that this integration is associated with.
-
-- name: type (required)
-  type: enum: `s3-data-warehouse`
-  description: The type of the integration. This is used to determine the payload type.
-
-- name: version (required)
-  type: integer
-  description: Version of the integration. Should be increased by one for every new update in order for the write to succeed. Otherwise, a '409 Conflict' will be returned.

package/build/dist/docs-index/212f60ea-998a-4db9-bc44-3e46342f6568.json

@@ -1 +0,0 @@
-{"docType":"doc"}

package/build/dist/docs-index/212f60ea-998a-4db9-bc44-3e46342f6568.txt

@@ -1,244 +0,0 @@
-Learn how to use the Grepr Splunk integration to ingest logs to a Grepr pipeline for processing and send the processed logs to your Splunk instance.
-
-# Configure Splunk connections with a Grepr integration
-
-The Grepr Splunk integration enables you to ingest logs into Grepr using a Grepr source, process the logs with a Grepr pipeline, and then send the processed logs to Splunk using a Grepr sink.
-
-The Grepr Splunk integration supports forwarding data through the following interfaces:
-
-* **Splunk's HTTP Event Collector (HEC)**: You can use any collector that supports HEC, including Fluent Bit, Fluentd, and the Splunk OpenTelemetry Collector.
-* **S2S over HTTP**: You can forward data from Splunk Universal Forwarders or Splunk Heavy Forwarders using S2S over HTTP. S2S over TCP is not supported.
-
-To send logs to a Grepr pipeline before forwarding them to your Splunk instance, change your collector configuration to send the logs to a Grepr endpoint URL rather than a Splunk HEC or S2S endpoint.
-
-In addition to using a Splunk integration to ingest log data with a Grepr source and send processed logs to Splunk with a Grepr sink, you can also use a Splunk HTTP source to ingest data from a Splunk instance into Grepr for processing. See [Ingest log data from Splunk using the Splunk HTTP source](#splunk-http-source).
-
-You can use the Grepr UI or REST API to add a Splunk integration. To learn how to create a Splunk integration in the Grepr UI and configure collectors to send logs to Grepr, see [Use a Splunk integration in a Grepr pipeline](#use-splunk-integration).
-
-To use the REST API, see the [Splunk Integration specification](/apis/api-spec#tag/Splunk-Integration).
-
-> Although this page describes using an integration to create a pipeline for sourcing and sending data with a single observability platform, your pipelines can use multiple integrations to source and sink data for different platforms. For example, you can create a pipeline with a Datadog integration that's used to source data from Datadog agents, and a Splunk integration and sink that sends the pipeline output to Splunk.
-
-## Requirements \[#splunk-requirements]
-
-The Grepr integration for Splunk requires the following:
-
-* An HTTP Event Collector (HEC) token is required for both HEC and S2S. You can create an HEC token in the Splunk platform settings. See [Set up and use the HTTP Event Collector in Splunk Web](https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector).
-* A Bearer token for authentication to the Splunk REST API is required for using a Splunk HTTP source to ingest data from a Splunk instance into Grepr. The user associated with the token must have the `search` and `rest_access_server_endpoints` capabilities. See [Ingest log data from Splunk using the Splunk HTTP source](#splunk-http-source).
-
-For details on creating tokens for the Splunk API, see [Create authentication tokens](https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.4/authenticate-into-the-splunk-platform-with-tokens/create-authentication-tokens).
-
-## Use a Splunk integration in a Grepr pipeline \[#use-splunk-integration]
-
-Use the following steps to create a Splunk integration in the Grepr UI and use it in a pipeline to source and sink data.
-
-### Step 1: Create a Splunk integration \[#create-splunk-integration]
-
-To create a Splunk integration in the Grepr UI:
-
-1. Go to the **Integrations** page in the Grepr UI and click **Add new** next to **Observability Vendors**.
-
-2. In the **Add Observability Vendor** dialog:
-
-   * In the **Type** menu, select **Splunk** .
-   * In the **Name** field, enter a name for the integration.
-   * In the **Ingest Auth token** field, enter your Splunk HEC token.
-   * In the **Splunk Host** field, enter the hostname for your Splunk instance.
-   * Optional: To use an HTTP source to ingest data, in the **REST API Search Bearer token** field, enter a Bearer token to authenticate against the Splunk API. The token must be associated with a user with the required permissions. See the [Requirements](#splunk-requirements).
-   * Optional: Use the **Validate SSL certificate** checkbox to turn validation of SSL certificates on or off when Grepr connects to your Splunk instance.
-
-3. Click **Create**.
-
-   #### Optional: Grant team access to the integration
-
-   When you have teams in your Grepr organization, you can grant access to the integration to one or more of those teams. To configure team access when you create or edit an integration:
-
-   1. In the **Grant Team Access** section, click the plus sign icon (+).
-
-   2. Select the team or teams that should be granted access to the integration.
-
-   3. Click **Create**.
-
-   To learn more, see [Manage teams in the Grepr platform](/admin/manage-teams) and [Permissions in the Grepr platform](/grepr-platform/permissions).
-
-### Step 2: Add a source to your pipeline \[#add-splunk-source]
-
-To add a source to your pipeline that uses the Splunk integration:
-
-1. In the Grepr UI, go to the details page for an existing pipeline or create a new pipeline from the homepage.
-2. In the left-hand navigation menu on the pipeline details page, click **Sources**.
-3. In the **Add source** dialog, select the Splunk integration in the **Source** menu.
-4. Click **Submit**.
-
-### Step 3: Forward logs to Grepr using HEC
-
-To send data to Grepr, you configure your collector or agent to send it to the ingestion URL for your Grepr integration, rather than to your observability vendor's platform. To find the ingestion URL when using the Grepr UI to configure your pipeline, go to the details page for the pipeline, click **Sources** in the left pane, and copy the **Ingest URL**.
-
-
-
-If you connect to Grepr through AWS PrivateLink, copy the private ingestion URL and use it in place of the public ingestion URL. To learn more about sending data to Grepr over AWS PrivateLink, see [Securely forward observability data to Grepr with AWS PrivateLink](/admin/private-link).
-
-When you use the API, you can construct the ingestion URL using the following format:
-
-`https://<integration-id>-<org-id>.ingest.grepr.ai/services/collector/event`
-
-Replace `<integration-id>` with the identifier of the vendor integration used by your pipeline and replace `<org-id>` with the identifier for your organization.
-
-To use the PrivateLink endpoint service, insert `.private` after the `ingest` host segment.
-
-Although all sources created from the same integration share the same ingestion URL, you can use a single integration to create sources for multiple pipelines. The Grepr platform ensures events are routed to the correct pipelines.
-
-To see more information and configuration examples, select the tab for your preferred collector:
-
-Fluent Bit can forward logs using the Splunk output plugin. To configure the plugin, set the `Host` value to the hostname from the Splunk integration's ingestion URL and the `Splunk_Token` value to your Splunk HEC token. The following is an example `OUTPUT` section from a Fluent Bit configuration file (`fluent-bit.conf`):
-
-```fluent
-[OUTPUT]
-   Name              splunk
-   Match             *
-   Host              <ingestion-host>
-   Port              443
-   TLS               On
-   TLS.Verify        On
-   Splunk_Token      <hec-token>
-```
-
-Replace:
-
-* `<ingestion-host>` with the hostname from your ingestion URL. Do not include the `https://` prefix or the path value. For example, if the ingestion URL is `https://0abc1defghij2-<org-id>.ingest.grepr.ai/services/collector/event`, set the value to `0abc1defghij2-<org-id>.ingest.grepr.ai`.
-* `<hec-token>` with your Splunk HEC token.
-
-To learn more about configuration settings for Fluent Bit, see the documentation for the [Fluent Bit Splunk output plugin](https://docs.fluentbit.io/manual/pipeline/outputs/splunk).
-
-Fluentd can send logs to Grepr using the `splunk_hec` output plugin. When you configure Fluentd, split the ingestion URL into the `hec_host`, `hec_port`, and `hec_endpoint` settings. The following is an example `match` directive from a Fluentd configuration file (`fluentd.conf`):
-
-```fluent
-<match your_tag.**> # Adjust your match pattern as needed
-  @type                     splunk_hec
-  protocol                  https
-  hec_host                  <ingestion-host>
-  hec_endpoint              services/collector/event
-  hec_port                  443
-  hec_token                 <hec-token>
-
-  <buffer> # Grepr recommends creating a buffer configuration for production deployments
-    @type memory # Or file for persistence
-    flush_interval 5s # Adjust as needed
-    chunk_limit_size 1m # Adjust as needed
-  </buffer>
-</match>
-```
-
-Replace:
-
-* `your_tag.**` with the tag of the logs you want to forward to Grepr, or use `**` to match all tags.
-* `<ingestion-host>` with the hostname from your ingestion URL. Do not include the `https://` prefix or the path value. For example, if the ingestion URL is `https://0abc1defghij2-<org-id>.ingest.grepr.ai/services/collector/event`, set the value to `0abc1defghij2-<org-id>.ingest.grepr.ai`.
-* `<hec-token>` with your Splunk HEC token.
-
-To learn more about the Splunk output plugin for Fluentd, including configuration settings, see the [fluent-plugin-splunk-hec documentation](https://github.com/splunk/fluent-plugin-splunk-hec#readme).
-
-The OpenTelemetry Collector can forward logs to Grepr using the `splunk_hec` exporter. In the OpenTelemetry collector configuration (`collector.yaml`), set the `endpoint` value to the ingestion URL:
-
-```yaml
-exporters:
-  splunk_hec:
-    token: <hec-token>
-    endpoint: <ingestion-url>
-
-service:
-  pipelines:
-    logs:
-      receivers: [otlp] # Replace with your actual receiver(s)
-      processors: [batch] # Replace/add your actual processor(s)
-      exporters: [splunk_hec]
-```
-
-Replace:
-
-* `<hec-token>` with your Splunk HEC token.
-* `<ingestion-url>` with the ingestion URL from your Splunk integration.
-
-To learn more about the OpenTelemetry Collector and configuration settings, see the [Splunk HEC Exporter documentation](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/exporter/splunkhecexporter#readme).
-
-To forward logs using the Splunk Universal Forwarder or Heavy Forwarder, add an `[httpout]` section to your Splunk Heavy Forwarder or Universal Forwarder outputs configuration (`outputs.conf`) with the following settings:
-
-* Set `httpEventCollectorToken` with an HEC token from your Splunk settings.
-* Set `uri` to the hostname of the ingestion URL from your Grepr source. Omit the path from the ingestion URL and append the port `443`. The following is an example of a properly formatted value for the `uri` setting: `https://q0yf61xl3k2b1-orgid.app.grepr.ai:443`.
-
-```ini
-[httpout]
-httpEventCollectorToken = <hec-token>
-uri = https://<ingestion-host>:443
-```
-
-To load the new configuration, restart your forwarders.
-
-### Step 4: Add a sink to your pipeline
-
-To add a sink to your pipeline that uses the Splunk integration to send processed logs to your Splunk instance:
-
-1. In the Grepr UI, go to the details page for your pipeline.
-
-2. In the left-hand navigation menu, click **Sinks**.
-
-3. In the **Add sink** dialog:
-
-   * Select the Splunk integration in the **Sink** menu.
-   * In the **Name** field, enter a name for the integration.
-   * In the **Additional tags** field, specify comma-separated tags to add to all log messages sent through this sink. You can use these tags to filter and organize logs in Splunk. For example: `processor:grepr,pipeline:my_pipeline,environment:production`.
-
-4. The **Index Configuration** section allows you to configure how logs are routed to Splunk indexes. Grepr follows a specific index routing logic to determine the destination index for each log:
-
-   * **Index override takes priority**: If an **Index override** value is provided, all logs flowing to this sink will use this index, regardless of any other index information.
-   * **Log-level index field**: If no **Index override** value is provided and an `index` field exists on the log (from an agent or transformations), that index is used.
-   * **Sink default index**: If no **Index override** value is provided, and no `index` field exists on the log, the **Default index** field specified in this sink configuration is used.
-   * **HEC token default**: If none of these conditions are met, the log is routed to the default index configured on the HEC token in your Splunk instance.
-
-5. Click **Submit**.
-
-## Ingest log data from Splunk using the Splunk HTTP source \[#splunk-http-source]
-
-You can use the Splunk HTTP source to read log data from a Splunk instance into Grepr. You can use this feature for tasks such as moving Splunk logs to another platform or testing Splunk log processing in Grepr without modifying forwarders.
-
-To configure and use a Splunk HTTP source in a pipeline:
-
-1. Create a Splunk integration that includes an authorization token for the Splunk REST API. See [Step 1: Create a Splunk integration](#create-splunk-integration).
-2. In your pipeline, add a server source that uses the Splunk integration. See [Step 2: Add a source to your pipeline](#add-splunk-source).
-
-## Limitations
-
-* The Splunk integration supports only Splunk HEC and S2S over HTTP. TCP connections, including S2S over TCP, are not supported.
-
-## Frequently Asked Questions
-
-### How do I send logs from Splunk to Grepr for processing?
-
-To send logs from Splunk to Grepr, change your collector configuration to send logs to the Grepr ingestion URL instead of your Splunk HEC endpoint. The ingestion URL format is https\://\<integration-id>-\<org-id>.ingest.grepr.ai/services/collector/event. You can configure Fluent Bit, Fluentd, OpenTelemetry Collector, or Splunk Universal/Heavy Forwarders to use this endpoint.
-
-### What is the difference between HEC and S2S for Splunk integration with Grepr?
-
-HEC (HTTP Event Collector) is Splunk's standard HTTP-based log ingestion method supported by multiple collectors like Fluent Bit, Fluentd, and OpenTelemetry Collector. S2S (Source-to-Source) is Splunk's forwarding protocol for Universal Forwarders and Heavy Forwarders. Both are supported by Grepr over HTTP, but TCP connections including S2S over TCP are not supported.
-
-### How do I configure Fluent Bit to forward logs to Grepr with a Splunk integration?
-
-In your Fluent Bit configuration file, create an OUTPUT section with Name set to 'splunk', Host set to your Grepr ingestion hostname, Port set to 443, TLS enabled, and Splunk_Token set to your Splunk HEC token. The Host value should be the hostname portion of your ingestion URL without the https\:// prefix or path.
-
-### How can I configure index routing when sending processed logs back to Splunk?
-
-When adding a Splunk sink, Grepr follows a priority order for index routing: first, any Index override value; second, the index field on the log itself; third, the Default index specified in the sink configuration; finally, the default index configured on your HEC token. You can set an Index override to route all logs to a specific index regardless of other settings.
-
-### Can I use Splunk Universal Forwarder or Heavy Forwarder to send logs to Grepr?
-
-Yes, you can use S2S over HTTP with Splunk Universal Forwarder or Heavy Forwarder. Add an httpout section to your outputs.conf with the Grepr ingestion URL, an HEC token, and port 443. TCP connections are not supported, so ensure you use HTTP/HTTPS endpoints only.
-
-### What authentication is required for the Splunk integration with Grepr?
-
-You need an HEC (HTTP Event Collector) token from Splunk for both HEC and S2S connections. Additionally, for log reduction and exception parsing features, you need a Bearer token for the Splunk REST API with search and rest_access_server_endpoints capabilities.
-
-### How do I reduce storage costs with Grepr's Splunk integration?
-
-Use the log reducer feature by configuring a Bearer token in your Splunk integration. Grepr queries your Splunk instance for alerts and dashboards, then uses those insights to identify and exclude redundant log messages from processing. This can significantly reduce the volume of logs stored and processed.
-
-### Can I send logs to both Grepr and Splunk directly from my collectors?
-
-Yes, you can dual-ship logs using multiple OUTPUT sections in Fluent Bit or multiple exporters in Fluentd and OpenTelemetry Collector. This allows you to send unprocessed logs directly to Splunk while simultaneously sending logs to Grepr for processing and transformation.

package/build/dist/docs-index/216eed38-8632-4edc-9d08-97f00e734a3a.json

@@ -1 +0,0 @@
-{"docType":"api"}

package/build/dist/docs-index/216eed38-8632-4edc-9d08-97f00e734a3a.txt

@@ -1,28 +0,0 @@
-# Record that this investigation is another occurrence of a memory you already found, instead of recording a second copy of it. Counts a recurrence against that memory and fills in anything it was missing, unless a person edited it: then it takes none of the request's text and textMerged is false. A memory a person marked wrong refuses a new link with 409; only a retried link from an investigation it already counts is accepted, taking no text. The memory must belong to the same agent.
-
-**POST** `/v1/agent-memory/{investigationId}/link/{memoryId}`
-
-**Operation ID**: `link`
-**Summary**: Record that this investigation is another occurrence of a memory you already found, instead of recording a second copy of it. Counts a recurrence against that memory and fills in anything it was missing, unless a person edited it: then it takes none of the request's text and textMerged is false. A memory a person marked wrong refuses a new link with 409; only a retried link from an investigation it already counts is accepted, taking no text. The memory must belong to the same agent.
-## Tags
-- Agent Memory
-## Parameters
-
-- **investigationId** (required) - path
-  - Type: string
-- **memoryId** (required) - path
-  - Type: string
-
-## Request Body
-
-**Content-Type**: `application/json`
-
-**Schema**: `LinkMemoryRequest`
-
-## Responses
-
-### 200
-
-The link was applied
-
-- **Content-Type**: `application/json` / `LinkMemoryResponse`

package/build/dist/docs-index/21c873f7-84ef-4846-97b0-33abf5b1efdd.json

@@ -1 +0,0 @@
-{"docType":"schema"}