@pulumi/datadog 4.51.0-alpha.1749534564 → 4.52.0-alpha.1749649703

package/types/input.d.ts

@@ -321,6 +321,26 @@ export interface CloudConfigurationRuleFilter {
      */
     query: pulumi.Input<string>;
 }
+export interface ComplianceCustomFrameworkRequirement {
+    /**
+     * The controls of the requirement. Length must be at least 1.
+     */
+    controls?: pulumi.Input<pulumi.Input<inputs.ComplianceCustomFrameworkRequirementControl>[]>;
+    /**
+     * The name of the requirement. String length must be at least 1.
+     */
+    name: pulumi.Input<string>;
+}
+export interface ComplianceCustomFrameworkRequirementControl {
+    /**
+     * The name of the control. String length must be at least 1.
+     */
+    name: pulumi.Input<string>;
+    /**
+     * The set of rules IDs for the control. Length must be at least 1.
+     */
+    rulesIds: pulumi.Input<pulumi.Input<string>[]>;
+}
 export interface DashboardListDashItem {
     /**
      * The ID of the dashboard to add
@@ -3082,11 +3102,11 @@ export interface DashboardWidgetListStreamDefinitionRequestColumn {
     /**
      * Widget column field.
      */
-    field: pulumi.Input<string>;
+    field?: pulumi.Input<string>;
     /**
      * Widget column width. Valid values are `auto`, `compact`, `full`.
      */
-    width: pulumi.Input<string>;
+    width?: pulumi.Input<string>;
 }
 export interface DashboardWidgetListStreamDefinitionRequestQuery {
     /**
@@ -8292,6 +8312,10 @@ export interface DashboardWidgetTraceServiceDefinition {
     titleSize?: pulumi.Input<string>;
 }
 export interface DashboardWidgetTreemapDefinition {
+    /**
+     * A nested block describing a custom link. Multiple `customLink` blocks are allowed using the structure below.
+     */
+    customLinks?: pulumi.Input<pulumi.Input<inputs.DashboardWidgetTreemapDefinitionCustomLink>[]>;
     /**
      * Nested block describing the request to use when displaying the widget.
      */
@@ -8301,6 +8325,24 @@ export interface DashboardWidgetTreemapDefinition {
      */
     title?: pulumi.Input<string>;
 }
+export interface DashboardWidgetTreemapDefinitionCustomLink {
+    /**
+     * The flag for toggling context menu link visibility.
+     */
+    isHidden?: pulumi.Input<boolean>;
+    /**
+     * The label for the custom link URL.
+     */
+    label?: pulumi.Input<string>;
+    /**
+     * The URL of the custom link.
+     */
+    link?: pulumi.Input<string>;
+    /**
+     * The label ID that refers to a context menu link item. When `overrideLabel` is provided, the client request omits the label field.
+     */
+    overrideLabel?: pulumi.Input<string>;
+}
 export interface DashboardWidgetTreemapDefinitionRequest {
     formulas?: pulumi.Input<pulumi.Input<inputs.DashboardWidgetTreemapDefinitionRequestFormula>[]>;
     queries?: pulumi.Input<pulumi.Input<inputs.DashboardWidgetTreemapDefinitionRequestQuery>[]>;
@@ -10346,333 +10388,1890 @@ export interface MonitorVariablesEventQuerySearch {
      */
     query: pulumi.Input<string>;
 }
-export interface ObservabilityPipelineConfig {
+export interface ObservabilityPipelineConfig {
+    /**
+     * List of destinations.
+     */
+    destinations?: pulumi.Input<inputs.ObservabilityPipelineConfigDestinations>;
+    /**
+     * List of processors.
+     */
+    processors?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessors>;
+    /**
+     * List of sources.
+     */
+    sources?: pulumi.Input<inputs.ObservabilityPipelineConfigSources>;
+}
+export interface ObservabilityPipelineConfigDestinations {
+    /**
+     * The `amazonOpensearch` destination writes logs to Amazon OpenSearch.
+     */
+    amazonOpensearches?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsAmazonOpensearch>[]>;
+    /**
+     * The `azureStorage` destination forwards logs to an Azure Blob Storage container.
+     */
+    azureStorages?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsAzureStorage>[]>;
+    /**
+     * The `datadogLogs` destination forwards logs to Datadog Log Management.
+     */
+    datadogLogs?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsDatadogLog>[]>;
+    /**
+     * The `elasticsearch` destination writes logs to an Elasticsearch cluster.
+     */
+    elasticsearches?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsElasticsearch>[]>;
+    /**
+     * The `googleChronicle` destination sends logs to Google Chronicle.
+     */
+    googleChronicles?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsGoogleChronicle>[]>;
+    /**
+     * The `googleCloudStorage` destination stores logs in a Google Cloud Storage (GCS) bucket.
+     */
+    googleCloudStorages?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsGoogleCloudStorage>[]>;
+    /**
+     * The `microsoftSentinel` destination forwards logs to Microsoft Sentinel.
+     */
+    microsoftSentinels?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsMicrosoftSentinel>[]>;
+    /**
+     * The `newRelic` destination sends logs to the New Relic platform.
+     */
+    newRelics?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsNewRelic>[]>;
+    /**
+     * The `opensearch` destination writes logs to an OpenSearch cluster.
+     */
+    opensearches?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsOpensearch>[]>;
+    /**
+     * The `rsyslog` destination forwards logs to an external `rsyslog` server over TCP or UDP using the syslog protocol.
+     */
+    rsyslogs?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsRsyslog>[]>;
+    /**
+     * The `sentinelOne` destination sends logs to SentinelOne.
+     */
+    sentinelOnes?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsSentinelOne>[]>;
+    /**
+     * The `splunkHec` destination forwards logs to Splunk using the HTTP Event Collector (HEC).
+     */
+    splunkHecs?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsSplunkHec>[]>;
+    /**
+     * The `sumoLogic` destination forwards logs to Sumo Logic.
+     */
+    sumoLogics?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsSumoLogic>[]>;
+    /**
+     * The `syslogNg` destination forwards logs to an external `syslog-ng` server over TCP or UDP using the syslog protocol.
+     */
+    syslogNgs?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsSyslogNg>[]>;
+}
+export interface ObservabilityPipelineConfigDestinationsAmazonOpensearch {
+    auth?: pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsAmazonOpensearchAuth>;
+    /**
+     * The index or datastream to write logs to.
+     */
+    bulkIndex?: pulumi.Input<string>;
+    /**
+     * The unique identifier for this component.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the input for this component.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+}
+export interface ObservabilityPipelineConfigDestinationsAmazonOpensearchAuth {
+    /**
+     * ARN of the role to assume.
+     */
+    assumeRole?: pulumi.Input<string>;
+    /**
+     * AWS region override (if applicable).
+     */
+    awsRegion?: pulumi.Input<string>;
+    /**
+     * External ID for assumed role.
+     */
+    externalId?: pulumi.Input<string>;
+    /**
+     * Session name for assumed role.
+     */
+    sessionName?: pulumi.Input<string>;
+    /**
+     * The authentication strategy to use (e.g. aws or basic).
+     */
+    strategy: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigDestinationsAzureStorage {
+    /**
+     * Optional prefix for blobs written to the container.
+     */
+    blobPrefix?: pulumi.Input<string>;
+    /**
+     * The name of the Azure Blob Storage container to store logs in.
+     */
+    containerName: pulumi.Input<string>;
+    /**
+     * The unique identifier for this component.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the `input` for this component.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+}
+export interface ObservabilityPipelineConfigDestinationsDatadogLog {
+    /**
+     * The unique ID of the destination.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * The inputs for the destination.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+}
+export interface ObservabilityPipelineConfigDestinationsElasticsearch {
+    /**
+     * The Elasticsearch API version to use. Set to `auto` to auto-detect.
+     */
+    apiVersion?: pulumi.Input<string>;
+    /**
+     * The index or datastream to write logs to in Elasticsearch.
+     */
+    bulkIndex?: pulumi.Input<string>;
+    /**
+     * The unique identifier for this component.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the `input` for this component.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+}
+export interface ObservabilityPipelineConfigDestinationsGoogleChronicle {
+    /**
+     * GCP credentials used to authenticate with Google Cloud Storage.
+     */
+    auth?: pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsGoogleChronicleAuth>;
+    /**
+     * The Google Chronicle customer ID.
+     */
+    customerId?: pulumi.Input<string>;
+    /**
+     * The encoding format for the logs sent to Chronicle.
+     */
+    encoding?: pulumi.Input<string>;
+    /**
+     * The unique identifier for this component.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the `input` for this component.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The log type metadata associated with the Chronicle destination.
+     */
+    logType?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigDestinationsGoogleChronicleAuth {
+    /**
+     * Path to the GCP service account key file.
+     */
+    credentialsFile?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigDestinationsGoogleCloudStorage {
+    /**
+     * Access control list setting for objects written to the bucket.
+     */
+    acl: pulumi.Input<string>;
+    /**
+     * GCP credentials used to authenticate with Google Cloud Storage.
+     */
+    auth?: pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsGoogleCloudStorageAuth>;
+    /**
+     * Name of the GCS bucket.
+     */
+    bucket: pulumi.Input<string>;
+    /**
+     * Unique identifier for the destination component.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the `input` for this component.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Optional prefix for object keys within the GCS bucket.
+     */
+    keyPrefix?: pulumi.Input<string>;
+    /**
+     * Custom metadata key-value pairs added to each object.
+     */
+    metadatas?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsGoogleCloudStorageMetadata>[]>;
+    /**
+     * Storage class used for objects stored in GCS.
+     */
+    storageClass: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigDestinationsGoogleCloudStorageAuth {
+    /**
+     * Path to the GCP service account key file.
+     */
+    credentialsFile: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigDestinationsGoogleCloudStorageMetadata {
+    /**
+     * The metadata key.
+     */
+    name: pulumi.Input<string>;
+    /**
+     * The metadata value.
+     */
+    value: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigDestinationsMicrosoftSentinel {
+    /**
+     * Azure AD client ID used for authentication.
+     */
+    clientId: pulumi.Input<string>;
+    /**
+     * The immutable ID of the Data Collection Rule (DCR).
+     */
+    dcrImmutableId: pulumi.Input<string>;
+    /**
+     * The unique identifier for this component.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the `input` for this component.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The name of the Log Analytics table where logs will be sent.
+     */
+    table: pulumi.Input<string>;
+    /**
+     * Azure AD tenant ID.
+     */
+    tenantId: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigDestinationsNewRelic {
+    /**
+     * The unique identifier for this component.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the `input` for this component.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The New Relic region.
+     */
+    region: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigDestinationsOpensearch {
+    /**
+     * The index or datastream to write logs to.
+     */
+    bulkIndex?: pulumi.Input<string>;
+    /**
+     * The unique identifier for this component.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as input.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+}
+export interface ObservabilityPipelineConfigDestinationsRsyslog {
+    /**
+     * The unique identifier for this component.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the `input` for this component.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Optional socket keepalive duration in milliseconds.
+     */
+    keepalive?: pulumi.Input<number>;
+    /**
+     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     */
+    tls?: pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsRsyslogTls>;
+}
+export interface ObservabilityPipelineConfigDestinationsRsyslogTls {
+    /**
+     * Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
+     */
+    caFile?: pulumi.Input<string>;
+    /**
+     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     */
+    crtFile?: pulumi.Input<string>;
+    /**
+     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     */
+    keyFile?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigDestinationsSentinelOne {
+    /**
+     * The unique identifier for this component.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the `input` for this component.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The SentinelOne region to send logs to.
+     */
+    region: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigDestinationsSplunkHec {
+    /**
+     * If `true`, Splunk tries to extract timestamps from incoming log events.
+     */
+    autoExtractTimestamp?: pulumi.Input<boolean>;
+    /**
+     * Encoding format for log events. Valid values: `json`, `rawMessage`.
+     */
+    encoding?: pulumi.Input<string>;
+    /**
+     * The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
+     */
+    id: pulumi.Input<string>;
+    /**
+     * Optional name of the Splunk index where logs are written.
+     */
+    index?: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the `input` for this component.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The Splunk sourcetype to assign to log events.
+     */
+    sourcetype?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigDestinationsSumoLogic {
+    /**
+     * The output encoding format.
+     */
+    encoding?: pulumi.Input<string>;
+    /**
+     * A list of custom headers to include in the request to Sumo Logic.
+     */
+    headerCustomFields?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsSumoLogicHeaderCustomField>[]>;
+    /**
+     * Optional override for the host name header.
+     */
+    headerHostName?: pulumi.Input<string>;
+    /**
+     * Optional override for the source category header.
+     */
+    headerSourceCategory?: pulumi.Input<string>;
+    /**
+     * Optional override for the source name header.
+     */
+    headerSourceName?: pulumi.Input<string>;
+    /**
+     * The unique identifier for this component.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the `input` for this component.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+}
+export interface ObservabilityPipelineConfigDestinationsSumoLogicHeaderCustomField {
+    /**
+     * The header field name.
+     */
+    name?: pulumi.Input<string>;
+    /**
+     * The header field value.
+     */
+    value?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigDestinationsSyslogNg {
+    /**
+     * The unique identifier for this component.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the `input` for this component.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Optional socket keepalive duration in milliseconds.
+     */
+    keepalive?: pulumi.Input<number>;
+    /**
+     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     */
+    tls?: pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsSyslogNgTls>;
+}
+export interface ObservabilityPipelineConfigDestinationsSyslogNgTls {
+    /**
+     * Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
+     */
+    caFile?: pulumi.Input<string>;
+    /**
+     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     */
+    crtFile?: pulumi.Input<string>;
+    /**
+     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     */
+    keyFile?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigProcessors {
+    /**
+     * The `addEnvVars` processor adds environment variable values to log events.
+     */
+    addEnvVars?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsAddEnvVar>[]>;
+    /**
+     * The `addFields` processor adds static key-value fields to logs.
+     */
+    addFields?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsAddField>[]>;
+    /**
+     * The `dedupe` processor removes duplicate fields in log events.
+     */
+    dedupes?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsDedupe>[]>;
+    /**
+     * The `enrichmentTable` processor enriches logs using a static CSV file or GeoIP database.
+     */
+    enrichmentTables?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsEnrichmentTable>[]>;
+    /**
+     * The `filter` processor allows conditional processing of logs based on a Datadog search query. Logs that match the `include` query are passed through; others are discarded.
+     */
+    filters?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsFilter>[]>;
+    /**
+     * The `generateDatadogMetrics` processor creates custom metrics from logs. Metrics can be counters, gauges, or distributions and optionally grouped by log fields.
+     */
+    generateDatadogMetrics?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsGenerateDatadogMetric>[]>;
+    /**
+     * The `ocsfMapper` processor transforms logs into the OCSF schema using predefined library mappings.
+     */
+    ocsfMappers?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsOcsfMapper>[]>;
+    /**
+     * The `parseGrok` processor extracts structured fields from unstructured log messages using Grok patterns.
+     */
+    parseGroks?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsParseGrok>[]>;
+    /**
+     * The `parseJson` processor extracts JSON from a specified field and flattens it into the event. This is useful when logs contain embedded JSON as a string.
+     */
+    parseJsons?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsParseJson>[]>;
+    /**
+     * The `quota` measures logging traffic for logs that match a specified filter. When the configured daily quota is met, the processor can drop or alert.
+     */
+    quotas?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsQuota>[]>;
+    /**
+     * The `reduce` processor aggregates and merges logs based on matching keys and merge strategies.
+     */
+    reduces?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsReduce>[]>;
+    /**
+     * The `removeFields` processor deletes specified fields from logs.
+     */
+    removeFields?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsRemoveField>[]>;
+    /**
+     * The `renameFields` processor changes field names.
+     */
+    renameFields?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsRenameField>[]>;
+    /**
+     * The `sample` processor allows probabilistic sampling of logs at a fixed rate.
+     */
+    samples?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsSample>[]>;
+    /**
+     * The `sensitiveDataScanner` processor detects and optionally redacts sensitive data in log events.
+     */
+    sensitiveDataScanners?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsSensitiveDataScanner>[]>;
+    /**
+     * The `throttle` processor limits the number of events that pass through over a given time window.
+     */
+    throttles?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsThrottle>[]>;
+}
+export interface ObservabilityPipelineConfigProcessorsAddEnvVar {
+    /**
+     * The unique identifier for this component. Used to reference this processor in the pipeline.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A Datadog search query used to determine which logs this processor targets.
+     */
+    include: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the input for this processor.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * A list of environment variable mappings to apply to log fields.
+     */
+    variables?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsAddEnvVarVariable>[]>;
+}
+export interface ObservabilityPipelineConfigProcessorsAddEnvVarVariable {
+    /**
+     * The target field in the log event.
+     */
+    field: pulumi.Input<string>;
+    /**
+     * The name of the environment variable to read.
+     */
+    name: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigProcessorsAddField {
+    /**
+     * A list of static fields (key-value pairs) that is added to each log event processed by this component.
+     */
+    fields?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsAddFieldField>[]>;
+    /**
+     * The unique ID of the processor.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A Datadog search query used to determine which logs this processor targets.
+     */
+    include: pulumi.Input<string>;
+    /**
+     * The inputs for the processor.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+}
+export interface ObservabilityPipelineConfigProcessorsAddFieldField {
+    /**
+     * The field name to add.
+     */
+    name: pulumi.Input<string>;
+    /**
+     * The value to assign to the field.
+     */
+    value: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigProcessorsDedupe {
+    /**
+     * A list of log field paths to check for duplicates.
+     */
+    fields: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The unique identifier for this processor.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A Datadog search query used to determine which logs this processor targets.
+     */
+    include: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the input for this processor.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The deduplication mode to apply to the fields.
+     */
+    mode: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigProcessorsEnrichmentTable {
+    /**
+     * Defines a static enrichment table loaded from a CSV file.
+     */
+    file?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsEnrichmentTableFile>;
+    /**
+     * Uses a GeoIP database to enrich logs based on an IP field.
+     */
+    geoip?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsEnrichmentTableGeoip>;
+    /**
+     * The unique identifier for this processor.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A Datadog search query used to determine which logs this processor targets.
+     */
+    include: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the input for this processor.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Path where enrichment results should be stored in the log.
+     */
+    target: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigProcessorsEnrichmentTableFile {
+    encoding?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsEnrichmentTableFileEncoding>;
+    /**
+     * Key fields used to look up enrichment values.
+     */
+    keys?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsEnrichmentTableFileKey>[]>;
+    /**
+     * Path to the CSV file.
+     */
+    path?: pulumi.Input<string>;
+    /**
+     * Schema defining column names and their types.
+     */
+    schemas?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsEnrichmentTableFileSchema>[]>;
+}
+export interface ObservabilityPipelineConfigProcessorsEnrichmentTableFileEncoding {
+    /**
+     * The `encoding` `delimiter`.
+     */
+    delimiter?: pulumi.Input<string>;
+    /**
+     * The `encoding` `includesHeaders`.
+     */
+    includesHeaders?: pulumi.Input<boolean>;
+    /**
+     * File encoding format.
+     */
+    type?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigProcessorsEnrichmentTableFileKey {
+    /**
+     * The `items` `column`.
+     */
+    column?: pulumi.Input<string>;
+    /**
+     * The comparison method (e.g. equals).
+     */
+    comparison?: pulumi.Input<string>;
+    /**
+     * The `items` `field`.
+     */
+    field?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigProcessorsEnrichmentTableFileSchema {
+    /**
+     * The `items` `column`.
+     */
+    column?: pulumi.Input<string>;
+    /**
+     * The type of the column (e.g. string, boolean, integer, etc.).
+     */
+    type?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigProcessorsEnrichmentTableGeoip {
+    /**
+     * Path to the IP field in the log.
+     */
+    keyField?: pulumi.Input<string>;
+    /**
+     * Locale used to resolve geographical names.
+     */
+    locale?: pulumi.Input<string>;
+    /**
+     * Path to the GeoIP database file.
+     */
+    path?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigProcessorsFilter {
+    /**
+     * The unique ID of the processor.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A Datadog search query used to determine which logs should pass through the filter. Logs that match this query continue to downstream components; others are dropped.
+     */
+    include: pulumi.Input<string>;
+    /**
+     * The inputs for the processor.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+}
+export interface ObservabilityPipelineConfigProcessorsGenerateDatadogMetric {
+    /**
+     * The unique identifier for this component. Used to reference this component in other parts of the pipeline.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A Datadog search query used to determine which logs this processor targets.
+     */
+    include: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the `input` for this processor.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Configuration for generating individual metrics.
+     */
+    metrics?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsGenerateDatadogMetricMetric>[]>;
+}
+export interface ObservabilityPipelineConfigProcessorsGenerateDatadogMetricMetric {
+    /**
+     * Optional fields used to group the metric series.
+     */
+    groupBies?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Datadog filter query to match logs for metric generation.
+     */
+    include: pulumi.Input<string>;
+    /**
+     * Type of metric to create.
+     */
+    metricType: pulumi.Input<string>;
+    /**
+     * Name of the custom metric to be created.
+     */
+    name: pulumi.Input<string>;
+    /**
+     * Specifies how the value of the generated metric is computed.
+     */
+    value?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsGenerateDatadogMetricMetricValue>;
+}
+export interface ObservabilityPipelineConfigProcessorsGenerateDatadogMetricMetricValue {
+    /**
+     * Name of the log field containing the numeric value to increment the metric by (used only for `incrementByField`).
+     */
+    field?: pulumi.Input<string>;
+    /**
+     * Metric value strategy: `incrementByOne` or `incrementByField`.
+     */
+    strategy: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigProcessorsOcsfMapper {
+    /**
+     * The unique identifier for this component.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * Search query to select logs.
+     */
+    include: pulumi.Input<string>;
+    /**
+     * List of component IDs whose output is used as input.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * List of OCSF mapping entries using library mapping.
+     */
+    mappings?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsOcsfMapperMapping>[]>;
+}
+export interface ObservabilityPipelineConfigProcessorsOcsfMapperMapping {
+    /**
+     * Search query for selecting which logs the mapping applies to.
+     */
+    include: pulumi.Input<string>;
+    /**
+     * Predefined library mapping for log transformation.
+     */
+    libraryMapping: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigProcessorsParseGrok {
+    /**
+     * If set to `true`, disables the default Grok rules provided by Datadog.
+     */
+    disableLibraryRules?: pulumi.Input<boolean>;
+    /**
+     * A unique identifier for this processor.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A Datadog search query used to determine which logs this processor targets.
+     */
+    include: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the `input` for this component.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The list of Grok parsing rules. If multiple parsing rules are provided, they are evaluated in order. The first successful match is applied.
+     */
+    rules?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsParseGrokRule>[]>;
+}
+export interface ObservabilityPipelineConfigProcessorsParseGrokRule {
+    /**
+     * A list of Grok parsing rules that define how to extract fields from the source field. Each rule must contain a name and a valid Grok pattern.
+     */
+    matchRules?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsParseGrokRuleMatchRule>[]>;
+    /**
+     * The name of the field in the log event to apply the Grok rules to.
+     */
+    source: pulumi.Input<string>;
+    /**
+     * A list of helper Grok rules that can be referenced by the parsing rules.
+     */
+    supportRules?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsParseGrokRuleSupportRule>[]>;
+}
+export interface ObservabilityPipelineConfigProcessorsParseGrokRuleMatchRule {
+    /**
+     * The name of the rule.
+     */
+    name: pulumi.Input<string>;
+    /**
+     * The definition of the Grok rule.
+     */
+    rule: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigProcessorsParseGrokRuleSupportRule {
+    /**
+     * The name of the helper Grok rule.
+     */
+    name: pulumi.Input<string>;
+    /**
+     * The definition of the helper Grok rule.
+     */
+    rule: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigProcessorsParseJson {
+    /**
+     * The field to parse.
+     */
+    field: pulumi.Input<string>;
+    /**
+     * The unique ID of the processor.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A Datadog search query used to determine which logs this processor targets.
+     */
+    include: pulumi.Input<string>;
+    /**
+     * The inputs for the processor.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+}
+export interface ObservabilityPipelineConfigProcessorsQuota {
+    /**
+     * Whether to drop events exceeding the limit.
+     */
+    dropEvents: pulumi.Input<boolean>;
+    /**
+     * The unique ID of the processor.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * Whether to ignore when partition fields are missing.
+     */
+    ignoreWhenMissingPartitions?: pulumi.Input<boolean>;
+    /**
+     * A Datadog search query used to determine which logs this processor targets.
+     */
+    include: pulumi.Input<string>;
+    /**
+     * The inputs for the processor.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    limit?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsQuotaLimit>;
+    /**
+     * The name of the quota.
+     */
+    name: pulumi.Input<string>;
+    /**
+     * The action to take when the quota is exceeded: `drop`, `noAction`, or `overflowRouting`.
+     */
+    overflowAction?: pulumi.Input<string>;
+    /**
+     * The overrides for field-specific quotas.
+     */
+    overrides?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsQuotaOverride>[]>;
+    /**
+     * List of partition fields.
+     */
+    partitionFields?: pulumi.Input<pulumi.Input<string>[]>;
+}
+export interface ObservabilityPipelineConfigProcessorsQuotaLimit {
+    /**
+     * Whether to enforce by 'bytes' or 'events'. Valid values are `bytes`, `events`.
+     */
+    enforce: pulumi.Input<string>;
+    /**
+     * The daily quota limit.
+     */
+    limit: pulumi.Input<number>;
+}
+export interface ObservabilityPipelineConfigProcessorsQuotaOverride {
+    /**
+     * Fields that trigger this override.
+     */
+    fields?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsQuotaOverrideField>[]>;
+    limit?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsQuotaOverrideLimit>;
+}
+export interface ObservabilityPipelineConfigProcessorsQuotaOverrideField {
+    /**
+     * The field name.
+     */
+    name: pulumi.Input<string>;
+    /**
+     * The field value.
+     */
+    value: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigProcessorsQuotaOverrideLimit {
+    /**
+     * Whether to enforce by 'bytes' or 'events'. Valid values are `bytes`, `events`.
+     */
+    enforce: pulumi.Input<string>;
+    /**
+     * The daily quota limit.
+     */
+    limit: pulumi.Input<number>;
+}
+export interface ObservabilityPipelineConfigProcessorsReduce {
+    /**
+     * A list of fields used to group log events for merging.
+     */
+    groupBies: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The unique identifier for this processor.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A Datadog search query used to determine which logs this processor targets.
+     */
+    include: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the input for this processor.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * List of merge strategies defining how values from grouped events should be combined.
+     */
+    mergeStrategies?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsReduceMergeStrategy>[]>;
+}
+export interface ObservabilityPipelineConfigProcessorsReduceMergeStrategy {
+    /**
+     * The field path in the log event.
+     */
+    path: pulumi.Input<string>;
+    /**
+     * The merge strategy to apply.
+     */
+    strategy: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigProcessorsRemoveField {
+    /**
+     * List of fields to remove from the events.
+     */
+    fields: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The unique ID of the processor.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A Datadog search query used to determine which logs this processor targets.
+     */
+    include: pulumi.Input<string>;
+    /**
+     * The inputs for the processor.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+}
+export interface ObservabilityPipelineConfigProcessorsRenameField {
+    /**
+     * List of fields to rename.
+     */
+    fields?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsRenameFieldField>[]>;
+    /**
+     * The unique ID of the processor.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A Datadog search query used to determine which logs this processor targets.
+     */
+    include: pulumi.Input<string>;
+    /**
+     * The inputs for the processor.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+}
+export interface ObservabilityPipelineConfigProcessorsRenameFieldField {
+    /**
+     * Destination field name.
+     */
+    destination: pulumi.Input<string>;
+    /**
+     * Whether to keep the original field.
+     */
+    preserveSource: pulumi.Input<boolean>;
+    /**
+     * Source field to rename.
+     */
+    source: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigProcessorsSample {
+    /**
+     * The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A Datadog search query used to determine which logs this processor targets.
+     */
+    include: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the `input` for this component.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The percentage of logs to sample.
+     */
+    percentage?: pulumi.Input<number>;
+    /**
+     * Number of events to sample (1 in N).
+     */
+    rate?: pulumi.Input<number>;
+}
+export interface ObservabilityPipelineConfigProcessorsSensitiveDataScanner {
+    /**
+     * The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A Datadog search query used to determine which logs this processor targets.
+     */
+    include: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the `input` for this component.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * A list of rules for identifying and acting on sensitive data patterns.
+     */
+    rules?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsSensitiveDataScannerRule>[]>;
+}
+export interface ObservabilityPipelineConfigProcessorsSensitiveDataScannerRule {
+    /**
+     * Keyword-based proximity matching for sensitive data.
+     */
+    keywordOptions?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsSensitiveDataScannerRuleKeywordOptions>;
+    /**
+     * A name identifying the rule.
+     */
+    name?: pulumi.Input<string>;
+    /**
+     * The action to take when a sensitive value is found.
+     */
+    onMatch?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsSensitiveDataScannerRuleOnMatch>;
+    /**
+     * Pattern detection configuration for identifying sensitive data using either a custom regex or a library reference.
+     */
+    pattern?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsSensitiveDataScannerRulePattern>;
+    /**
+     * Field-level targeting options that determine where the scanner should operate.
+     */
+    scope?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsSensitiveDataScannerRuleScope>;
+    /**
+     * Tags assigned to this rule for filtering and classification.
+     */
+    tags?: pulumi.Input<pulumi.Input<string>[]>;
+}
+export interface ObservabilityPipelineConfigProcessorsSensitiveDataScannerRuleKeywordOptions {
+    /**
+     * A list of keywords to match near the sensitive pattern.
+     */
+    keywords?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Maximum number of tokens between a keyword and a sensitive value match.
+     */
+    proximity?: pulumi.Input<number>;
+}
+export interface ObservabilityPipelineConfigProcessorsSensitiveDataScannerRuleOnMatch {
+    /**
+     * Hashes the matched value.
+     */
+    hash?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsSensitiveDataScannerRuleOnMatchHash>;
+    /**
+     * Redacts part of the matched value (e.g., keep last 4 characters).
+     */
+    partialRedact?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsSensitiveDataScannerRuleOnMatchPartialRedact>;
+    /**
+     * Redacts the matched value.
+     */
+    redact?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsSensitiveDataScannerRuleOnMatchRedact>;
+}
+export interface ObservabilityPipelineConfigProcessorsSensitiveDataScannerRuleOnMatchHash {
+}
+export interface ObservabilityPipelineConfigProcessorsSensitiveDataScannerRuleOnMatchPartialRedact {
+    /**
+     * Number of characters to keep.
+     */
+    characters?: pulumi.Input<number>;
+    /**
+     * Direction from which to keep characters: `first` or `last`.
+     */
+    direction?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigProcessorsSensitiveDataScannerRuleOnMatchRedact {
+    /**
+     * Replacement string for redacted values (e.g., `***`).
+     */
+    replace?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigProcessorsSensitiveDataScannerRulePattern {
+    /**
+     * Pattern detection using a custom regular expression.
+     */
+    custom?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsSensitiveDataScannerRulePatternCustom>;
+    /**
+     * Pattern detection using a predefined pattern from the sensitive data scanner pattern library.
+     */
+    library?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsSensitiveDataScannerRulePatternLibrary>;
+}
+export interface ObservabilityPipelineConfigProcessorsSensitiveDataScannerRulePatternCustom {
+    /**
+     * A regular expression used to detect sensitive values. Must be a valid regex.
+     */
+    rule?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigProcessorsSensitiveDataScannerRulePatternLibrary {
+    /**
+     * Identifier for a predefined pattern from the sensitive data scanner pattern library.
+     */
+    id?: pulumi.Input<string>;
+    /**
+     * Whether to augment the pattern with recommended keywords (optional).
+     */
+    useRecommendedKeywords?: pulumi.Input<boolean>;
+}
+export interface ObservabilityPipelineConfigProcessorsSensitiveDataScannerRuleScope {
+    /**
+     * Scan all fields.
+     */
+    all?: pulumi.Input<boolean>;
+    /**
+     * Explicitly exclude these fields from scanning.
+     */
+    exclude?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsSensitiveDataScannerRuleScopeExclude>;
+    /**
+     * Explicitly include these fields for scanning.
+     */
+    include?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsSensitiveDataScannerRuleScopeInclude>;
+}
+export interface ObservabilityPipelineConfigProcessorsSensitiveDataScannerRuleScopeExclude {
+    /**
+     * The fields to exclude from scanning.
+     */
+    fields?: pulumi.Input<pulumi.Input<string>[]>;
+}
+export interface ObservabilityPipelineConfigProcessorsSensitiveDataScannerRuleScopeInclude {
+    /**
+     * The fields to include in scanning.
+     */
+    fields?: pulumi.Input<pulumi.Input<string>[]>;
+}
+export interface ObservabilityPipelineConfigProcessorsThrottle {
+    /**
+     * Optional list of fields used to group events before applying throttling.
+     */
+    groupBies?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The unique identifier for this processor.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * A Datadog search query used to determine which logs this processor targets.
+     */
+    include: pulumi.Input<string>;
+    /**
+     * A list of component IDs whose output is used as the input for this processor.
+     */
+    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The number of events to allow before throttling is applied.
+     */
+    threshold: pulumi.Input<number>;
+    /**
+     * The time window in seconds over which the threshold applies.
+     */
+    window: pulumi.Input<number>;
+}
+export interface ObservabilityPipelineConfigSources {
+    /**
+     * The `amazonDataFirehose` source ingests logs from AWS Data Firehose.
+     */
+    amazonDataFirehoses?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigSourcesAmazonDataFirehose>[]>;
+    /**
+     * The `amazonS3` source ingests logs from an Amazon S3 bucket. It supports AWS authentication and TLS encryption.
+     */
+    amazonS3s?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigSourcesAmazonS3>[]>;
+    /**
+     * The `datadogAgent` source collects logs from the Datadog Agent.
+     */
+    datadogAgents?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigSourcesDatadogAgent>[]>;
+    /**
+     * The `fluent` source ingests logs from Fluent Bit.
+     */
+    fluentBits?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigSourcesFluentBit>[]>;
+    /**
+     * The `fluent` source ingests logs from a Fluentd-compatible service.
+     */
+    fluentds?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigSourcesFluentd>[]>;
+    /**
+     * The `googlePubsub` source ingests logs from a Google Cloud Pub/Sub subscription.
+     */
+    googlePubsubs?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigSourcesGooglePubsub>[]>;
+    /**
+     * The `httpClient` source scrapes logs from HTTP endpoints at regular intervals.
+     */
+    httpClients?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigSourcesHttpClient>[]>;
+    /**
+     * The `httpServer` source collects logs over HTTP POST from external services.
+     */
+    httpServers?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigSourcesHttpServer>[]>;
+    /**
+     * The `kafka` source ingests data from Apache Kafka topics.
+     */
+    kafkas?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigSourcesKafka>[]>;
+    /**
+     * The `logstash` source ingests logs from a Logstash forwarder.
+     */
+    logstashes?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigSourcesLogstash>[]>;
+    /**
+     * The `rsyslog` source listens for logs over TCP or UDP from an `rsyslog` server using the syslog protocol.
+     */
+    rsyslogs?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigSourcesRsyslog>[]>;
+    /**
+     * The `splunkHec` source implements the Splunk HTTP Event Collector (HEC) API.
+     */
+    splunkHecs?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigSourcesSplunkHec>[]>;
+    /**
+     * The `splunkTcp` source receives logs from a Splunk Universal Forwarder over TCP. TLS is supported for secure transmission.
+     */
+    splunkTcps?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigSourcesSplunkTcp>[]>;
+    /**
+     * The `sumoLogic` source receives logs from Sumo Logic collectors.
+     */
+    sumoLogics?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigSourcesSumoLogic>[]>;
+    /**
+     * The `syslogNg` source listens for logs over TCP or UDP from a `syslog-ng` server using the syslog protocol.
+     */
+    syslogNgs?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigSourcesSyslogNg>[]>;
+}
+export interface ObservabilityPipelineConfigSourcesAmazonDataFirehose {
+    /**
+     * AWS authentication credentials used for accessing AWS services such as S3. If omitted, the system’s default credentials are used (for example, the IAM role and environment variables).
+     */
+    auth?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesAmazonDataFirehoseAuth>;
+    /**
+     * The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
+     */
+    id: pulumi.Input<string>;
+    /**
+     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     */
+    tls?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesAmazonDataFirehoseTls>;
+}
+export interface ObservabilityPipelineConfigSourcesAmazonDataFirehoseAuth {
+    /**
+     * The Amazon Resource Name (ARN) of the role to assume.
+     */
+    assumeRole?: pulumi.Input<string>;
+    /**
+     * A unique identifier for cross-account role assumption.
+     */
+    externalId?: pulumi.Input<string>;
+    /**
+     * A session identifier used for logging and tracing the assumed role session.
+     */
+    sessionName?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigSourcesAmazonDataFirehoseTls {
+    /**
+     * Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
+     */
+    caFile?: pulumi.Input<string>;
+    /**
+     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     */
+    crtFile?: pulumi.Input<string>;
+    /**
+     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     */
+    keyFile?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigSourcesAmazonS3 {
+    /**
+     * AWS authentication credentials used for accessing AWS services such as S3. If omitted, the system’s default credentials are used (for example, the IAM role and environment variables).
+     */
+    auth?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesAmazonS3Auth>;
+    /**
+     * The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
+     */
+    id: pulumi.Input<string>;
+    /**
+     * AWS region where the S3 bucket resides.
+     */
+    region: pulumi.Input<string>;
+    /**
+     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     */
+    tls?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesAmazonS3Tls>;
+}
+export interface ObservabilityPipelineConfigSourcesAmazonS3Auth {
+    /**
+     * The Amazon Resource Name (ARN) of the role to assume.
+     */
+    assumeRole?: pulumi.Input<string>;
+    /**
+     * A unique identifier for cross-account role assumption.
+     */
+    externalId?: pulumi.Input<string>;
+    /**
+     * A session identifier used for logging and tracing the assumed role session.
+     */
+    sessionName?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigSourcesAmazonS3Tls {
+    /**
+     * Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
+     */
+    caFile?: pulumi.Input<string>;
+    /**
+     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     */
+    crtFile?: pulumi.Input<string>;
+    /**
+     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     */
+    keyFile?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigSourcesDatadogAgent {
+    /**
+     * The unique ID of the source.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     */
+    tls?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesDatadogAgentTls>;
+}
+export interface ObservabilityPipelineConfigSourcesDatadogAgentTls {
+    /**
+     * Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
+     */
+    caFile?: pulumi.Input<string>;
+    /**
+     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     */
+    crtFile?: pulumi.Input<string>;
+    /**
+     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     */
+    keyFile?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigSourcesFluentBit {
+    /**
+     * The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
+     */
+    id: pulumi.Input<string>;
+    /**
+     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     */
+    tls?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesFluentBitTls>;
+}
+export interface ObservabilityPipelineConfigSourcesFluentBitTls {
+    /**
+     * Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
+     */
+    caFile?: pulumi.Input<string>;
+    /**
+     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     */
+    crtFile?: pulumi.Input<string>;
+    /**
+     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     */
+    keyFile?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigSourcesFluentd {
+    /**
+     * The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
+     */
+    id: pulumi.Input<string>;
+    /**
+     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     */
+    tls?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesFluentdTls>;
+}
+export interface ObservabilityPipelineConfigSourcesFluentdTls {
+    /**
+     * Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
+     */
+    caFile?: pulumi.Input<string>;
+    /**
+     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     */
+    crtFile?: pulumi.Input<string>;
+    /**
+     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     */
+    keyFile?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigSourcesGooglePubsub {
+    /**
+     * GCP credentials used to authenticate with Google Cloud Storage.
+     */
+    auth?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesGooglePubsubAuth>;
+    /**
+     * The decoding format used to interpret incoming logs.
+     */
+    decoding: pulumi.Input<string>;
+    /**
+     * The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
+     */
+    id: pulumi.Input<string>;
+    /**
+     * The GCP project ID that owns the Pub/Sub subscription.
+     */
+    project: pulumi.Input<string>;
+    /**
+     * The Pub/Sub subscription name from which messages are consumed.
+     */
+    subscription: pulumi.Input<string>;
+    /**
+     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     */
+    tls?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesGooglePubsubTls>;
+}
+export interface ObservabilityPipelineConfigSourcesGooglePubsubAuth {
+    /**
+     * Path to the GCP service account key file.
+     */
+    credentialsFile: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigSourcesGooglePubsubTls {
+    /**
+     * Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
+     */
+    caFile?: pulumi.Input<string>;
+    /**
+     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     */
+    crtFile?: pulumi.Input<string>;
+    /**
+     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     */
+    keyFile?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigSourcesHttpClient {
+    /**
+     * Optional authentication strategy for HTTP requests.
+     */
+    authStrategy?: pulumi.Input<string>;
+    /**
+     * The decoding format used to interpret incoming logs.
+     */
+    decoding: pulumi.Input<string>;
+    /**
+     * The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
+     */
+    id: pulumi.Input<string>;
+    /**
+     * The interval (in seconds) between HTTP scrape requests.
+     */
+    scrapeIntervalSecs?: pulumi.Input<number>;
+    /**
+     * The timeout (in seconds) for each scrape request.
+     */
+    scrapeTimeoutSecs?: pulumi.Input<number>;
+    /**
+     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     */
+    tls?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesHttpClientTls>;
+}
+export interface ObservabilityPipelineConfigSourcesHttpClientTls {
+    /**
+     * Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
+     */
+    caFile?: pulumi.Input<string>;
+    /**
+     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     */
+    crtFile?: pulumi.Input<string>;
+    /**
+     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     */
+    keyFile?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigSourcesHttpServer {
+    /**
+     * HTTP authentication method. Valid values are `none`, `plain`.
+     */
+    authStrategy: pulumi.Input<string>;
+    /**
+     * The decoding format used to interpret incoming logs. Valid values are `json`, `gelf`, `syslog`, `bytes`.
+     */
+    decoding: pulumi.Input<string>;
+    /**
+     * Unique ID for the HTTP server source.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     */
+    tls?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesHttpServerTls>;
+}
+export interface ObservabilityPipelineConfigSourcesHttpServerTls {
+    /**
+     * Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
+     */
+    caFile?: pulumi.Input<string>;
+    /**
+     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     */
+    crtFile?: pulumi.Input<string>;
+    /**
+     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     */
+    keyFile?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigSourcesKafka {
+    /**
+     * The Kafka consumer group ID.
+     */
+    groupId: pulumi.Input<string>;
+    /**
+     * The unique ID of the source.
+     */
+    id: pulumi.Input<string>;
+    /**
+     * Advanced librdkafka client configuration options.
+     */
+    librdkafkaOptions?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigSourcesKafkaLibrdkafkaOption>[]>;
+    /**
+     * SASL authentication settings.
+     */
+    sasl?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesKafkaSasl>;
+    /**
+     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     */
+    tls?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesKafkaTls>;
+    /**
+     * A list of Kafka topic names to subscribe to. The source ingests messages from each topic specified.
+     */
+    topics: pulumi.Input<pulumi.Input<string>[]>;
+}
+export interface ObservabilityPipelineConfigSourcesKafkaLibrdkafkaOption {
+    /**
+     * The name of the librdkafka option.
+     */
+    name: pulumi.Input<string>;
+    /**
+     * The value of the librdkafka option.
+     */
+    value: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigSourcesKafkaSasl {
     /**
-     * List of destinations.
+     * SASL mechanism to use (e.g., PLAIN, SCRAM-SHA-256, SCRAM-SHA-512). Valid values are `PLAIN`, `SCRAM-SHA-256`, `SCRAM-SHA-512`.
      */
-    destinations?: pulumi.Input<inputs.ObservabilityPipelineConfigDestinations>;
+    mechanism?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigSourcesKafkaTls {
     /**
-     * List of processors.
+     * Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
      */
-    processors?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessors>;
+    caFile?: pulumi.Input<string>;
     /**
-     * List of sources.
+     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
      */
-    sources?: pulumi.Input<inputs.ObservabilityPipelineConfigSources>;
-}
-export interface ObservabilityPipelineConfigDestinations {
+    crtFile?: pulumi.Input<string>;
     /**
-     * The `datadogLogs` destination forwards logs to Datadog Log Management.
+     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
      */
-    datadogLogs?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigDestinationsDatadogLog>[]>;
+    keyFile?: pulumi.Input<string>;
 }
-export interface ObservabilityPipelineConfigDestinationsDatadogLog {
+export interface ObservabilityPipelineConfigSourcesLogstash {
     /**
-     * The unique ID of the destination.
+     * The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
      */
     id: pulumi.Input<string>;
     /**
-     * The inputs for the destination.
+     * Configuration for enabling TLS encryption between the pipeline component and external services.
      */
-    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    tls?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesLogstashTls>;
 }
-export interface ObservabilityPipelineConfigProcessors {
+export interface ObservabilityPipelineConfigSourcesLogstashTls {
     /**
-     * The `addFields` processor adds static key-value fields to logs.
+     * Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
      */
-    addFields?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsAddField>[]>;
+    caFile?: pulumi.Input<string>;
     /**
-     * The `filter` processor allows conditional processing of logs based on a Datadog search query. Logs that match the `include` query are passed through; others are discarded.
+     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
      */
-    filters?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsFilter>[]>;
+    crtFile?: pulumi.Input<string>;
     /**
-     * The `parseJson` processor extracts JSON from a specified field and flattens it into the event. This is useful when logs contain embedded JSON as a string.
+     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
      */
-    parseJsons?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsParseJson>[]>;
+    keyFile?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigSourcesRsyslog {
     /**
-     * The `quota` measures logging traffic for logs that match a specified filter. When the configured daily quota is met, the processor can drop or alert.
+     * The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
      */
-    quotas?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsQuota>[]>;
+    id: pulumi.Input<string>;
     /**
-     * The `removeFields` processor deletes specified fields from logs.
+     * Protocol used by the syslog source to receive messages.
      */
-    removeFields?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsRemoveField>[]>;
+    mode?: pulumi.Input<string>;
     /**
-     * The `renameFields` processor changes field names.
+     * Configuration for enabling TLS encryption between the pipeline component and external services.
      */
-    renameFields?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsRenameField>[]>;
+    tls?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesRsyslogTls>;
 }
-export interface ObservabilityPipelineConfigProcessorsAddField {
+export interface ObservabilityPipelineConfigSourcesRsyslogTls {
     /**
-     * A list of static fields (key-value pairs) that is added to each log event processed by this component.
-     */
-    fields?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsAddFieldField>[]>;
-    /**
-     * The unique ID of the processor.
+     * Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
      */
-    id: pulumi.Input<string>;
+    caFile?: pulumi.Input<string>;
     /**
-     * A Datadog search query used to determine which logs this processor targets.
+     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
      */
-    include: pulumi.Input<string>;
+    crtFile?: pulumi.Input<string>;
     /**
-     * The inputs for the processor.
+     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
      */
-    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    keyFile?: pulumi.Input<string>;
 }
-export interface ObservabilityPipelineConfigProcessorsAddFieldField {
+export interface ObservabilityPipelineConfigSourcesSplunkHec {
     /**
-     * The field name to add.
+     * The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
      */
-    name: pulumi.Input<string>;
+    id: pulumi.Input<string>;
     /**
-     * The value to assign to the field.
+     * Configuration for enabling TLS encryption between the pipeline component and external services.
      */
-    value: pulumi.Input<string>;
+    tls?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesSplunkHecTls>;
 }
-export interface ObservabilityPipelineConfigProcessorsFilter {
+export interface ObservabilityPipelineConfigSourcesSplunkHecTls {
     /**
-     * The unique ID of the processor.
+     * Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
      */
-    id: pulumi.Input<string>;
+    caFile?: pulumi.Input<string>;
     /**
-     * A Datadog search query used to determine which logs should pass through the filter. Logs that match this query continue to downstream components; others are dropped.
+     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
      */
-    include: pulumi.Input<string>;
+    crtFile?: pulumi.Input<string>;
     /**
-     * The inputs for the processor.
+     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
      */
-    inputs: pulumi.Input<pulumi.Input<string>[]>;
+    keyFile?: pulumi.Input<string>;
 }
-export interface ObservabilityPipelineConfigProcessorsParseJson {
+export interface ObservabilityPipelineConfigSourcesSplunkTcp {
     /**
-     * The field to parse.
+     * The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
      */
-    field: pulumi.Input<string>;
+    id: pulumi.Input<string>;
     /**
-     * The unique ID of the processor.
+     * Configuration for enabling TLS encryption between the pipeline component and external services.
      */
-    id: pulumi.Input<string>;
+    tls?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesSplunkTcpTls>;
+}
+export interface ObservabilityPipelineConfigSourcesSplunkTcpTls {
     /**
-     * A Datadog search query used to determine which logs this processor targets.
+     * Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
      */
-    include: pulumi.Input<string>;
+    caFile?: pulumi.Input<string>;
     /**
-     * The inputs for the processor.
+     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
      */
-    inputs: pulumi.Input<pulumi.Input<string>[]>;
-}
-export interface ObservabilityPipelineConfigProcessorsQuota {
+    crtFile?: pulumi.Input<string>;
     /**
-     * Whether to drop events exceeding the limit.
+     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
      */
-    dropEvents: pulumi.Input<boolean>;
+    keyFile?: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigSourcesSumoLogic {
     /**
-     * The unique ID of the processor.
+     * The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
      */
     id: pulumi.Input<string>;
+}
+export interface ObservabilityPipelineConfigSourcesSyslogNg {
     /**
-     * Whether to ignore when partition fields are missing.
+     * The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
      */
-    ignoreWhenMissingPartitions?: pulumi.Input<boolean>;
+    id: pulumi.Input<string>;
     /**
-     * A Datadog search query used to determine which logs this processor targets.
+     * Protocol used by the syslog source to receive messages.
      */
-    include: pulumi.Input<string>;
+    mode?: pulumi.Input<string>;
     /**
-     * The inputs for the processor.
+     * Configuration for enabling TLS encryption between the pipeline component and external services.
      */
-    inputs: pulumi.Input<pulumi.Input<string>[]>;
-    limit?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsQuotaLimit>;
+    tls?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesSyslogNgTls>;
+}
+export interface ObservabilityPipelineConfigSourcesSyslogNgTls {
     /**
-     * The name of the quota.
+     * Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
      */
-    name: pulumi.Input<string>;
+    caFile?: pulumi.Input<string>;
     /**
-     * The overrides for field-specific quotas.
+     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
      */
-    overrides?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsQuotaOverride>[]>;
+    crtFile?: pulumi.Input<string>;
     /**
-     * List of partition fields.
+     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
      */
-    partitionFields?: pulumi.Input<pulumi.Input<string>[]>;
+    keyFile?: pulumi.Input<string>;
 }
-export interface ObservabilityPipelineConfigProcessorsQuotaLimit {
+export interface OnCallEscalationPolicyStep {
     /**
-     * Whether to enforce by 'bytes' or 'events'. Valid values are `bytes`, `events`.
+     * Specifies how this escalation step will assign targets. Can be `default` (page all targets at once) or `round-robin`. Valid values are `assignment`, `round-robin`. Defaults to `"default"`.
      */
-    enforce: pulumi.Input<string>;
+    assignment?: pulumi.Input<string>;
     /**
-     * The daily quota limit.
+     * Defines how many seconds to wait before escalating to the next step. Value must be between 60 and 36000.
      */
-    limit: pulumi.Input<number>;
-}
-export interface ObservabilityPipelineConfigProcessorsQuotaOverride {
+    escalateAfterSeconds: pulumi.Input<number>;
     /**
-     * Fields that trigger this override.
+     * The ID of this step.
      */
-    fields?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsQuotaOverrideField>[]>;
-    limit?: pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsQuotaOverrideLimit>;
-}
-export interface ObservabilityPipelineConfigProcessorsQuotaOverrideField {
+    id?: pulumi.Input<string>;
     /**
-     * The field name.
+     * List of targets for the step.
      */
-    name: pulumi.Input<string>;
+    targets?: pulumi.Input<pulumi.Input<inputs.OnCallEscalationPolicyStepTarget>[]>;
+}
+export interface OnCallEscalationPolicyStepTarget {
     /**
-     * The field value.
+     * Targeted schedule ID.
      */
-    value: pulumi.Input<string>;
-}
-export interface ObservabilityPipelineConfigProcessorsQuotaOverrideLimit {
+    schedule?: pulumi.Input<string>;
     /**
-     * Whether to enforce by 'bytes' or 'events'. Valid values are `bytes`, `events`.
+     * Targeted team ID.
      */
-    enforce: pulumi.Input<string>;
+    team?: pulumi.Input<string>;
     /**
-     * The daily quota limit.
+     * Targeted user ID.
      */
-    limit: pulumi.Input<number>;
+    user?: pulumi.Input<string>;
 }
-export interface ObservabilityPipelineConfigProcessorsRemoveField {
+export interface OnCallScheduleLayer {
     /**
-     * List of fields to remove from the events.
+     * The date/time when this layer should become active (in ISO 8601).
      */
-    fields: pulumi.Input<pulumi.Input<string>[]>;
+    effectiveDate: pulumi.Input<string>;
     /**
-     * The unique ID of the processor.
+     * The date/time after which this layer no longer applies (in ISO 8601).
      */
-    id: pulumi.Input<string>;
+    endDate?: pulumi.Input<string>;
     /**
-     * A Datadog search query used to determine which logs this processor targets.
+     * The ID of this layer.
      */
-    include: pulumi.Input<string>;
+    id?: pulumi.Input<string>;
+    interval?: pulumi.Input<inputs.OnCallScheduleLayerInterval>;
     /**
-     * The inputs for the processor.
+     * The name of this layer. Should be unique within the schedule.
      */
-    inputs: pulumi.Input<pulumi.Input<string>[]>;
-}
-export interface ObservabilityPipelineConfigProcessorsRenameField {
+    name: pulumi.Input<string>;
     /**
-     * List of fields to rename.
+     * List of restrictions for the layer.
      */
-    fields?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigProcessorsRenameFieldField>[]>;
+    restrictions?: pulumi.Input<pulumi.Input<inputs.OnCallScheduleLayerRestriction>[]>;
     /**
-     * The unique ID of the processor.
+     * The date/time when the rotation for this layer starts (in ISO 8601).
      */
-    id: pulumi.Input<string>;
+    rotationStart?: pulumi.Input<string>;
     /**
-     * A Datadog search query used to determine which logs this processor targets.
+     * List of user IDs for the layer. Can either be a valid user id or null
      */
-    include: pulumi.Input<string>;
+    users: pulumi.Input<pulumi.Input<string>[]>;
+}
+export interface OnCallScheduleLayerInterval {
     /**
-     * he inputs for the processor.
+     * The number of full days in each rotation period.
      */
-    inputs: pulumi.Input<pulumi.Input<string>[]>;
-}
-export interface ObservabilityPipelineConfigProcessorsRenameFieldField {
+    days?: pulumi.Input<number>;
     /**
-     * Destination field name.
+     * For intervals that are not expressible in whole days, this will be added to `days`. Defaults to `0`.
      */
-    destination: pulumi.Input<string>;
+    seconds?: pulumi.Input<number>;
+}
+export interface OnCallScheduleLayerRestriction {
     /**
-     * Whether to keep the original field.
+     * The weekday when the restriction period ends. Valid values are `monday`, `tuesday`, `wednesday`, `thursday`, `friday`, `saturday`, `sunday`.
      */
-    preserveSource: pulumi.Input<boolean>;
+    endDay?: pulumi.Input<string>;
     /**
-     * Source field to rename.
+     * The time of day when the restriction ends (hh:mm:ss).
      */
-    source: pulumi.Input<string>;
-}
-export interface ObservabilityPipelineConfigSources {
+    endTime?: pulumi.Input<string>;
     /**
-     * The `datadogAgent` source collects logs from the Datadog Agent.
+     * The weekday when the restriction period starts. Valid values are `monday`, `tuesday`, `wednesday`, `thursday`, `friday`, `saturday`, `sunday`.
      */
-    datadogAgents?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigSourcesDatadogAgent>[]>;
+    startDay?: pulumi.Input<string>;
     /**
-     * The `kafka` source ingests data from Apache Kafka topics.
+     * The time of day when the restriction begins (hh:mm:ss).
      */
-    kafkas?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigSourcesKafka>[]>;
+    startTime?: pulumi.Input<string>;
 }
-export interface ObservabilityPipelineConfigSourcesDatadogAgent {
+export interface OnCallTeamRoutingRulesRule {
     /**
-     * The unique ID of the source.
+     * Specifies the list of actions to perform when the routing rule is matched.
      */
-    id: pulumi.Input<string>;
+    actions?: pulumi.Input<pulumi.Input<inputs.OnCallTeamRoutingRulesRuleAction>[]>;
     /**
-     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     * ID of the policy to be applied when this routing rule matches.
      */
-    tls?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesDatadogAgentTls>;
-}
-export interface ObservabilityPipelineConfigSourcesDatadogAgentTls {
+    escalationPolicy?: pulumi.Input<string>;
     /**
-     * Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
+     * The ID of this rule.
      */
-    caFile?: pulumi.Input<string>;
+    id?: pulumi.Input<string>;
     /**
-     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     * Defines the query or condition that triggers this routing rule. Defaults to `""`.
      */
-    crtFile: pulumi.Input<string>;
+    query?: pulumi.Input<string>;
     /**
-     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     * Holds time zone information and a list of time restrictions for a routing rule.
      */
-    keyFile?: pulumi.Input<string>;
-}
-export interface ObservabilityPipelineConfigSourcesKafka {
+    timeRestrictions?: pulumi.Input<inputs.OnCallTeamRoutingRulesRuleTimeRestrictions>;
     /**
-     * The Kafka consumer group ID.
+     * Defines the urgency for pages created via this rule. Only valid if `escalationPolicy` is set. Valid values are `high`, `low`, `dynamic`.
      */
-    groupId: pulumi.Input<string>;
+    urgency?: pulumi.Input<string>;
+}
+export interface OnCallTeamRoutingRulesRuleAction {
+    sendSlackMessage?: pulumi.Input<inputs.OnCallTeamRoutingRulesRuleActionSendSlackMessage>;
+    sendTeamsMessage?: pulumi.Input<inputs.OnCallTeamRoutingRulesRuleActionSendTeamsMessage>;
+}
+export interface OnCallTeamRoutingRulesRuleActionSendSlackMessage {
     /**
-     * The unique ID of the source.
+     * Slack channel ID.
      */
-    id: pulumi.Input<string>;
+    channel?: pulumi.Input<string>;
     /**
-     * Advanced librdkafka client configuration options.
+     * Slack workspace ID.
      */
-    librdkafkaOptions?: pulumi.Input<pulumi.Input<inputs.ObservabilityPipelineConfigSourcesKafkaLibrdkafkaOption>[]>;
+    workspace?: pulumi.Input<string>;
+}
+export interface OnCallTeamRoutingRulesRuleActionSendTeamsMessage {
     /**
-     * SASL authentication settings.
+     * Teams channel ID.
      */
-    sasl?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesKafkaSasl>;
+    channel?: pulumi.Input<string>;
     /**
-     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     * Teams team ID.
      */
-    tls?: pulumi.Input<inputs.ObservabilityPipelineConfigSourcesKafkaTls>;
+    team?: pulumi.Input<string>;
     /**
-     * A list of Kafka topic names to subscribe to. The source ingests messages from each topic specified.
+     * Teams tenant ID.
      */
-    topics: pulumi.Input<pulumi.Input<string>[]>;
+    tenant?: pulumi.Input<string>;
 }
-export interface ObservabilityPipelineConfigSourcesKafkaLibrdkafkaOption {
+export interface OnCallTeamRoutingRulesRuleTimeRestrictions {
     /**
-     * The name of the librdkafka option.
+     * List of restrictions for the rule.
      */
-    name: pulumi.Input<string>;
+    restrictions?: pulumi.Input<pulumi.Input<inputs.OnCallTeamRoutingRulesRuleTimeRestrictionsRestriction>[]>;
     /**
-     * The value of the librdkafka option.
+     * Specifies the time zone applicable to the restrictions, e.g. `America/New_York`.
      */
-    value: pulumi.Input<string>;
+    timeZone?: pulumi.Input<string>;
 }
-export interface ObservabilityPipelineConfigSourcesKafkaSasl {
+export interface OnCallTeamRoutingRulesRuleTimeRestrictionsRestriction {
     /**
-     * SASL mechanism to use (e.g., PLAIN, SCRAM-SHA-256, SCRAM-SHA-512). Valid values are `PLAIN`, `SCRAM-SHA-256`, `SCRAM-SHA-512`.
+     * The weekday when the restriction period ends. Valid values are `monday`, `tuesday`, `wednesday`, `thursday`, `friday`, `saturday`, `sunday`.
      */
-    mechanism: pulumi.Input<string>;
-}
-export interface ObservabilityPipelineConfigSourcesKafkaTls {
+    endDay?: pulumi.Input<string>;
     /**
-     * Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
+     * The time of day when the restriction ends (hh:mm:ss).
      */
-    caFile?: pulumi.Input<string>;
+    endTime?: pulumi.Input<string>;
     /**
-     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     * The weekday when the restriction period starts. Valid values are `monday`, `tuesday`, `wednesday`, `thursday`, `friday`, `saturday`, `sunday`.
      */
-    crtFile: pulumi.Input<string>;
+    startDay?: pulumi.Input<string>;
     /**
-     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     * The time of day when the restriction begins (hh:mm:ss).
      */
-    keyFile?: pulumi.Input<string>;
+    startTime?: pulumi.Input<string>;
 }
 export interface OrganizationSettingsSettings {
     /**
@@ -14913,11 +16512,11 @@ export interface PowerpackWidgetListStreamDefinitionRequestColumn {
     /**
      * Widget column field.
      */
-    field: pulumi.Input<string>;
+    field?: pulumi.Input<string>;
     /**
      * Widget column width. Valid values are `auto`, `compact`, `full`.
      */
-    width: pulumi.Input<string>;
+    width?: pulumi.Input<string>;
 }
 export interface PowerpackWidgetListStreamDefinitionRequestQuery {
     /**
@@ -21891,6 +23490,10 @@ export interface PowerpackWidgetTraceServiceDefinition {
     titleSize?: pulumi.Input<string>;
 }
 export interface PowerpackWidgetTreemapDefinition {
+    /**
+     * A nested block describing a custom link. Multiple `customLink` blocks are allowed using the structure below.
+     */
+    customLinks?: pulumi.Input<pulumi.Input<inputs.PowerpackWidgetTreemapDefinitionCustomLink>[]>;
     /**
      * Nested block describing the request to use when displaying the widget.
      */
@@ -21900,6 +23503,24 @@ export interface PowerpackWidgetTreemapDefinition {
      */
     title?: pulumi.Input<string>;
 }
+export interface PowerpackWidgetTreemapDefinitionCustomLink {
+    /**
+     * The flag for toggling context menu link visibility.
+     */
+    isHidden?: pulumi.Input<boolean>;
+    /**
+     * The label for the custom link URL.
+     */
+    label?: pulumi.Input<string>;
+    /**
+     * The URL of the custom link.
+     */
+    link?: pulumi.Input<string>;
+    /**
+     * The label ID that refers to a context menu link item. When `overrideLabel` is provided, the client request omits the label field.
+     */
+    overrideLabel?: pulumi.Input<string>;
+}
 export interface PowerpackWidgetTreemapDefinitionRequest {
     formulas?: pulumi.Input<pulumi.Input<inputs.PowerpackWidgetTreemapDefinitionRequestFormula>[]>;
     queries?: pulumi.Input<pulumi.Input<inputs.PowerpackWidgetTreemapDefinitionRequestQuery>[]>;
@@ -22376,7 +23997,7 @@ export interface PowerpackWidgetWidgetLayout {
 }
 export interface ProviderDefaultTags {
     /**
-     * [Experimental - Logs Pipelines, Monitors and Security Monitoring Rules only] Resource tags to be applied by default across all resources.
+     * [Experimental - Logs Pipelines, Monitors Security Monitoring Rules, and Service Level Objectives only] Resource tags to be applied by default across all resources.
      */
     tags?: pulumi.Input<{
         [key: string]: pulumi.Input<string>;
@@ -22620,7 +24241,7 @@ export interface SecurityMonitoringRuleQuery {
      */
     aggregation?: pulumi.Input<string>;
     /**
-     * Source of events. Valid values are `logs`, `audit`, `appSecSpans`, `spans`, `securityRuntime`, `network`. Defaults to `"logs"`.
+     * Source of events. Valid values are `logs`, `audit`, `appSecSpans`, `spans`, `securityRuntime`, `network`, `events`. Defaults to `"logs"`.
      */
     dataSource?: pulumi.Input<string>;
     /**
@@ -23509,6 +25130,10 @@ export interface SyntheticsTestBrowserStepParams {
      * Type of click to use for a "click" step.
      */
     clickType?: pulumi.Input<string>;
+    /**
+     * Whether to use `element.click()` for a "click" step. This is a more reliable way to interact with elements but does not emulate a real user interaction.
+     */
+    clickWithJavascript?: pulumi.Input<boolean>;
     /**
      * Javascript code to use for the step.
      */