cribl-control-plane 0.0.21__py3-none-any.whl → 0.4.0b23__py3-none-any.whl

cribl_control_plane/models/functionaggregation.py

@@ -0,0 +1,172 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import Any, Dict, List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionAggregationID(str, Enum):
+    AGGREGATION = "aggregation"
+
+
+class FunctionAggregationAddTypedDict(TypedDict):
+    value: str
+    r"""JavaScript expression to compute the value (can be constant)"""
+    name: NotRequired[str]
+
+
+class FunctionAggregationAdd(BaseModel):
+    value: str
+    r"""JavaScript expression to compute the value (can be constant)"""
+
+    name: Optional[str] = None
+
+
+class FunctionAggregationSchemaTypedDict(TypedDict):
+    aggregations: List[str]
+    r"""Aggregate function to perform on events. Example: sum(bytes).where(action=='REJECT').as(TotalBytes)"""
+    passthrough: NotRequired[bool]
+    r"""Pass through the original events along with the aggregation events"""
+    preserve_group_bys: NotRequired[bool]
+    r"""Preserve the structure of the original aggregation event's groupby fields"""
+    sufficient_stats_only: NotRequired[bool]
+    r"""Output only statistics that are sufficient for the supplied aggregations"""
+    metrics_mode: NotRequired[bool]
+    r"""Enable to output the aggregates as metrics. When disabled, aggregates are output as events."""
+    prefix: NotRequired[str]
+    r"""A prefix that is prepended to all of the fields output by this Aggregations Function"""
+    time_window: NotRequired[str]
+    r"""The time span of the tumbling window for aggregating events. Must be a valid time string (such as 10s)."""
+    groupbys: NotRequired[List[str]]
+    r"""Optional: One or more fields to group aggregates by. Supports wildcard expressions. Warning: Using wildcard '*' causes all fields in the event to be included, which can result in high cardinality and increased memory usage. Exclude fields that can result in high cardinality before using wildcards. Example: !_time, !_numericValue, *"""
+    flush_event_limit: NotRequired[float]
+    r"""The maximum number of events to include in any given aggregation event"""
+    flush_mem_limit: NotRequired[str]
+    r"""The memory usage limit to impose upon aggregations. Defaults to 80% of the process memory; value configured above default limit is ignored. Accepts numerals with units like KB and MB (example: 128MB)."""
+    cumulative: NotRequired[bool]
+    r"""Enable to retain aggregations for cumulative aggregations when flushing out an aggregation table event. When disabled (the default), aggregations are reset to 0 on flush."""
+    search_agg_mode: NotRequired[str]
+    r"""Allows Cribl Search-specific aggregation configuration"""
+    add: NotRequired[List[FunctionAggregationAddTypedDict]]
+    r"""Set of key-value pairs to evaluate and add/set"""
+    should_treat_dots_as_literals: NotRequired[bool]
+    r"""Treat dots in dimension names as literals. This is useful for top-level dimensions that contain dots, such as 'service.name'."""
+    flush_on_input_close: NotRequired[bool]
+    r"""Flush aggregations when an input stream is closed. If disabled, Time Window Settings control flush behavior."""
+
+
+class FunctionAggregationSchema(BaseModel):
+    aggregations: List[str]
+    r"""Aggregate function to perform on events. Example: sum(bytes).where(action=='REJECT').as(TotalBytes)"""
+
+    passthrough: Optional[bool] = False
+    r"""Pass through the original events along with the aggregation events"""
+
+    preserve_group_bys: Annotated[
+        Optional[bool], pydantic.Field(alias="preserveGroupBys")
+    ] = False
+    r"""Preserve the structure of the original aggregation event's groupby fields"""
+
+    sufficient_stats_only: Annotated[
+        Optional[bool], pydantic.Field(alias="sufficientStatsOnly")
+    ] = False
+    r"""Output only statistics that are sufficient for the supplied aggregations"""
+
+    metrics_mode: Annotated[Optional[bool], pydantic.Field(alias="metricsMode")] = False
+    r"""Enable to output the aggregates as metrics. When disabled, aggregates are output as events."""
+
+    prefix: Optional[str] = None
+    r"""A prefix that is prepended to all of the fields output by this Aggregations Function"""
+
+    time_window: Annotated[Optional[str], pydantic.Field(alias="timeWindow")] = "10s"
+    r"""The time span of the tumbling window for aggregating events. Must be a valid time string (such as 10s)."""
+
+    groupbys: Optional[List[str]] = None
+    r"""Optional: One or more fields to group aggregates by. Supports wildcard expressions. Warning: Using wildcard '*' causes all fields in the event to be included, which can result in high cardinality and increased memory usage. Exclude fields that can result in high cardinality before using wildcards. Example: !_time, !_numericValue, *"""
+
+    flush_event_limit: Annotated[
+        Optional[float], pydantic.Field(alias="flushEventLimit")
+    ] = None
+    r"""The maximum number of events to include in any given aggregation event"""
+
+    flush_mem_limit: Annotated[Optional[str], pydantic.Field(alias="flushMemLimit")] = (
+        None
+    )
+    r"""The memory usage limit to impose upon aggregations. Defaults to 80% of the process memory; value configured above default limit is ignored. Accepts numerals with units like KB and MB (example: 128MB)."""
+
+    cumulative: Optional[bool] = False
+    r"""Enable to retain aggregations for cumulative aggregations when flushing out an aggregation table event. When disabled (the default), aggregations are reset to 0 on flush."""
+
+    search_agg_mode: Annotated[Optional[str], pydantic.Field(alias="searchAggMode")] = (
+        None
+    )
+    r"""Allows Cribl Search-specific aggregation configuration"""
+
+    add: Optional[List[FunctionAggregationAdd]] = None
+    r"""Set of key-value pairs to evaluate and add/set"""
+
+    should_treat_dots_as_literals: Annotated[
+        Optional[bool], pydantic.Field(alias="shouldTreatDotsAsLiterals")
+    ] = False
+    r"""Treat dots in dimension names as literals. This is useful for top-level dimensions that contain dots, such as 'service.name'."""
+
+    flush_on_input_close: Annotated[
+        Optional[bool], pydantic.Field(alias="flushOnInputClose")
+    ] = True
+    r"""Flush aggregations when an input stream is closed. If disabled, Time Window Settings control flush behavior."""
+
+
+class FunctionAggregationTypedDict(TypedDict):
+    filename: str
+    group: str
+    id: FunctionAggregationID
+    load_time: float
+    mod_time: float
+    name: str
+    uischema: Dict[str, Any]
+    version: str
+    async_timeout: NotRequired[float]
+    cribl_version: NotRequired[str]
+    disabled: NotRequired[bool]
+    handle_signals: NotRequired[bool]
+    sync: NotRequired[bool]
+    schema_: NotRequired[FunctionAggregationSchemaTypedDict]
+
+
+class FunctionAggregation(BaseModel):
+    filename: Annotated[str, pydantic.Field(alias="__filename")]
+
+    group: str
+
+    id: FunctionAggregationID
+
+    load_time: Annotated[float, pydantic.Field(alias="loadTime")]
+
+    mod_time: Annotated[float, pydantic.Field(alias="modTime")]
+
+    name: str
+
+    uischema: Dict[str, Any]
+
+    version: str
+
+    async_timeout: Annotated[Optional[float], pydantic.Field(alias="asyncTimeout")] = (
+        None
+    )
+
+    cribl_version: Optional[str] = None
+
+    disabled: Optional[bool] = None
+
+    handle_signals: Annotated[Optional[bool], pydantic.Field(alias="handleSignals")] = (
+        None
+    )
+
+    sync: Optional[bool] = None
+
+    schema_: Annotated[
+        Optional[FunctionAggregationSchema], pydantic.Field(alias="schema")
+    ] = None

cribl_control_plane/models/functionautotimestamp.py

@@ -0,0 +1,173 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane import models, utils
+from cribl_control_plane.types import BaseModel
+from cribl_control_plane.utils import validate_open_enum
+from enum import Enum
+import pydantic
+from pydantic import field_serializer
+from pydantic.functional_validators import PlainValidator
+from typing import Any, Dict, List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionAutoTimestampID(str, Enum):
+    AUTO_TIMESTAMP = "auto_timestamp"
+
+
+class DefaultTime(str, Enum, metaclass=utils.OpenEnumMeta):
+    r"""How to set the time field if no timestamp is found"""
+
+    # Current Time
+    NOW = "now"
+    # Last Event's Time
+    LAST = "last"
+    # None
+    NONE = "none"
+
+
+class TimestampTypedDict(TypedDict):
+    regex: str
+    r"""Regex with first capturing group matching the timestamp"""
+    strptime: str
+    r"""Select or enter strptime format for the captured timestamp"""
+
+
+class Timestamp(BaseModel):
+    regex: str
+    r"""Regex with first capturing group matching the timestamp"""
+
+    strptime: str
+    r"""Select or enter strptime format for the captured timestamp"""
+
+
+class FunctionAutoTimestampSchemaTypedDict(TypedDict):
+    src_field: NotRequired[str]
+    r"""Field to search for a timestamp"""
+    dst_field: NotRequired[str]
+    r"""Field to place timestamp in"""
+    default_timezone: NotRequired[str]
+    r"""Timezone to assign to timestamps without timezone info"""
+    time_expression: NotRequired[str]
+    r"""Expression to use to format time. Current time, as a JavaScript Date object, is in global `time`. You can access other fields' values via __e.<fieldName>."""
+    offset: NotRequired[float]
+    r"""The offset into the string from which to look for a timestamp"""
+    max_len: NotRequired[float]
+    r"""Maximum string length at which to look for a timestamp"""
+    default_time: NotRequired[DefaultTime]
+    r"""How to set the time field if no timestamp is found"""
+    latest_date_allowed: NotRequired[str]
+    r"""The latest timestamp value allowed relative to now, such as +42days. Parsed values after this date will be set to the Default time."""
+    spacer: NotRequired[str]
+    earliest_date_allowed: NotRequired[str]
+    r"""The earliest timestamp value allowed relative to now, such as -42years. Parsed values prior to this date will be set to the Default time."""
+    timestamps: NotRequired[List[TimestampTypedDict]]
+    r"""Add regex/strptime pairs to extract additional timestamp formats"""
+
+
+class FunctionAutoTimestampSchema(BaseModel):
+    src_field: Annotated[Optional[str], pydantic.Field(alias="srcField")] = "_raw"
+    r"""Field to search for a timestamp"""
+
+    dst_field: Annotated[Optional[str], pydantic.Field(alias="dstField")] = "_time"
+    r"""Field to place timestamp in"""
+
+    default_timezone: Annotated[
+        Optional[str], pydantic.Field(alias="defaultTimezone")
+    ] = "local"
+    r"""Timezone to assign to timestamps without timezone info"""
+
+    time_expression: Annotated[
+        Optional[str], pydantic.Field(alias="timeExpression")
+    ] = "time.getTime() / 1000"
+    r"""Expression to use to format time. Current time, as a JavaScript Date object, is in global `time`. You can access other fields' values via __e.<fieldName>."""
+
+    offset: Optional[float] = 0
+    r"""The offset into the string from which to look for a timestamp"""
+
+    max_len: Annotated[Optional[float], pydantic.Field(alias="maxLen")] = 150
+    r"""Maximum string length at which to look for a timestamp"""
+
+    default_time: Annotated[
+        Annotated[Optional[DefaultTime], PlainValidator(validate_open_enum(False))],
+        pydantic.Field(alias="defaultTime"),
+    ] = DefaultTime.NOW
+    r"""How to set the time field if no timestamp is found"""
+
+    latest_date_allowed: Annotated[
+        Optional[str], pydantic.Field(alias="latestDateAllowed")
+    ] = "+1week"
+    r"""The latest timestamp value allowed relative to now, such as +42days. Parsed values after this date will be set to the Default time."""
+
+    spacer: Optional[str] = None
+
+    earliest_date_allowed: Annotated[
+        Optional[str], pydantic.Field(alias="earliestDateAllowed")
+    ] = "-420weeks"
+    r"""The earliest timestamp value allowed relative to now, such as -42years. Parsed values prior to this date will be set to the Default time."""
+
+    timestamps: Optional[List[Timestamp]] = None
+    r"""Add regex/strptime pairs to extract additional timestamp formats"""
+
+    @field_serializer("default_time")
+    def serialize_default_time(self, value):
+        if isinstance(value, str):
+            try:
+                return models.DefaultTime(value)
+            except ValueError:
+                return value
+        return value
+
+
+class FunctionAutoTimestampTypedDict(TypedDict):
+    filename: str
+    group: str
+    id: FunctionAutoTimestampID
+    load_time: float
+    mod_time: float
+    name: str
+    uischema: Dict[str, Any]
+    version: str
+    async_timeout: NotRequired[float]
+    cribl_version: NotRequired[str]
+    disabled: NotRequired[bool]
+    handle_signals: NotRequired[bool]
+    sync: NotRequired[bool]
+    schema_: NotRequired[FunctionAutoTimestampSchemaTypedDict]
+
+
+class FunctionAutoTimestamp(BaseModel):
+    filename: Annotated[str, pydantic.Field(alias="__filename")]
+
+    group: str
+
+    id: FunctionAutoTimestampID
+
+    load_time: Annotated[float, pydantic.Field(alias="loadTime")]
+
+    mod_time: Annotated[float, pydantic.Field(alias="modTime")]
+
+    name: str
+
+    uischema: Dict[str, Any]
+
+    version: str
+
+    async_timeout: Annotated[Optional[float], pydantic.Field(alias="asyncTimeout")] = (
+        None
+    )
+
+    cribl_version: Optional[str] = None
+
+    disabled: Optional[bool] = None
+
+    handle_signals: Annotated[Optional[bool], pydantic.Field(alias="handleSignals")] = (
+        None
+    )
+
+    sync: Optional[bool] = None
+
+    schema_: Annotated[
+        Optional[FunctionAutoTimestampSchema], pydantic.Field(alias="schema")
+    ] = None

cribl_control_plane/models/functioncef.py

@@ -0,0 +1,111 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import Any, Dict, List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionCefID(str, Enum):
+    CEF = "cef"
+
+
+class HeaderTypedDict(TypedDict):
+    value: str
+    r"""JavaScript expression to compute the value (can be constant)"""
+    name: NotRequired[str]
+
+
+class Header(BaseModel):
+    value: str
+    r"""JavaScript expression to compute the value (can be constant)"""
+
+    name: Optional[str] = None
+
+
+class ExtensionTypedDict(TypedDict):
+    name: str
+    value: str
+    r"""JavaScript expression to compute the value (can be constant)"""
+
+
+class Extension(BaseModel):
+    name: str
+
+    value: str
+    r"""JavaScript expression to compute the value (can be constant)"""
+
+
+class FunctionCefSchemaTypedDict(TypedDict):
+    output_field: NotRequired[str]
+    r"""The field to which the CEF formatted event will be output"""
+    header: NotRequired[List[HeaderTypedDict]]
+    r"""Set of header key/value pairs"""
+    extension: NotRequired[List[ExtensionTypedDict]]
+    r"""Set of extension key-value pairs"""
+
+
+class FunctionCefSchema(BaseModel):
+    output_field: Annotated[Optional[str], pydantic.Field(alias="outputField")] = "_raw"
+    r"""The field to which the CEF formatted event will be output"""
+
+    header: Optional[List[Header]] = None
+    r"""Set of header key/value pairs"""
+
+    extension: Optional[List[Extension]] = None
+    r"""Set of extension key-value pairs"""
+
+
+class FunctionCefTypedDict(TypedDict):
+    filename: str
+    group: str
+    id: FunctionCefID
+    load_time: float
+    mod_time: float
+    name: str
+    uischema: Dict[str, Any]
+    version: str
+    async_timeout: NotRequired[float]
+    cribl_version: NotRequired[str]
+    disabled: NotRequired[bool]
+    handle_signals: NotRequired[bool]
+    sync: NotRequired[bool]
+    schema_: NotRequired[FunctionCefSchemaTypedDict]
+
+
+class FunctionCef(BaseModel):
+    filename: Annotated[str, pydantic.Field(alias="__filename")]
+
+    group: str
+
+    id: FunctionCefID
+
+    load_time: Annotated[float, pydantic.Field(alias="loadTime")]
+
+    mod_time: Annotated[float, pydantic.Field(alias="modTime")]
+
+    name: str
+
+    uischema: Dict[str, Any]
+
+    version: str
+
+    async_timeout: Annotated[Optional[float], pydantic.Field(alias="asyncTimeout")] = (
+        None
+    )
+
+    cribl_version: Optional[str] = None
+
+    disabled: Optional[bool] = None
+
+    handle_signals: Annotated[Optional[bool], pydantic.Field(alias="handleSignals")] = (
+        None
+    )
+
+    sync: Optional[bool] = None
+
+    schema_: Annotated[Optional[FunctionCefSchema], pydantic.Field(alias="schema")] = (
+        None
+    )

cribl_control_plane/models/functionchain.py

@@ -0,0 +1,75 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import Any, Dict, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionChainID(str, Enum):
+    CHAIN = "chain"
+
+
+class FunctionChainSchemaTypedDict(TypedDict):
+    processor: str
+    r"""The data processor (Pack/Pipeline) to send events through"""
+
+
+class FunctionChainSchema(BaseModel):
+    processor: str
+    r"""The data processor (Pack/Pipeline) to send events through"""
+
+
+class FunctionChainTypedDict(TypedDict):
+    filename: str
+    group: str
+    id: FunctionChainID
+    load_time: float
+    mod_time: float
+    name: str
+    uischema: Dict[str, Any]
+    version: str
+    async_timeout: NotRequired[float]
+    cribl_version: NotRequired[str]
+    disabled: NotRequired[bool]
+    handle_signals: NotRequired[bool]
+    sync: NotRequired[bool]
+    schema_: NotRequired[FunctionChainSchemaTypedDict]
+
+
+class FunctionChain(BaseModel):
+    filename: Annotated[str, pydantic.Field(alias="__filename")]
+
+    group: str
+
+    id: FunctionChainID
+
+    load_time: Annotated[float, pydantic.Field(alias="loadTime")]
+
+    mod_time: Annotated[float, pydantic.Field(alias="modTime")]
+
+    name: str
+
+    uischema: Dict[str, Any]
+
+    version: str
+
+    async_timeout: Annotated[Optional[float], pydantic.Field(alias="asyncTimeout")] = (
+        None
+    )
+
+    cribl_version: Optional[str] = None
+
+    disabled: Optional[bool] = None
+
+    handle_signals: Annotated[Optional[bool], pydantic.Field(alias="handleSignals")] = (
+        None
+    )
+
+    sync: Optional[bool] = None
+
+    schema_: Annotated[
+        Optional[FunctionChainSchema], pydantic.Field(alias="schema")
+    ] = None

cribl_control_plane/models/functionclone.py

@@ -0,0 +1,75 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import Any, Dict, List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionCloneID(str, Enum):
+    CLONE = "clone"
+
+
+class FunctionCloneSchemaTypedDict(TypedDict):
+    clones: NotRequired[List[Dict[str, str]]]
+    r"""Create clones with the following fields set"""
+
+
+class FunctionCloneSchema(BaseModel):
+    clones: Optional[List[Dict[str, str]]] = None
+    r"""Create clones with the following fields set"""
+
+
+class FunctionCloneTypedDict(TypedDict):
+    filename: str
+    group: str
+    id: FunctionCloneID
+    load_time: float
+    mod_time: float
+    name: str
+    uischema: Dict[str, Any]
+    version: str
+    async_timeout: NotRequired[float]
+    cribl_version: NotRequired[str]
+    disabled: NotRequired[bool]
+    handle_signals: NotRequired[bool]
+    sync: NotRequired[bool]
+    schema_: NotRequired[FunctionCloneSchemaTypedDict]
+
+
+class FunctionClone(BaseModel):
+    filename: Annotated[str, pydantic.Field(alias="__filename")]
+
+    group: str
+
+    id: FunctionCloneID
+
+    load_time: Annotated[float, pydantic.Field(alias="loadTime")]
+
+    mod_time: Annotated[float, pydantic.Field(alias="modTime")]
+
+    name: str
+
+    uischema: Dict[str, Any]
+
+    version: str
+
+    async_timeout: Annotated[Optional[float], pydantic.Field(alias="asyncTimeout")] = (
+        None
+    )
+
+    cribl_version: Optional[str] = None
+
+    disabled: Optional[bool] = None
+
+    handle_signals: Annotated[Optional[bool], pydantic.Field(alias="handleSignals")] = (
+        None
+    )
+
+    sync: Optional[bool] = None
+
+    schema_: Annotated[
+        Optional[FunctionCloneSchema], pydantic.Field(alias="schema")
+    ] = None