cribl-control-plane 0.4.0b23__py3-none-any.whl → 0.5.0b3__py3-none-any.whl

cribl_control_plane/models/pipelinefunctiondynamicsampling.py

@@ -0,0 +1,111 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane import models, utils
+from cribl_control_plane.types import BaseModel
+from cribl_control_plane.utils import validate_open_enum
+from enum import Enum
+import pydantic
+from pydantic import field_serializer
+from pydantic.functional_validators import PlainValidator
+from typing import Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class PipelineFunctionDynamicSamplingID(str, Enum):
+    r"""Function ID"""
+
+    DYNAMIC_SAMPLING = "dynamic_sampling"
+
+
+class PipelineFunctionDynamicSamplingSampleMode(
+    str, Enum, metaclass=utils.OpenEnumMeta
+):
+    r"""Defines how sample rate will be derived: log(previousPeriodCount) or sqrt(previousPeriodCount)"""
+
+    # Logarithmic
+    LOG = "log"
+    # Square Root
+    SQRT = "sqrt"
+
+
+class PipelineFunctionDynamicSamplingConfTypedDict(TypedDict):
+    mode: NotRequired[PipelineFunctionDynamicSamplingSampleMode]
+    r"""Defines how sample rate will be derived: log(previousPeriodCount) or sqrt(previousPeriodCount)"""
+    key_expr: NotRequired[str]
+    r"""Expression used to derive sample group key. Example:`${domain}:${status}`. Each sample group will have its own derived sampling rate based on volume. Defaults to `${host}`."""
+    sample_period: NotRequired[float]
+    r"""How often (in seconds) sample rates will be adjusted"""
+    min_events: NotRequired[float]
+    r"""Minimum number of events that must be received in previous sample period for sampling mode to be applied to current period. If the number of events received for a sample group is less than this minimum, a sample rate of 1:1 is used."""
+    max_sample_rate: NotRequired[float]
+    r"""Maximum sampling rate. If computed sampling rate is above this value, it will be limited to this value."""
+
+
+class PipelineFunctionDynamicSamplingConf(BaseModel):
+    mode: Annotated[
+        Optional[PipelineFunctionDynamicSamplingSampleMode],
+        PlainValidator(validate_open_enum(False)),
+    ] = PipelineFunctionDynamicSamplingSampleMode.LOG
+    r"""Defines how sample rate will be derived: log(previousPeriodCount) or sqrt(previousPeriodCount)"""
+
+    key_expr: Annotated[Optional[str], pydantic.Field(alias="keyExpr")] = "`${host}`"
+    r"""Expression used to derive sample group key. Example:`${domain}:${status}`. Each sample group will have its own derived sampling rate based on volume. Defaults to `${host}`."""
+
+    sample_period: Annotated[Optional[float], pydantic.Field(alias="samplePeriod")] = 30
+    r"""How often (in seconds) sample rates will be adjusted"""
+
+    min_events: Annotated[Optional[float], pydantic.Field(alias="minEvents")] = 30
+    r"""Minimum number of events that must be received in previous sample period for sampling mode to be applied to current period. If the number of events received for a sample group is less than this minimum, a sample rate of 1:1 is used."""
+
+    max_sample_rate: Annotated[
+        Optional[float], pydantic.Field(alias="maxSampleRate")
+    ] = 100
+    r"""Maximum sampling rate. If computed sampling rate is above this value, it will be limited to this value."""
+
+    @field_serializer("mode")
+    def serialize_mode(self, value):
+        if isinstance(value, str):
+            try:
+                return models.PipelineFunctionDynamicSamplingSampleMode(value)
+            except ValueError:
+                return value
+        return value
+
+
+class PipelineFunctionDynamicSamplingTypedDict(TypedDict):
+    id: PipelineFunctionDynamicSamplingID
+    r"""Function ID"""
+    conf: PipelineFunctionDynamicSamplingConfTypedDict
+    filter_: NotRequired[str]
+    r"""Filter that selects data to be fed through this Function"""
+    description: NotRequired[str]
+    r"""Simple description of this step"""
+    disabled: NotRequired[bool]
+    r"""If true, data will not be pushed through this function"""
+    final: NotRequired[bool]
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+    group_id: NotRequired[str]
+    r"""Group ID"""
+
+
+class PipelineFunctionDynamicSampling(BaseModel):
+    id: PipelineFunctionDynamicSamplingID
+    r"""Function ID"""
+
+    conf: PipelineFunctionDynamicSamplingConf
+
+    filter_: Annotated[Optional[str], pydantic.Field(alias="filter")] = "true"
+    r"""Filter that selects data to be fed through this Function"""
+
+    description: Optional[str] = None
+    r"""Simple description of this step"""
+
+    disabled: Optional[bool] = None
+    r"""If true, data will not be pushed through this function"""
+
+    final: Optional[bool] = None
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+
+    group_id: Annotated[Optional[str], pydantic.Field(alias="groupId")] = None
+    r"""Group ID"""

cribl_control_plane/models/pipelinefunctioneval.py

@@ -0,0 +1,56 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from .functionconfschemaeval import (
+    FunctionConfSchemaEval,
+    FunctionConfSchemaEvalTypedDict,
+)
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class PipelineFunctionEvalID(str, Enum):
+    r"""Function ID"""
+
+    EVAL = "eval"
+
+
+class PipelineFunctionEvalTypedDict(TypedDict):
+    id: PipelineFunctionEvalID
+    r"""Function ID"""
+    conf: FunctionConfSchemaEvalTypedDict
+    filter_: NotRequired[str]
+    r"""Filter that selects data to be fed through this Function"""
+    description: NotRequired[str]
+    r"""Simple description of this step"""
+    disabled: NotRequired[bool]
+    r"""If true, data will not be pushed through this function"""
+    final: NotRequired[bool]
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+    group_id: NotRequired[str]
+    r"""Group ID"""
+
+
+class PipelineFunctionEval(BaseModel):
+    id: PipelineFunctionEvalID
+    r"""Function ID"""
+
+    conf: FunctionConfSchemaEval
+
+    filter_: Annotated[Optional[str], pydantic.Field(alias="filter")] = "true"
+    r"""Filter that selects data to be fed through this Function"""
+
+    description: Optional[str] = None
+    r"""Simple description of this step"""
+
+    disabled: Optional[bool] = None
+    r"""If true, data will not be pushed through this function"""
+
+    final: Optional[bool] = None
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+
+    group_id: Annotated[Optional[str], pydantic.Field(alias="groupId")] = None
+    r"""Group ID"""

cribl_control_plane/models/pipelinefunctioneventbreaker.py

@@ -0,0 +1,95 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane import models, utils
+from cribl_control_plane.types import BaseModel
+from cribl_control_plane.utils import validate_open_enum
+from enum import Enum
+import pydantic
+from pydantic import field_serializer
+from pydantic.functional_validators import PlainValidator
+from typing import Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class PipelineFunctionEventBreakerID(str, Enum):
+    r"""Function ID"""
+
+    EVENT_BREAKER = "event_breaker"
+
+
+class PipelineFunctionEventBreakerExistingOrNew(
+    str, Enum, metaclass=utils.OpenEnumMeta
+):
+    # Use Existing
+    EXISTING = "existing"
+    # Create New
+    NEW = "new"
+
+
+class PipelineFunctionEventBreakerConfTypedDict(TypedDict):
+    existing_or_new: NotRequired[PipelineFunctionEventBreakerExistingOrNew]
+    should_mark_cribl_breaker: NotRequired[bool]
+    r"""Add this Function name to the cribl_breaker field"""
+
+
+class PipelineFunctionEventBreakerConf(BaseModel):
+    existing_or_new: Annotated[
+        Annotated[
+            Optional[PipelineFunctionEventBreakerExistingOrNew],
+            PlainValidator(validate_open_enum(False)),
+        ],
+        pydantic.Field(alias="existingOrNew"),
+    ] = PipelineFunctionEventBreakerExistingOrNew.EXISTING
+
+    should_mark_cribl_breaker: Annotated[
+        Optional[bool], pydantic.Field(alias="shouldMarkCriblBreaker")
+    ] = True
+    r"""Add this Function name to the cribl_breaker field"""
+
+    @field_serializer("existing_or_new")
+    def serialize_existing_or_new(self, value):
+        if isinstance(value, str):
+            try:
+                return models.PipelineFunctionEventBreakerExistingOrNew(value)
+            except ValueError:
+                return value
+        return value
+
+
+class PipelineFunctionEventBreakerTypedDict(TypedDict):
+    id: PipelineFunctionEventBreakerID
+    r"""Function ID"""
+    conf: PipelineFunctionEventBreakerConfTypedDict
+    filter_: NotRequired[str]
+    r"""Filter that selects data to be fed through this Function"""
+    description: NotRequired[str]
+    r"""Simple description of this step"""
+    disabled: NotRequired[bool]
+    r"""If true, data will not be pushed through this function"""
+    final: NotRequired[bool]
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+    group_id: NotRequired[str]
+    r"""Group ID"""
+
+
+class PipelineFunctionEventBreaker(BaseModel):
+    id: PipelineFunctionEventBreakerID
+    r"""Function ID"""
+
+    conf: PipelineFunctionEventBreakerConf
+
+    filter_: Annotated[Optional[str], pydantic.Field(alias="filter")] = "true"
+    r"""Filter that selects data to be fed through this Function"""
+
+    description: Optional[str] = None
+    r"""Simple description of this step"""
+
+    disabled: Optional[bool] = None
+    r"""If true, data will not be pushed through this function"""
+
+    final: Optional[bool] = None
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+
+    group_id: Annotated[Optional[str], pydantic.Field(alias="groupId")] = None
+    r"""Group ID"""

cribl_control_plane/models/pipelinefunctioneventstats.py

@@ -0,0 +1,79 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class PipelineFunctionEventstatsID(str, Enum):
+    r"""Function ID"""
+
+    EVENTSTATS = "eventstats"
+
+
+class EventstatsConfigurationTypedDict(TypedDict):
+    aggregations: List[str]
+    r"""Aggregate function(s) to perform on events. E.g., sum(bytes).where(action=='REJECT').as(TotalBytes)"""
+    group_bys: NotRequired[List[str]]
+    r"""Fields to group aggregates by, supports wildcard expressions."""
+    max_events: NotRequired[float]
+    r"""Specifies how many events are at max kept in memory to be enriched with aggregations"""
+    flush_on_input_close: NotRequired[bool]
+    r"""Determines if aggregations should flush when an input stream is closed. If disabled, time window settings will control flush behavior."""
+
+
+class EventstatsConfiguration(BaseModel):
+    aggregations: List[str]
+    r"""Aggregate function(s) to perform on events. E.g., sum(bytes).where(action=='REJECT').as(TotalBytes)"""
+
+    group_bys: Annotated[Optional[List[str]], pydantic.Field(alias="groupBys")] = None
+    r"""Fields to group aggregates by, supports wildcard expressions."""
+
+    max_events: Annotated[Optional[float], pydantic.Field(alias="maxEvents")] = 50000
+    r"""Specifies how many events are at max kept in memory to be enriched with aggregations"""
+
+    flush_on_input_close: Annotated[
+        Optional[bool], pydantic.Field(alias="flushOnInputClose")
+    ] = False
+    r"""Determines if aggregations should flush when an input stream is closed. If disabled, time window settings will control flush behavior."""
+
+
+class PipelineFunctionEventstatsTypedDict(TypedDict):
+    id: PipelineFunctionEventstatsID
+    r"""Function ID"""
+    conf: EventstatsConfigurationTypedDict
+    filter_: NotRequired[str]
+    r"""Filter that selects data to be fed through this Function"""
+    description: NotRequired[str]
+    r"""Simple description of this step"""
+    disabled: NotRequired[bool]
+    r"""If true, data will not be pushed through this function"""
+    final: NotRequired[bool]
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+    group_id: NotRequired[str]
+    r"""Group ID"""
+
+
+class PipelineFunctionEventstats(BaseModel):
+    id: PipelineFunctionEventstatsID
+    r"""Function ID"""
+
+    conf: EventstatsConfiguration
+
+    filter_: Annotated[Optional[str], pydantic.Field(alias="filter")] = "true"
+    r"""Filter that selects data to be fed through this Function"""
+
+    description: Optional[str] = None
+    r"""Simple description of this step"""
+
+    disabled: Optional[bool] = None
+    r"""If true, data will not be pushed through this function"""
+
+    final: Optional[bool] = None
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+
+    group_id: Annotated[Optional[str], pydantic.Field(alias="groupId")] = None
+    r"""Group ID"""

cribl_control_plane/models/pipelinefunctionexternaldata.py

@@ -0,0 +1,56 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from .functionconfschemaexternaldata import (
+    FunctionConfSchemaExternaldata,
+    FunctionConfSchemaExternaldataTypedDict,
+)
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class PipelineFunctionExternaldataID(str, Enum):
+    r"""Function ID"""
+
+    EXTERNALDATA = "externaldata"
+
+
+class PipelineFunctionExternaldataTypedDict(TypedDict):
+    id: PipelineFunctionExternaldataID
+    r"""Function ID"""
+    conf: FunctionConfSchemaExternaldataTypedDict
+    filter_: NotRequired[str]
+    r"""Filter that selects data to be fed through this Function"""
+    description: NotRequired[str]
+    r"""Simple description of this step"""
+    disabled: NotRequired[bool]
+    r"""If true, data will not be pushed through this function"""
+    final: NotRequired[bool]
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+    group_id: NotRequired[str]
+    r"""Group ID"""
+
+
+class PipelineFunctionExternaldata(BaseModel):
+    id: PipelineFunctionExternaldataID
+    r"""Function ID"""
+
+    conf: FunctionConfSchemaExternaldata
+
+    filter_: Annotated[Optional[str], pydantic.Field(alias="filter")] = "true"
+    r"""Filter that selects data to be fed through this Function"""
+
+    description: Optional[str] = None
+    r"""Simple description of this step"""
+
+    disabled: Optional[bool] = None
+    r"""If true, data will not be pushed through this function"""
+
+    final: Optional[bool] = None
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+
+    group_id: Annotated[Optional[str], pydantic.Field(alias="groupId")] = None
+    r"""Group ID"""

cribl_control_plane/models/pipelinefunctionflatten.py

@@ -0,0 +1,56 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from .functionconfschemaflatten import (
+    FunctionConfSchemaFlatten,
+    FunctionConfSchemaFlattenTypedDict,
+)
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class PipelineFunctionFlattenID(str, Enum):
+    r"""Function ID"""
+
+    FLATTEN = "flatten"
+
+
+class PipelineFunctionFlattenTypedDict(TypedDict):
+    id: PipelineFunctionFlattenID
+    r"""Function ID"""
+    conf: FunctionConfSchemaFlattenTypedDict
+    filter_: NotRequired[str]
+    r"""Filter that selects data to be fed through this Function"""
+    description: NotRequired[str]
+    r"""Simple description of this step"""
+    disabled: NotRequired[bool]
+    r"""If true, data will not be pushed through this function"""
+    final: NotRequired[bool]
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+    group_id: NotRequired[str]
+    r"""Group ID"""
+
+
+class PipelineFunctionFlatten(BaseModel):
+    id: PipelineFunctionFlattenID
+    r"""Function ID"""
+
+    conf: FunctionConfSchemaFlatten
+
+    filter_: Annotated[Optional[str], pydantic.Field(alias="filter")] = "true"
+    r"""Filter that selects data to be fed through this Function"""
+
+    description: Optional[str] = None
+    r"""Simple description of this step"""
+
+    disabled: Optional[bool] = None
+    r"""If true, data will not be pushed through this function"""
+
+    final: Optional[bool] = None
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+
+    group_id: Annotated[Optional[str], pydantic.Field(alias="groupId")] = None
+    r"""Group ID"""

cribl_control_plane/models/pipelinefunctionfoldkeys.py

@@ -0,0 +1,56 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from .functionconfschemafoldkeys import (
+    FunctionConfSchemaFoldkeys,
+    FunctionConfSchemaFoldkeysTypedDict,
+)
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class PipelineFunctionFoldkeysID(str, Enum):
+    r"""Function ID"""
+
+    FOLDKEYS = "foldkeys"
+
+
+class PipelineFunctionFoldkeysTypedDict(TypedDict):
+    id: PipelineFunctionFoldkeysID
+    r"""Function ID"""
+    conf: FunctionConfSchemaFoldkeysTypedDict
+    filter_: NotRequired[str]
+    r"""Filter that selects data to be fed through this Function"""
+    description: NotRequired[str]
+    r"""Simple description of this step"""
+    disabled: NotRequired[bool]
+    r"""If true, data will not be pushed through this function"""
+    final: NotRequired[bool]
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+    group_id: NotRequired[str]
+    r"""Group ID"""
+
+
+class PipelineFunctionFoldkeys(BaseModel):
+    id: PipelineFunctionFoldkeysID
+    r"""Function ID"""
+
+    conf: FunctionConfSchemaFoldkeys
+
+    filter_: Annotated[Optional[str], pydantic.Field(alias="filter")] = "true"
+    r"""Filter that selects data to be fed through this Function"""
+
+    description: Optional[str] = None
+    r"""Simple description of this step"""
+
+    disabled: Optional[bool] = None
+    r"""If true, data will not be pushed through this function"""
+
+    final: Optional[bool] = None
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+
+    group_id: Annotated[Optional[str], pydantic.Field(alias="groupId")] = None
+    r"""Group ID"""

cribl_control_plane/models/pipelinefunctiongenstats.py

@@ -0,0 +1,56 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from .functionconfschemagenstats import (
+    FunctionConfSchemaGenStats,
+    FunctionConfSchemaGenStatsTypedDict,
+)
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class PipelineFunctionGenStatsID(str, Enum):
+    r"""Function ID"""
+
+    GEN_STATS = "gen_stats"
+
+
+class PipelineFunctionGenStatsTypedDict(TypedDict):
+    id: PipelineFunctionGenStatsID
+    r"""Function ID"""
+    conf: FunctionConfSchemaGenStatsTypedDict
+    filter_: NotRequired[str]
+    r"""Filter that selects data to be fed through this Function"""
+    description: NotRequired[str]
+    r"""Simple description of this step"""
+    disabled: NotRequired[bool]
+    r"""If true, data will not be pushed through this function"""
+    final: NotRequired[bool]
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+    group_id: NotRequired[str]
+    r"""Group ID"""
+
+
+class PipelineFunctionGenStats(BaseModel):
+    id: PipelineFunctionGenStatsID
+    r"""Function ID"""
+
+    conf: FunctionConfSchemaGenStats
+
+    filter_: Annotated[Optional[str], pydantic.Field(alias="filter")] = "true"
+    r"""Filter that selects data to be fed through this Function"""
+
+    description: Optional[str] = None
+    r"""Simple description of this step"""
+
+    disabled: Optional[bool] = None
+    r"""If true, data will not be pushed through this function"""
+
+    final: Optional[bool] = None
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+
+    group_id: Annotated[Optional[str], pydantic.Field(alias="groupId")] = None
+    r"""Group ID"""

cribl_control_plane/models/pipelinefunctiongeoip.py

@@ -0,0 +1,109 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class PipelineFunctionGeoipID(str, Enum):
+    r"""Function ID"""
+
+    GEOIP = "geoip"
+
+
+class PipelineFunctionGeoipAdditionalFieldTypedDict(TypedDict):
+    extra_in_field: str
+    r"""Field name in which to find an IP to look up. Can be nested."""
+    extra_out_field: str
+    r"""Field name in which to store the GeoIP lookup results"""
+
+
+class PipelineFunctionGeoipAdditionalField(BaseModel):
+    extra_in_field: Annotated[str, pydantic.Field(alias="extraInField")]
+    r"""Field name in which to find an IP to look up. Can be nested."""
+
+    extra_out_field: Annotated[str, pydantic.Field(alias="extraOutField")]
+    r"""Field name in which to store the GeoIP lookup results"""
+
+
+class PipelineFunctionGeoipOutputFieldMappingsTypedDict(TypedDict):
+    r"""Search-specific mappings for granular control over event enrichment"""
+
+
+class PipelineFunctionGeoipOutputFieldMappings(BaseModel):
+    r"""Search-specific mappings for granular control over event enrichment"""
+
+
+class PipelineFunctionGeoipConfTypedDict(TypedDict):
+    file: str
+    r"""Select an uploaded Maxmind database, or specify path to a Maxmind database with .mmdb extension"""
+    in_field: NotRequired[str]
+    r"""Field name in which to find an IP to look up. Can be nested."""
+    out_field: NotRequired[str]
+    r"""Field name in which to store the GeoIP lookup results"""
+    additional_fields: NotRequired[List[PipelineFunctionGeoipAdditionalFieldTypedDict]]
+    out_field_mappings: NotRequired[PipelineFunctionGeoipOutputFieldMappingsTypedDict]
+    r"""Search-specific mappings for granular control over event enrichment"""
+
+
+class PipelineFunctionGeoipConf(BaseModel):
+    file: str
+    r"""Select an uploaded Maxmind database, or specify path to a Maxmind database with .mmdb extension"""
+
+    in_field: Annotated[Optional[str], pydantic.Field(alias="inField")] = "ip"
+    r"""Field name in which to find an IP to look up. Can be nested."""
+
+    out_field: Annotated[Optional[str], pydantic.Field(alias="outField")] = "geoip"
+    r"""Field name in which to store the GeoIP lookup results"""
+
+    additional_fields: Annotated[
+        Optional[List[PipelineFunctionGeoipAdditionalField]],
+        pydantic.Field(alias="additionalFields"),
+    ] = None
+
+    out_field_mappings: Annotated[
+        Optional[PipelineFunctionGeoipOutputFieldMappings],
+        pydantic.Field(alias="outFieldMappings"),
+    ] = None
+    r"""Search-specific mappings for granular control over event enrichment"""
+
+
+class PipelineFunctionGeoipTypedDict(TypedDict):
+    id: PipelineFunctionGeoipID
+    r"""Function ID"""
+    conf: PipelineFunctionGeoipConfTypedDict
+    filter_: NotRequired[str]
+    r"""Filter that selects data to be fed through this Function"""
+    description: NotRequired[str]
+    r"""Simple description of this step"""
+    disabled: NotRequired[bool]
+    r"""If true, data will not be pushed through this function"""
+    final: NotRequired[bool]
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+    group_id: NotRequired[str]
+    r"""Group ID"""
+
+
+class PipelineFunctionGeoip(BaseModel):
+    id: PipelineFunctionGeoipID
+    r"""Function ID"""
+
+    conf: PipelineFunctionGeoipConf
+
+    filter_: Annotated[Optional[str], pydantic.Field(alias="filter")] = "true"
+    r"""Filter that selects data to be fed through this Function"""
+
+    description: Optional[str] = None
+    r"""Simple description of this step"""
+
+    disabled: Optional[bool] = None
+    r"""If true, data will not be pushed through this function"""
+
+    final: Optional[bool] = None
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+
+    group_id: Annotated[Optional[str], pydantic.Field(alias="groupId")] = None
+    r"""Group ID"""