cribl-control-plane 0.4.0b23__py3-none-any.whl → 0.5.0b3__py3-none-any.whl

cribl_control_plane/models/functionconfschemagenstats.py

@@ -0,0 +1,14 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from typing import List, Optional
+from typing_extensions import NotRequired, TypedDict
+
+
+class FunctionConfSchemaGenStatsTypedDict(TypedDict):
+    fields: NotRequired[List[str]]
+
+
+class FunctionConfSchemaGenStats(BaseModel):
+    fields: Optional[List[str]] = None

cribl_control_plane/models/functionconfschemageoip.py

@@ -0,0 +1,66 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaGeoipAdditionalFieldTypedDict(TypedDict):
+    extra_in_field: str
+    r"""Field name in which to find an IP to look up. Can be nested."""
+    extra_out_field: str
+    r"""Field name in which to store the GeoIP lookup results"""
+
+
+class FunctionConfSchemaGeoipAdditionalField(BaseModel):
+    extra_in_field: Annotated[str, pydantic.Field(alias="extraInField")]
+    r"""Field name in which to find an IP to look up. Can be nested."""
+
+    extra_out_field: Annotated[str, pydantic.Field(alias="extraOutField")]
+    r"""Field name in which to store the GeoIP lookup results"""
+
+
+class FunctionConfSchemaGeoipOutputFieldMappingsTypedDict(TypedDict):
+    r"""Search-specific mappings for granular control over event enrichment"""
+
+
+class FunctionConfSchemaGeoipOutputFieldMappings(BaseModel):
+    r"""Search-specific mappings for granular control over event enrichment"""
+
+
+class FunctionConfSchemaGeoipTypedDict(TypedDict):
+    file: NotRequired[str]
+    r"""Select an uploaded Maxmind database, or specify path to a Maxmind database with .mmdb extension"""
+    in_field: NotRequired[str]
+    r"""Field name in which to find an IP to look up. Can be nested."""
+    out_field: NotRequired[str]
+    r"""Field name in which to store the GeoIP lookup results"""
+    additional_fields: NotRequired[
+        List[FunctionConfSchemaGeoipAdditionalFieldTypedDict]
+    ]
+    out_field_mappings: NotRequired[FunctionConfSchemaGeoipOutputFieldMappingsTypedDict]
+    r"""Search-specific mappings for granular control over event enrichment"""
+
+
+class FunctionConfSchemaGeoip(BaseModel):
+    file: Optional[str] = None
+    r"""Select an uploaded Maxmind database, or specify path to a Maxmind database with .mmdb extension"""
+
+    in_field: Annotated[Optional[str], pydantic.Field(alias="inField")] = "ip"
+    r"""Field name in which to find an IP to look up. Can be nested."""
+
+    out_field: Annotated[Optional[str], pydantic.Field(alias="outField")] = "geoip"
+    r"""Field name in which to store the GeoIP lookup results"""
+
+    additional_fields: Annotated[
+        Optional[List[FunctionConfSchemaGeoipAdditionalField]],
+        pydantic.Field(alias="additionalFields"),
+    ] = None
+
+    out_field_mappings: Annotated[
+        Optional[FunctionConfSchemaGeoipOutputFieldMappings],
+        pydantic.Field(alias="outFieldMappings"),
+    ] = None
+    r"""Search-specific mappings for granular control over event enrichment"""

cribl_control_plane/models/functionconfschemagrok.py

@@ -0,0 +1,38 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaGrokPatternListTypedDict(TypedDict):
+    pattern: str
+    r"""Grok pattern to extract fields. Syntax supported: %{PATTERN_NAME:FIELD_NAME}"""
+
+
+class FunctionConfSchemaGrokPatternList(BaseModel):
+    pattern: str
+    r"""Grok pattern to extract fields. Syntax supported: %{PATTERN_NAME:FIELD_NAME}"""
+
+
+class FunctionConfSchemaGrokTypedDict(TypedDict):
+    pattern: NotRequired[str]
+    r"""Grok pattern to extract fields. Syntax supported: %{PATTERN_NAME:FIELD_NAME}"""
+    pattern_list: NotRequired[List[FunctionConfSchemaGrokPatternListTypedDict]]
+    source: NotRequired[str]
+    r"""Field on which to perform Grok extractions"""
+
+
+class FunctionConfSchemaGrok(BaseModel):
+    pattern: Optional[str] = None
+    r"""Grok pattern to extract fields. Syntax supported: %{PATTERN_NAME:FIELD_NAME}"""
+
+    pattern_list: Annotated[
+        Optional[List[FunctionConfSchemaGrokPatternList]],
+        pydantic.Field(alias="patternList"),
+    ] = None
+
+    source: Optional[str] = "_raw"
+    r"""Field on which to perform Grok extractions"""

cribl_control_plane/models/functionconfschemahandlebar.py

@@ -0,0 +1,56 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import Dict, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaHandlebarTemplateDefinitionTypedDict(TypedDict):
+    content: str
+    r"""Handlebars template string"""
+    description: NotRequired[str]
+    r"""Optional description of what this template is used for"""
+    type: NotRequired[str]
+    r"""Type categorization for the template (e.g., Universal, Email, Slack)"""
+
+
+class FunctionConfSchemaHandlebarTemplateDefinition(BaseModel):
+    content: str
+    r"""Handlebars template string"""
+
+    description: Optional[str] = None
+    r"""Optional description of what this template is used for"""
+
+    type: Optional[str] = "Universal"
+    r"""Type categorization for the template (e.g., Universal, Email, Slack)"""
+
+
+class FunctionConfSchemaHandlebarTypedDict(TypedDict):
+    templates: NotRequired[
+        Dict[str, FunctionConfSchemaHandlebarTemplateDefinitionTypedDict]
+    ]
+    r"""Object with template_id as keys and template definitions as values. Uses event.__template_id to select template at runtime."""
+    target_field: NotRequired[str]
+    r"""Field name to store the rendered template result. Defaults to _raw."""
+    parse_json: NotRequired[bool]
+    r"""Parse the rendered template as JSON and store as an object instead of a string. Useful for building structured data like Slack blocks."""
+    remove_on_null: NotRequired[bool]
+    r"""Remove the target field if the rendered result is empty or null."""
+
+
+class FunctionConfSchemaHandlebar(BaseModel):
+    templates: Optional[Dict[str, FunctionConfSchemaHandlebarTemplateDefinition]] = None
+    r"""Object with template_id as keys and template definitions as values. Uses event.__template_id to select template at runtime."""
+
+    target_field: Annotated[Optional[str], pydantic.Field(alias="targetField")] = "_raw"
+    r"""Field name to store the rendered template result. Defaults to _raw."""
+
+    parse_json: Annotated[Optional[bool], pydantic.Field(alias="parseJson")] = False
+    r"""Parse the rendered template as JSON and store as an object instead of a string. Useful for building structured data like Slack blocks."""
+
+    remove_on_null: Annotated[Optional[bool], pydantic.Field(alias="removeOnNull")] = (
+        True
+    )
+    r"""Remove the target field if the rendered result is empty or null."""

cribl_control_plane/models/functionconfschemajoin.py

@@ -0,0 +1,55 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import Dict, List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaJoinFieldConditionTypedDict(TypedDict):
+    left_field_name: str
+    r"""The field name to join on, on the left side."""
+    right_field_name: str
+    r"""The field name on the right side of the data, i.e. the stage results, that we are joining with"""
+
+
+class FunctionConfSchemaJoinFieldCondition(BaseModel):
+    left_field_name: Annotated[str, pydantic.Field(alias="leftFieldName")]
+    r"""The field name to join on, on the left side."""
+
+    right_field_name: Annotated[str, pydantic.Field(alias="rightFieldName")]
+    r"""The field name on the right side of the data, i.e. the stage results, that we are joining with"""
+
+
+class FunctionConfSchemaJoinTypedDict(TypedDict):
+    kind: NotRequired[str]
+    r"""Join kind, e.g. inner"""
+    hints: NotRequired[Dict[str, str]]
+    r"""Hints passed to the join function"""
+    field_conditions: NotRequired[List[FunctionConfSchemaJoinFieldConditionTypedDict]]
+    r"""Fields to use when joining"""
+    search_job_id: NotRequired[str]
+    r"""The id for this search job."""
+    stage_id: NotRequired[str]
+    r"""The stage we are joining with."""
+
+
+class FunctionConfSchemaJoin(BaseModel):
+    kind: Optional[str] = None
+    r"""Join kind, e.g. inner"""
+
+    hints: Optional[Dict[str, str]] = None
+    r"""Hints passed to the join function"""
+
+    field_conditions: Annotated[
+        Optional[List[FunctionConfSchemaJoinFieldCondition]],
+        pydantic.Field(alias="fieldConditions"),
+    ] = None
+    r"""Fields to use when joining"""
+
+    search_job_id: Annotated[Optional[str], pydantic.Field(alias="searchJobId")] = None
+    r"""The id for this search job."""
+
+    stage_id: Annotated[Optional[str], pydantic.Field(alias="stageId")] = None
+    r"""The stage we are joining with."""

cribl_control_plane/models/functionconfschemajsonunroll.py

@@ -0,0 +1,21 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from typing import Optional
+from typing_extensions import NotRequired, TypedDict
+
+
+class FunctionConfSchemaJSONUnrollTypedDict(TypedDict):
+    path: NotRequired[str]
+    r"""Path to array to unroll, such as foo.0.bar"""
+    name: NotRequired[str]
+    r"""Name of each exploded array element in each new event. Leave empty to expand the array element with its original name."""
+
+
+class FunctionConfSchemaJSONUnroll(BaseModel):
+    path: Optional[str] = None
+    r"""Path to array to unroll, such as foo.0.bar"""
+
+    name: Optional[str] = None
+    r"""Name of each exploded array element in each new event. Leave empty to expand the array element with its original name."""

cribl_control_plane/models/functionconfschemalakeexport.py

@@ -0,0 +1,44 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaLakeExportTypedDict(TypedDict):
+    search_job_id: NotRequired[str]
+    r"""Id of the search job this function is running on."""
+    dataset: NotRequired[str]
+    r"""Name of the dataset"""
+    lake: NotRequired[str]
+    r"""Name of the lake"""
+    tee: NotRequired[str]
+    r"""Tee results to search. When set to true results will be shipped instead of stats"""
+    flush_ms: NotRequired[float]
+    r"""How often are stats flushed in ms"""
+    suppress_previews: NotRequired[bool]
+    r"""Disables generation of intermediate stats. When true stats will be emitted only on end"""
+
+
+class FunctionConfSchemaLakeExport(BaseModel):
+    search_job_id: Annotated[Optional[str], pydantic.Field(alias="searchJobId")] = None
+    r"""Id of the search job this function is running on."""
+
+    dataset: Optional[str] = None
+    r"""Name of the dataset"""
+
+    lake: Optional[str] = "default"
+    r"""Name of the lake"""
+
+    tee: Optional[str] = "false"
+    r"""Tee results to search. When set to true results will be shipped instead of stats"""
+
+    flush_ms: Annotated[Optional[float], pydantic.Field(alias="flushMs")] = 1000
+    r"""How often are stats flushed in ms"""
+
+    suppress_previews: Annotated[
+        Optional[bool], pydantic.Field(alias="suppressPreviews")
+    ] = None
+    r"""Disables generation of intermediate stats. When true stats will be emitted only on end"""

cribl_control_plane/models/functionconfschemalimit.py

@@ -0,0 +1,16 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from typing import Optional
+from typing_extensions import NotRequired, TypedDict
+
+
+class FunctionConfSchemaLimitTypedDict(TypedDict):
+    limit: NotRequired[int]
+    r"""Number of qualifying events to pass through"""
+
+
+class FunctionConfSchemaLimit(BaseModel):
+    limit: Optional[int] = 100
+    r"""Number of qualifying events to pass through"""

cribl_control_plane/models/functionconfschemalocalsearchdatatypeparser.py

@@ -0,0 +1,17 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaLocalSearchDatatypeParserTypedDict(TypedDict):
+    ruleset_id: NotRequired[str]
+    r"""ID of the local search datatype ruleset"""
+
+
+class FunctionConfSchemaLocalSearchDatatypeParser(BaseModel):
+    ruleset_id: Annotated[Optional[str], pydantic.Field(alias="rulesetId")] = None
+    r"""ID of the local search datatype ruleset"""

cribl_control_plane/models/functionconfschemalocalsearchrulesetrunner.py

@@ -0,0 +1,40 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane import models, utils
+from cribl_control_plane.types import BaseModel
+from cribl_control_plane.utils import validate_open_enum
+from enum import Enum
+import pydantic
+from pydantic import field_serializer
+from pydantic.functional_validators import PlainValidator
+from typing import Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class RulesetType(str, Enum, metaclass=utils.OpenEnumMeta):
+    DATASET = "dataset"
+    DATATYPE = "datatype"
+
+
+class FunctionConfSchemaLocalSearchRulesetRunnerTypedDict(TypedDict):
+    ruleset_type: NotRequired[RulesetType]
+    ruleset_id: NotRequired[str]
+
+
+class FunctionConfSchemaLocalSearchRulesetRunner(BaseModel):
+    ruleset_type: Annotated[
+        Annotated[Optional[RulesetType], PlainValidator(validate_open_enum(False))],
+        pydantic.Field(alias="rulesetType"),
+    ] = None
+
+    ruleset_id: Annotated[Optional[str], pydantic.Field(alias="rulesetId")] = None
+
+    @field_serializer("ruleset_type")
+    def serialize_ruleset_type(self, value):
+        if isinstance(value, str):
+            try:
+                return models.RulesetType(value)
+            except ValueError:
+                return value
+        return value

cribl_control_plane/models/functionconfschemalookup.py

@@ -0,0 +1,92 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import Any, List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaLookupInFieldTypedDict(TypedDict):
+    event_field: str
+    r"""Field name as it appears in events"""
+    lookup_field: NotRequired[str]
+    r"""Optional: The field name as it appears in the lookup file. Defaults to event field name"""
+
+
+class FunctionConfSchemaLookupInField(BaseModel):
+    event_field: Annotated[str, pydantic.Field(alias="eventField")]
+    r"""Field name as it appears in events"""
+
+    lookup_field: Annotated[Optional[str], pydantic.Field(alias="lookupField")] = None
+    r"""Optional: The field name as it appears in the lookup file. Defaults to event field name"""
+
+
+class FunctionConfSchemaLookupOutFieldTypedDict(TypedDict):
+    lookup_field: str
+    r"""The field name as it appears in the lookup file"""
+    event_field: NotRequired[str]
+    r"""Optional: Field name to add to event. Defaults to lookup field name."""
+    default_value: NotRequired[str]
+    r"""Optional: Value to assign if lookup entry is not found"""
+
+
+class FunctionConfSchemaLookupOutField(BaseModel):
+    lookup_field: Annotated[str, pydantic.Field(alias="lookupField")]
+    r"""The field name as it appears in the lookup file"""
+
+    event_field: Annotated[Optional[str], pydantic.Field(alias="eventField")] = None
+    r"""Optional: Field name to add to event. Defaults to lookup field name."""
+
+    default_value: Annotated[Optional[str], pydantic.Field(alias="defaultValue")] = None
+    r"""Optional: Value to assign if lookup entry is not found"""
+
+
+class FunctionConfSchemaLookupTypedDict(TypedDict):
+    file: NotRequired[str]
+    r"""Path to the lookup file. Reference environment variables via $. Example: $HOME/file.csv"""
+    db_lookup: NotRequired[bool]
+    r"""Enable to use a disk-based lookup. This option displays only the settings relevant to disk-based mode and hides those for in-memory lookups."""
+    match_mode: NotRequired[Any]
+    match_type: NotRequired[Any]
+    reload_period_sec: NotRequired[Any]
+    in_fields: NotRequired[List[FunctionConfSchemaLookupInFieldTypedDict]]
+    r"""Fields that should be used to key into the lookup table"""
+    out_fields: NotRequired[List[FunctionConfSchemaLookupOutFieldTypedDict]]
+    r"""Fields to add to events after matching lookup. Defaults to all if not specified."""
+    add_to_event: NotRequired[bool]
+    r"""Add the looked-up values to _raw, as key=value pairs"""
+    ignore_case: NotRequired[Any]
+
+
+class FunctionConfSchemaLookup(BaseModel):
+    file: Optional[str] = None
+    r"""Path to the lookup file. Reference environment variables via $. Example: $HOME/file.csv"""
+
+    db_lookup: Annotated[Optional[bool], pydantic.Field(alias="dbLookup")] = False
+    r"""Enable to use a disk-based lookup. This option displays only the settings relevant to disk-based mode and hides those for in-memory lookups."""
+
+    match_mode: Annotated[Optional[Any], pydantic.Field(alias="matchMode")] = None
+
+    match_type: Annotated[Optional[Any], pydantic.Field(alias="matchType")] = None
+
+    reload_period_sec: Annotated[
+        Optional[Any], pydantic.Field(alias="reloadPeriodSec")
+    ] = None
+
+    in_fields: Annotated[
+        Optional[List[FunctionConfSchemaLookupInField]],
+        pydantic.Field(alias="inFields"),
+    ] = None
+    r"""Fields that should be used to key into the lookup table"""
+
+    out_fields: Annotated[
+        Optional[List[FunctionConfSchemaLookupOutField]],
+        pydantic.Field(alias="outFields"),
+    ] = None
+    r"""Fields to add to events after matching lookup. Defaults to all if not specified."""
+
+    add_to_event: Annotated[Optional[bool], pydantic.Field(alias="addToEvent")] = False
+    r"""Add the looked-up values to _raw, as key=value pairs"""
+
+    ignore_case: Annotated[Optional[Any], pydantic.Field(alias="ignoreCase")] = None

cribl_control_plane/models/functionconfschemamask.py

@@ -0,0 +1,63 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaMaskRuleTypedDict(TypedDict):
+    match_regex: str
+    r"""Pattern to replace. Use /g to replace all matches."""
+    replace_expr: NotRequired[str]
+    r"""A JavaScript expression or literal to replace the matching content. Capturing groups can be referenced as g1, g2, and so on, and event fields as event.<fieldName>."""
+    disabled: NotRequired[bool]
+    r"""Set to No to disable the evaluation of an individual rule"""
+
+
+class FunctionConfSchemaMaskRule(BaseModel):
+    match_regex: Annotated[str, pydantic.Field(alias="matchRegex")]
+    r"""Pattern to replace. Use /g to replace all matches."""
+
+    replace_expr: Annotated[Optional[str], pydantic.Field(alias="replaceExpr")] = "''"
+    r"""A JavaScript expression or literal to replace the matching content. Capturing groups can be referenced as g1, g2, and so on, and event fields as event.<fieldName>."""
+
+    disabled: Optional[bool] = False
+    r"""Set to No to disable the evaluation of an individual rule"""
+
+
+class FunctionConfSchemaMaskFlagTypedDict(TypedDict):
+    value: str
+    r"""JavaScript expression to compute the value (can be constant)"""
+    name: NotRequired[str]
+
+
+class FunctionConfSchemaMaskFlag(BaseModel):
+    value: str
+    r"""JavaScript expression to compute the value (can be constant)"""
+
+    name: Optional[str] = None
+
+
+class FunctionConfSchemaMaskTypedDict(TypedDict):
+    rules: NotRequired[List[FunctionConfSchemaMaskRuleTypedDict]]
+    fields: NotRequired[List[str]]
+    r"""Fields on which to apply the masking rules. Supports * wildcards, except when used on internal fields."""
+    depth: NotRequired[int]
+    r"""Depth to which the Mask Function will search for fields to mask"""
+    flags: NotRequired[List[FunctionConfSchemaMaskFlagTypedDict]]
+    r"""Fields to evaluate if one or more masking rules are matched"""
+
+
+class FunctionConfSchemaMask(BaseModel):
+    rules: Optional[List[FunctionConfSchemaMaskRule]] = None
+
+    fields: Optional[List[str]] = None
+    r"""Fields on which to apply the masking rules. Supports * wildcards, except when used on internal fields."""
+
+    depth: Optional[int] = 5
+    r"""Depth to which the Mask Function will search for fields to mask"""
+
+    flags: Optional[List[FunctionConfSchemaMaskFlag]] = None
+    r"""Fields to evaluate if one or more masking rules are matched"""

cribl_control_plane/models/functionconfschemamvexpand.py

@@ -0,0 +1,76 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane import models, utils
+from cribl_control_plane.types import BaseModel
+from cribl_control_plane.utils import validate_open_enum
+from enum import Enum
+import pydantic
+from pydantic import field_serializer
+from pydantic.functional_validators import PlainValidator
+from typing import List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaMvExpandBagExpansionMode(
+    str, Enum, metaclass=utils.OpenEnumMeta
+):
+    r"""decides if bag-values are expanded to bags or arrays"""
+
+    # Store as object
+    BAG = "bag"
+    # Store as array
+    ARRAY = "array"
+
+
+class FunctionConfSchemaMvExpandTypedDict(TypedDict):
+    source_fields: NotRequired[List[str]]
+    r"""Array of property-/field-names to expand"""
+    target_names: NotRequired[List[str]]
+    r"""stores the value as new target field name"""
+    row_limit: NotRequired[float]
+    r"""max. number of rows generated out of every source events"""
+    item_index_name: NotRequired[str]
+    r"""name of an optional index property generated into the output"""
+    bag_expansion_mode: NotRequired[FunctionConfSchemaMvExpandBagExpansionMode]
+    r"""decides if bag-values are expanded to bags or arrays"""
+
+
+class FunctionConfSchemaMvExpand(BaseModel):
+    source_fields: Annotated[
+        Optional[List[str]], pydantic.Field(alias="sourceFields")
+    ] = None
+    r"""Array of property-/field-names to expand"""
+
+    target_names: Annotated[
+        Optional[List[str]], pydantic.Field(alias="targetNames")
+    ] = None
+    r"""stores the value as new target field name"""
+
+    row_limit: Annotated[Optional[float], pydantic.Field(alias="rowLimit")] = (
+        9007199254740991
+    )
+    r"""max. number of rows generated out of every source events"""
+
+    item_index_name: Annotated[Optional[str], pydantic.Field(alias="itemIndexName")] = (
+        None
+    )
+    r"""name of an optional index property generated into the output"""
+
+    bag_expansion_mode: Annotated[
+        Annotated[
+            Optional[FunctionConfSchemaMvExpandBagExpansionMode],
+            PlainValidator(validate_open_enum(False)),
+        ],
+        pydantic.Field(alias="bagExpansionMode"),
+    ] = FunctionConfSchemaMvExpandBagExpansionMode.BAG
+    r"""decides if bag-values are expanded to bags or arrays"""
+
+    @field_serializer("bag_expansion_mode")
+    def serialize_bag_expansion_mode(self, value):
+        if isinstance(value, str):
+            try:
+                return models.FunctionConfSchemaMvExpandBagExpansionMode(value)
+            except ValueError:
+                return value
+        return value

cribl_control_plane/models/functionconfschemamvpull.py

@@ -0,0 +1,45 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaMvPullTypedDict(TypedDict):
+    array_path: NotRequired[str]
+    r"""Field name of the array within events that contains the data objects of interest. Can be a path."""
+    relative_key_path: NotRequired[str]
+    r"""Extract the K-V pair's key from this field, relative to the data object."""
+    relative_value_path: NotRequired[str]
+    r"""Extract the K-V pair's value from this field, relative to the data object."""
+    target_bag_path: NotRequired[str]
+    r"""Optionally, specify a bag as the target for K-V entries. If not specified, these entries are stored on each top-level event."""
+    delete_original: NotRequired[bool]
+    r"""Toggle this on to remove each original array of data objects after extraction. If toggled off, arrays are retained."""
+
+
+class FunctionConfSchemaMvPull(BaseModel):
+    array_path: Annotated[Optional[str], pydantic.Field(alias="arrayPath")] = None
+    r"""Field name of the array within events that contains the data objects of interest. Can be a path."""
+
+    relative_key_path: Annotated[
+        Optional[str], pydantic.Field(alias="relativeKeyPath")
+    ] = None
+    r"""Extract the K-V pair's key from this field, relative to the data object."""
+
+    relative_value_path: Annotated[
+        Optional[str], pydantic.Field(alias="relativeValuePath")
+    ] = None
+    r"""Extract the K-V pair's value from this field, relative to the data object."""
+
+    target_bag_path: Annotated[Optional[str], pydantic.Field(alias="targetBagPath")] = (
+        None
+    )
+    r"""Optionally, specify a bag as the target for K-V entries. If not specified, these entries are stored on each top-level event."""
+
+    delete_original: Annotated[
+        Optional[bool], pydantic.Field(alias="deleteOriginal")
+    ] = False
+    r"""Toggle this on to remove each original array of data objects after extraction. If toggled off, arrays are retained."""