cribl-control-plane 0.4.0b23__py3-none-any.whl → 0.5.0b3__py3-none-any.whl

cribl_control_plane/models/functionconfschemaredis.py

@@ -0,0 +1,121 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane import models, utils
+from cribl_control_plane.types import BaseModel
+from cribl_control_plane.utils import validate_open_enum
+from enum import Enum
+import pydantic
+from pydantic import field_serializer
+from pydantic.functional_validators import PlainValidator
+from typing import List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaRedisCommandTypedDict(TypedDict):
+    command: str
+    r"""Redis command to perform. For a complete list visit: https://redis.io/commands"""
+    key_expr: str
+    r"""A JavaScript expression to compute the value of the key to operate on. Can also be a constant such as 'username'."""
+    out_field: NotRequired[str]
+    r"""Name of the field in which to store the returned value. Leave blank to discard returned value."""
+    args_expr: NotRequired[str]
+    r"""A JavaScript expression to compute arguments to the operation. Can return an array."""
+
+
+class FunctionConfSchemaRedisCommand(BaseModel):
+    command: str
+    r"""Redis command to perform. For a complete list visit: https://redis.io/commands"""
+
+    key_expr: Annotated[str, pydantic.Field(alias="keyExpr")]
+    r"""A JavaScript expression to compute the value of the key to operate on. Can also be a constant such as 'username'."""
+
+    out_field: Annotated[Optional[str], pydantic.Field(alias="outField")] = None
+    r"""Name of the field in which to store the returned value. Leave blank to discard returned value."""
+
+    args_expr: Annotated[Optional[str], pydantic.Field(alias="argsExpr")] = None
+    r"""A JavaScript expression to compute arguments to the operation. Can return an array."""
+
+
+class FunctionConfSchemaRedisDeploymentType(str, Enum, metaclass=utils.OpenEnumMeta):
+    r"""How the Redis server is configured. Defaults to Standalone"""
+
+    # Standalone
+    STANDALONE = "standalone"
+    # Cluster
+    CLUSTER = "cluster"
+    # Sentinel
+    SENTINEL = "sentinel"
+
+
+class FunctionConfSchemaRedisAuthenticationMethod(
+    str, Enum, metaclass=utils.OpenEnumMeta
+):
+    # None
+    NONE = "none"
+    # Manual
+    MANUAL = "manual"
+    # User Secret
+    CREDENTIALS_SECRET = "credentialsSecret"
+    # Admin Secret
+    TEXT_SECRET = "textSecret"
+
+
+class FunctionConfSchemaRedisTypedDict(TypedDict):
+    commands: NotRequired[List[FunctionConfSchemaRedisCommandTypedDict]]
+    deployment_type: NotRequired[FunctionConfSchemaRedisDeploymentType]
+    r"""How the Redis server is configured. Defaults to Standalone"""
+    auth_type: NotRequired[FunctionConfSchemaRedisAuthenticationMethod]
+    max_block_secs: NotRequired[float]
+    r"""Maximum amount of time (seconds) to wait before assuming that Redis is down and passing events through. Use 0 to disable."""
+    enable_client_side_caching: NotRequired[bool]
+    r"""Enable client-side cache. Redundant when using Redis write operations. See more options at Settings > General > Limits > Redis Cache."""
+
+
+class FunctionConfSchemaRedis(BaseModel):
+    commands: Optional[List[FunctionConfSchemaRedisCommand]] = None
+
+    deployment_type: Annotated[
+        Annotated[
+            Optional[FunctionConfSchemaRedisDeploymentType],
+            PlainValidator(validate_open_enum(False)),
+        ],
+        pydantic.Field(alias="deploymentType"),
+    ] = FunctionConfSchemaRedisDeploymentType.STANDALONE
+    r"""How the Redis server is configured. Defaults to Standalone"""
+
+    auth_type: Annotated[
+        Annotated[
+            Optional[FunctionConfSchemaRedisAuthenticationMethod],
+            PlainValidator(validate_open_enum(False)),
+        ],
+        pydantic.Field(alias="authType"),
+    ] = FunctionConfSchemaRedisAuthenticationMethod.NONE
+
+    max_block_secs: Annotated[Optional[float], pydantic.Field(alias="maxBlockSecs")] = (
+        60
+    )
+    r"""Maximum amount of time (seconds) to wait before assuming that Redis is down and passing events through. Use 0 to disable."""
+
+    enable_client_side_caching: Annotated[
+        Optional[bool], pydantic.Field(alias="enableClientSideCaching")
+    ] = None
+    r"""Enable client-side cache. Redundant when using Redis write operations. See more options at Settings > General > Limits > Redis Cache."""
+
+    @field_serializer("deployment_type")
+    def serialize_deployment_type(self, value):
+        if isinstance(value, str):
+            try:
+                return models.FunctionConfSchemaRedisDeploymentType(value)
+            except ValueError:
+                return value
+        return value
+
+    @field_serializer("auth_type")
+    def serialize_auth_type(self, value):
+        if isinstance(value, str):
+            try:
+                return models.FunctionConfSchemaRedisAuthenticationMethod(value)
+            except ValueError:
+                return value
+        return value

cribl_control_plane/models/functionconfschemaregexextract.py

@@ -0,0 +1,55 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaRegexExtractRegexListTypedDict(TypedDict):
+    regex: str
+    r"""Regex literal with named capturing groups, such as (?<foo>bar), or _NAME_ and _VALUE_ capturing groups, such as (?<_NAME_0>[^ =]+)=(?<_VALUE_0>[^,]+)"""
+
+
+class FunctionConfSchemaRegexExtractRegexList(BaseModel):
+    regex: str
+    r"""Regex literal with named capturing groups, such as (?<foo>bar), or _NAME_ and _VALUE_ capturing groups, such as (?<_NAME_0>[^ =]+)=(?<_VALUE_0>[^,]+)"""
+
+
+class FunctionConfSchemaRegexExtractTypedDict(TypedDict):
+    regex: NotRequired[str]
+    r"""Regex literal with named capturing groups, such as (?<foo>bar), or _NAME_ and _VALUE_ capturing groups, such as (?<_NAME_0>[^ =]+)=(?<_VALUE_0>[^,]+)"""
+    regex_list: NotRequired[List[FunctionConfSchemaRegexExtractRegexListTypedDict]]
+    source: NotRequired[str]
+    r"""Field on which to perform regex field extraction"""
+    iterations: NotRequired[float]
+    r"""The maximum number of times to apply regex to source field when the global flag is set, or when using _NAME_ and _VALUE_ capturing groups"""
+    field_name_expression: NotRequired[str]
+    r"""JavaScript expression to format field names when _NAME_n and _VALUE_n capturing groups are used. Original field name is in global variable 'name'. Example: To append XX to all field names, use `${name}_XX` (backticks are literal). If empty, names will be sanitized using this regex: /^[_0-9]+|[^a-zA-Z0-9_]+/g. You can access other fields values via __e.<fieldName>."""
+    overwrite: NotRequired[bool]
+    r"""Overwrite existing event fields with extracted values. If disabled, existing fields will be converted to an array."""
+
+
+class FunctionConfSchemaRegexExtract(BaseModel):
+    regex: Optional[str] = None
+    r"""Regex literal with named capturing groups, such as (?<foo>bar), or _NAME_ and _VALUE_ capturing groups, such as (?<_NAME_0>[^ =]+)=(?<_VALUE_0>[^,]+)"""
+
+    regex_list: Annotated[
+        Optional[List[FunctionConfSchemaRegexExtractRegexList]],
+        pydantic.Field(alias="regexList"),
+    ] = None
+
+    source: Optional[str] = "_raw"
+    r"""Field on which to perform regex field extraction"""
+
+    iterations: Optional[float] = 100
+    r"""The maximum number of times to apply regex to source field when the global flag is set, or when using _NAME_ and _VALUE_ capturing groups"""
+
+    field_name_expression: Annotated[
+        Optional[str], pydantic.Field(alias="fieldNameExpression")
+    ] = None
+    r"""JavaScript expression to format field names when _NAME_n and _VALUE_n capturing groups are used. Original field name is in global variable 'name'. Example: To append XX to all field names, use `${name}_XX` (backticks are literal). If empty, names will be sanitized using this regex: /^[_0-9]+|[^a-zA-Z0-9_]+/g. You can access other fields values via __e.<fieldName>."""
+
+    overwrite: Optional[bool] = False
+    r"""Overwrite existing event fields with extracted values. If disabled, existing fields will be converted to an array."""

cribl_control_plane/models/functionconfschemaregexfilter.py

@@ -0,0 +1,38 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaRegexFilterRegexListTypedDict(TypedDict):
+    regex: str
+    r"""Regex to test against"""
+
+
+class FunctionConfSchemaRegexFilterRegexList(BaseModel):
+    regex: str
+    r"""Regex to test against"""
+
+
+class FunctionConfSchemaRegexFilterTypedDict(TypedDict):
+    regex: NotRequired[str]
+    r"""Regex to test against"""
+    regex_list: NotRequired[List[FunctionConfSchemaRegexFilterRegexListTypedDict]]
+    field: NotRequired[str]
+    r"""Name of the field to apply the regex on (defaults to _raw)"""
+
+
+class FunctionConfSchemaRegexFilter(BaseModel):
+    regex: Optional[str] = None
+    r"""Regex to test against"""
+
+    regex_list: Annotated[
+        Optional[List[FunctionConfSchemaRegexFilterRegexList]],
+        pydantic.Field(alias="regexList"),
+    ] = None
+
+    field: Optional[str] = "_raw"
+    r"""Name of the field to apply the regex on (defaults to _raw)"""

cribl_control_plane/models/functionconfschemarename.py

@@ -0,0 +1,49 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class RenameTypedDict(TypedDict):
+    current_name: str
+    r"""Name of the field to rename. Literal identifiers must be quoted."""
+    new_name: str
+    r"""The name the field will be renamed to. Literal identifiers must be quoted."""
+
+
+class Rename(BaseModel):
+    current_name: Annotated[str, pydantic.Field(alias="currentName")]
+    r"""Name of the field to rename. Literal identifiers must be quoted."""
+
+    new_name: Annotated[str, pydantic.Field(alias="newName")]
+    r"""The name the field will be renamed to. Literal identifiers must be quoted."""
+
+
+class FunctionConfSchemaRenameTypedDict(TypedDict):
+    base_fields: NotRequired[List[str]]
+    r"""Fields whose children will inherit the Rename fields and Rename expression operations. Supports wildcards. If empty, only top-level fields will be renamed."""
+    rename: NotRequired[List[RenameTypedDict]]
+    r"""Set of key-value pairs to rename fields, where key is the current name and value is the new name. Does not support internal fields."""
+    rename_expr: NotRequired[str]
+    r"""Optional JavaScript expression whose returned value will be used to rename fields. Use the 'name' and 'value' global variables to access field names/values. Example: `name.startsWith('data') ? name.toUpperCase() : name`. You can access other field values via __e.<fieldName>."""
+    wildcard_depth: NotRequired[int]
+    r"""For wildcards specified in Parent fields, sets the maximum depth within events to match and rename fields. Enter `0` to match only top-level fields. Defaults to `5` levels down."""
+
+
+class FunctionConfSchemaRename(BaseModel):
+    base_fields: Annotated[Optional[List[str]], pydantic.Field(alias="baseFields")] = (
+        None
+    )
+    r"""Fields whose children will inherit the Rename fields and Rename expression operations. Supports wildcards. If empty, only top-level fields will be renamed."""
+
+    rename: Optional[List[Rename]] = None
+    r"""Set of key-value pairs to rename fields, where key is the current name and value is the new name. Does not support internal fields."""
+
+    rename_expr: Annotated[Optional[str], pydantic.Field(alias="renameExpr")] = None
+    r"""Optional JavaScript expression whose returned value will be used to rename fields. Use the 'name' and 'value' global variables to access field names/values. Example: `name.startsWith('data') ? name.toUpperCase() : name`. You can access other field values via __e.<fieldName>."""
+
+    wildcard_depth: Annotated[Optional[int], pydantic.Field(alias="wildcardDepth")] = 5
+    r"""For wildcards specified in Parent fields, sets the maximum depth within events to match and rename fields. Enter `0` to match only top-level fields. Defaults to `5` levels down."""

cribl_control_plane/models/functionconfschemarollupmetrics.py

@@ -0,0 +1,57 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane import models, utils
+from cribl_control_plane.types import BaseModel
+from cribl_control_plane.utils import validate_open_enum
+from enum import Enum
+import pydantic
+from pydantic import field_serializer
+from pydantic.functional_validators import PlainValidator
+from typing import List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class GaugeUpdate(str, Enum, metaclass=utils.OpenEnumMeta):
+    r"""The operation to use when rolling up gauge metrics. Defaults to last."""
+
+    # Last
+    LAST = "last"
+    # Maximum
+    MAX = "max"
+    # Minimum
+    MIN = "min"
+    # Average
+    AVG = "avg"
+
+
+class FunctionConfSchemaRollupMetricsTypedDict(TypedDict):
+    dimensions: NotRequired[List[str]]
+    r"""List of dimensions across which to perform rollups. Supports wildcards. Defaults to all original dimensions."""
+    time_window: NotRequired[str]
+    r"""The time span of the rollup window. Must be a valid time string (such as 10s)."""
+    gauge_rollup: NotRequired[GaugeUpdate]
+    r"""The operation to use when rolling up gauge metrics. Defaults to last."""
+
+
+class FunctionConfSchemaRollupMetrics(BaseModel):
+    dimensions: Optional[List[str]] = None
+    r"""List of dimensions across which to perform rollups. Supports wildcards. Defaults to all original dimensions."""
+
+    time_window: Annotated[Optional[str], pydantic.Field(alias="timeWindow")] = "30s"
+    r"""The time span of the rollup window. Must be a valid time string (such as 10s)."""
+
+    gauge_rollup: Annotated[
+        Annotated[Optional[GaugeUpdate], PlainValidator(validate_open_enum(False))],
+        pydantic.Field(alias="gaugeRollup"),
+    ] = GaugeUpdate.LAST
+    r"""The operation to use when rolling up gauge metrics. Defaults to last."""
+
+    @field_serializer("gauge_rollup")
+    def serialize_gauge_rollup(self, value):
+        if isinstance(value, str):
+            try:
+                return models.GaugeUpdate(value)
+            except ValueError:
+                return value
+        return value

cribl_control_plane/models/functionconfschemasampling.py

@@ -0,0 +1,32 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaSamplingRuleTypedDict(TypedDict):
+    filter_: NotRequired[str]
+    r"""JavaScript filter expression matching events to be sampled. Use true to match all."""
+    rate: NotRequired[int]
+    r"""Sampling rate; picks one out of N matching events"""
+
+
+class FunctionConfSchemaSamplingRule(BaseModel):
+    filter_: Annotated[Optional[str], pydantic.Field(alias="filter")] = "true"
+    r"""JavaScript filter expression matching events to be sampled. Use true to match all."""
+
+    rate: Optional[int] = 1
+    r"""Sampling rate; picks one out of N matching events"""
+
+
+class FunctionConfSchemaSamplingTypedDict(TypedDict):
+    rules: NotRequired[List[FunctionConfSchemaSamplingRuleTypedDict]]
+    r"""Events matching these rules will be sampled at the given rate"""
+
+
+class FunctionConfSchemaSampling(BaseModel):
+    rules: Optional[List[FunctionConfSchemaSamplingRule]] = None
+    r"""Events matching these rules will be sampled at the given rate"""

cribl_control_plane/models/functionconfschemasend.py

@@ -0,0 +1,84 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane import models, utils
+from cribl_control_plane.types import BaseModel
+from cribl_control_plane.utils import validate_open_enum
+from enum import Enum
+import pydantic
+from pydantic import field_serializer
+from pydantic.functional_validators import PlainValidator
+from typing import Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaSendMode(str, Enum, metaclass=utils.OpenEnumMeta):
+    r"""In Sender mode, forwards search results directly to the destination. In Metrics mode, accumulates metrics from federated send operators, and forwards the aggregate metrics."""
+
+    SENDER = "sender"
+    METRICS = "metrics"
+
+
+class FunctionConfSchemaSendTypedDict(TypedDict):
+    url: NotRequired[str]
+    r"""Full URL to send search to."""
+    group: NotRequired[str]
+    r"""Group within the workspace we're sending to."""
+    workspace: NotRequired[str]
+    r"""Workspace within the deployment to send the search results to."""
+    send_url_template: NotRequired[str]
+    r"""Template to build the URL to send from."""
+    search_id: NotRequired[str]
+    r"""Id of the search this function is running on."""
+    tee: NotRequired[str]
+    r"""Tee results to search. When set to true results will be shipped instead of stats"""
+    flush_ms: NotRequired[float]
+    r"""How often are stats flushed in ms"""
+    suppress_previews: NotRequired[bool]
+    r"""Disables generation of intermediate stats. When true stats will be emitted only on end"""
+    mode: NotRequired[FunctionConfSchemaSendMode]
+    r"""In Sender mode, forwards search results directly to the destination. In Metrics mode, accumulates metrics from federated send operators, and forwards the aggregate metrics."""
+
+
+class FunctionConfSchemaSend(BaseModel):
+    url: Optional[str] = None
+    r"""Full URL to send search to."""
+
+    group: Optional[str] = "default"
+    r"""Group within the workspace we're sending to."""
+
+    workspace: Optional[str] = "main"
+    r"""Workspace within the deployment to send the search results to."""
+
+    send_url_template: Annotated[
+        Optional[str], pydantic.Field(alias="sendUrlTemplate")
+    ] = None
+    r"""Template to build the URL to send from."""
+
+    search_id: Annotated[Optional[str], pydantic.Field(alias="searchId")] = None
+    r"""Id of the search this function is running on."""
+
+    tee: Optional[str] = "false"
+    r"""Tee results to search. When set to true results will be shipped instead of stats"""
+
+    flush_ms: Annotated[Optional[float], pydantic.Field(alias="flushMs")] = 1000
+    r"""How often are stats flushed in ms"""
+
+    suppress_previews: Annotated[
+        Optional[bool], pydantic.Field(alias="suppressPreviews")
+    ] = None
+    r"""Disables generation of intermediate stats. When true stats will be emitted only on end"""
+
+    mode: Annotated[
+        Optional[FunctionConfSchemaSendMode], PlainValidator(validate_open_enum(False))
+    ] = None
+    r"""In Sender mode, forwards search results directly to the destination. In Metrics mode, accumulates metrics from federated send operators, and forwards the aggregate metrics."""
+
+    @field_serializer("mode")
+    def serialize_mode(self, value):
+        if isinstance(value, str):
+            try:
+                return models.FunctionConfSchemaSendMode(value)
+            except ValueError:
+                return value
+        return value

cribl_control_plane/models/functionconfschemasensitivedatascanner.py

@@ -0,0 +1,75 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaSensitiveDataScannerRuleTypedDict(TypedDict):
+    ruleset_id: str
+    r"""The ID of the ruleset to use for the scan"""
+    replace_expr: NotRequired[str]
+    r"""A JavaScript expression or literal to replace the matching content. Capturing groups can be referenced as g1, g2, and so on, and event fields as event.<fieldName>."""
+    disabled: NotRequired[bool]
+
+
+class FunctionConfSchemaSensitiveDataScannerRule(BaseModel):
+    ruleset_id: Annotated[str, pydantic.Field(alias="rulesetId")]
+    r"""The ID of the ruleset to use for the scan"""
+
+    replace_expr: Annotated[Optional[str], pydantic.Field(alias="replaceExpr")] = (
+        "'REDACTED'"
+    )
+    r"""A JavaScript expression or literal to replace the matching content. Capturing groups can be referenced as g1, g2, and so on, and event fields as event.<fieldName>."""
+
+    disabled: Optional[bool] = False
+
+
+class FunctionConfSchemaSensitiveDataScannerFlagTypedDict(TypedDict):
+    value: str
+    name: NotRequired[str]
+
+
+class FunctionConfSchemaSensitiveDataScannerFlag(BaseModel):
+    value: str
+
+    name: Optional[str] = None
+
+
+class FunctionConfSchemaSensitiveDataScannerTypedDict(TypedDict):
+    rules: NotRequired[List[FunctionConfSchemaSensitiveDataScannerRuleTypedDict]]
+    fields: NotRequired[List[str]]
+    r"""Rulesets act on the events contained in these fields. Mitigation expressions apply to the scan results. Supports wildcards (*)."""
+    exclude_fields: NotRequired[List[str]]
+    r"""Fields that the mitigation expression will not be applied to. Supports wildcards (*)."""
+    flags: NotRequired[List[FunctionConfSchemaSensitiveDataScannerFlagTypedDict]]
+    r"""Fields to add when mitigation is applied to an event"""
+    include_detected_rules: NotRequired[bool]
+    r"""Add matching ruleset IDs to a field called \"__detected\" """
+    background_detection: NotRequired[bool]
+
+
+class FunctionConfSchemaSensitiveDataScanner(BaseModel):
+    rules: Optional[List[FunctionConfSchemaSensitiveDataScannerRule]] = None
+
+    fields: Optional[List[str]] = None
+    r"""Rulesets act on the events contained in these fields. Mitigation expressions apply to the scan results. Supports wildcards (*)."""
+
+    exclude_fields: Annotated[
+        Optional[List[str]], pydantic.Field(alias="excludeFields")
+    ] = None
+    r"""Fields that the mitigation expression will not be applied to. Supports wildcards (*)."""
+
+    flags: Optional[List[FunctionConfSchemaSensitiveDataScannerFlag]] = None
+    r"""Fields to add when mitigation is applied to an event"""
+
+    include_detected_rules: Annotated[
+        Optional[bool], pydantic.Field(alias="includeDetectedRules")
+    ] = True
+    r"""Add matching ruleset IDs to a field called \"__detected\" """
+
+    background_detection: Annotated[
+        Optional[bool], pydantic.Field(alias="backgroundDetection")
+    ] = False

cribl_control_plane/models/functionconfschemaserde.py

@@ -0,0 +1,105 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane import models, utils
+from cribl_control_plane.types import BaseModel
+from cribl_control_plane.utils import validate_open_enum
+from enum import Enum
+import pydantic
+from pydantic import field_serializer
+from pydantic.functional_validators import PlainValidator
+from typing import Any, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaSerdeOperationMode(str, Enum, metaclass=utils.OpenEnumMeta):
+    r"""Extract creates new fields. Reserialize extracts and filters fields, and then reserializes."""
+
+    # Extract
+    EXTRACT = "extract"
+    # Reserialize
+    RESERIALIZE = "reserialize"
+
+
+class FunctionConfSchemaSerdeType(str, Enum, metaclass=utils.OpenEnumMeta):
+    r"""Parser or formatter type to use"""
+
+    # CSV
+    CSV = "csv"
+    # Extended Log File Format
+    ELFF = "elff"
+    # Common Log Format
+    CLF = "clf"
+    # Key=Value Pairs
+    KVP = "kvp"
+    # JSON Object
+    JSON = "json"
+    # Delimited values
+    DELIM = "delim"
+    # Regular Expression
+    REGEX = "regex"
+    # Grok
+    GROK = "grok"
+
+
+class FunctionConfSchemaSerdeTypedDict(TypedDict):
+    mode: NotRequired[FunctionConfSchemaSerdeOperationMode]
+    r"""Extract creates new fields. Reserialize extracts and filters fields, and then reserializes."""
+    type: NotRequired[FunctionConfSchemaSerdeType]
+    r"""Parser or formatter type to use"""
+    delim_char: NotRequired[Any]
+    quote_char: NotRequired[Any]
+    escape_char: NotRequired[Any]
+    null_value: NotRequired[Any]
+    src_field: NotRequired[str]
+    r"""Field containing text to be parsed"""
+    dst_field: NotRequired[str]
+    r"""Name of the field to add fields to. Extract mode only."""
+    clean_fields: NotRequired[Any]
+
+
+class FunctionConfSchemaSerde(BaseModel):
+    mode: Annotated[
+        Optional[FunctionConfSchemaSerdeOperationMode],
+        PlainValidator(validate_open_enum(False)),
+    ] = FunctionConfSchemaSerdeOperationMode.EXTRACT
+    r"""Extract creates new fields. Reserialize extracts and filters fields, and then reserializes."""
+
+    type: Annotated[
+        Optional[FunctionConfSchemaSerdeType], PlainValidator(validate_open_enum(False))
+    ] = FunctionConfSchemaSerdeType.CSV
+    r"""Parser or formatter type to use"""
+
+    delim_char: Annotated[Optional[Any], pydantic.Field(alias="delimChar")] = None
+
+    quote_char: Annotated[Optional[Any], pydantic.Field(alias="quoteChar")] = None
+
+    escape_char: Annotated[Optional[Any], pydantic.Field(alias="escapeChar")] = None
+
+    null_value: Annotated[Optional[Any], pydantic.Field(alias="nullValue")] = None
+
+    src_field: Annotated[Optional[str], pydantic.Field(alias="srcField")] = "_raw"
+    r"""Field containing text to be parsed"""
+
+    dst_field: Annotated[Optional[str], pydantic.Field(alias="dstField")] = None
+    r"""Name of the field to add fields to. Extract mode only."""
+
+    clean_fields: Annotated[Optional[Any], pydantic.Field(alias="cleanFields")] = None
+
+    @field_serializer("mode")
+    def serialize_mode(self, value):
+        if isinstance(value, str):
+            try:
+                return models.FunctionConfSchemaSerdeOperationMode(value)
+            except ValueError:
+                return value
+        return value
+
+    @field_serializer("type")
+    def serialize_type(self, value):
+        if isinstance(value, str):
+            try:
+                return models.FunctionConfSchemaSerdeType(value)
+            except ValueError:
+                return value
+        return value