--- title: "Update a Pipeline" method: PATCH path: "/pipelines/{id}" tags: ["pipelines"] --- # Update a Pipeline `PATCH /pipelines/{id}` Update the specified Pipeline.

Provide a complete representation of the Pipeline that you want to update in the request body.

This endpoint does not support partial updates. Cribl removes any omitted fields when updating the Pipeline.

Confirm that the configuration in your request body is correct before sending the request.

If the configuration is incorrect, the updated Pipeline might not function as expected. ## Path parameters - `id` string, required ## Request body - Pipeline - `id` string, required — Unique identifier for the Pipeline. - `conf` object, required — Configuration for the Pipeline, including functions and settings. - `asyncFuncTimeout` integer — Timeout (in milliseconds) for asynchronous Pipeline functions. - `output` string — The output destination for events processed by this Pipeline. - `description` string — Brief description of the Pipeline. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `functions` PipelineFunctionConf[] — List of Functions to pass data through the Pipeline. - union - PipelineFunctionAggregateMetrics - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'aggregate_metrics', required — Identifier of the Function. Always aggregate_metrics - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaAggregateMetrics, required - `passthrough` boolean — Pass through the original events along with the aggregation events - `preserveGroupBys` boolean — Preserve the structure of the original aggregation event's groupby fields - `sufficientStatsOnly` boolean — Output only statistics that are sufficient for the supplied aggregations - `prefix` string — A prefix that is prepended to all of the fields output by this Aggregations Function - `timeWindow` string — The time span of the tumbling window for aggregating events. Must be a valid time string (such as 10s). - `aggregations` object[] — Combination of Aggregation function and output metric type - … - `groupbys` string[] — Optional: One or more dimensions to group aggregates by. Supports wildcard expressions. Wrap dimension names in quotes if using literal identifiers, such as 'service.name'. Warning: Using wildcard '*' causes all dimensions in the event to be included, which can result in high cardinality and increased memory usage. Exclude dimensions that can result in high cardinality before using wildcards. Example: !_time, !_numericValue, * - `flushEventLimit` number — The maximum number of events to include in any given aggregation event - `flushMemLimit` string — The memory usage limit to impose upon aggregations. Defaults to 80% of the process memory; value configured above default limit is ignored. Accepts numerals with units like KB and MB (example: 128MB). - `cumulative` boolean — Enable to retain aggregations for cumulative aggregations when flushing out an aggregation table event. When disabled (the default), aggregations are reset to 0 on flush. - `shouldTreatDotsAsLiterals` boolean — Treat dots in dimension names as literals. This is useful for top-level dimensions that contain dots, such as 'service.name'. - `add` object[] — Set of key-value pairs to evaluate and add/set - … - `flushOnInputClose` boolean — Flush aggregations when an input stream is closed. If disabled, Time Window Settings control flush behavior. - `lagTolerance` string — The tumbling window tolerance to late events. Must be a valid time string (such as 10s). - `idleTimeLimit` string — How long to wait before flushing a bucket that has not received events. Must be a valid time string (such as 10s). - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionAggregation - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'aggregation', required — Identifier of the Function. Always aggregation - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaAggregation, required - `passthrough` boolean — Pass through the original events along with the aggregation events - `preserveGroupBys` boolean — Preserve the structure of the original aggregation event's groupby fields - `sufficientStatsOnly` boolean — Output only statistics that are sufficient for the supplied aggregations - `metricsMode` boolean — Enable to output the aggregates as metrics. When disabled, aggregates are output as events. - `prefix` string — A prefix that is prepended to all of the fields output by this Aggregations Function - `timeWindow` string — The time span of the tumbling window for aggregating events. Must be a valid time string (such as 10s). - `aggregations` string[] — Aggregate function to perform on events. Example: sum(bytes).where(action=='REJECT').as(TotalBytes) - `groupbys` string[] — Optional: One or more fields to group aggregates by. Supports wildcard expressions. Warning: Using wildcard '*' causes all fields in the event to be included, which can result in high cardinality and increased memory usage. Exclude fields that can result in high cardinality before using wildcards. Example: !_time, !_numericValue, * - `flushEventLimit` number — The maximum number of events to include in any given aggregation event - `flushMemLimit` string — The memory usage limit to impose upon aggregations. Defaults to 80% of the process memory; value configured above default limit is ignored. Accepts numerals with units like KB and MB (example: 128MB). - `cumulative` boolean — Enable to retain aggregations for cumulative aggregations when flushing out an aggregation table event. When disabled (the default), aggregations are reset to 0 on flush. - `searchAggMode` string — Allows Cribl Search-specific aggregation configuration - `add` AddConfFunctionConfSchemaAggregation[] — Set of key-value pairs to evaluate and add/set - … - `shouldTreatDotsAsLiterals` boolean — Treat dots in dimension names as literals. This is useful for top-level dimensions that contain dots, such as 'service.name'. - `flushOnInputClose` boolean — Flush aggregations when an input stream is closed. If disabled, Time Window Settings control flush behavior. - `printUndefineds` boolean — When enabled (e.g. for Cribl Search), convert undefined expression results to null so requested-but-missing fields appear in JSON output. When disabled (default), undefined is preserved. - `lagTolerance` string — The tumbling window tolerance to late events. Must be a valid time string (such as 10s). - `idleTimeLimit` string — How long to wait before flushing a bucket that has not received events. Must be a valid time string (such as 10s). - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionAutoTimestamp - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'auto_timestamp', required — Identifier of the Function. Always auto_timestamp - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaAutoTimestamp, required - `srcField` string — Field to search for a timestamp - `dstField` string — Field to place timestamp in - `defaultTimezone` string — Timezone to assign to timestamps without timezone info - `timeExpression` string — Expression to use to format time. Current time, as a JavaScript Date object, is in global `time`. You can access other fields' values via __e.. - `offset` number — The offset into the string from which to look for a timestamp - `maxLen` number — Maximum string length at which to look for a timestamp - `defaultTime` 'now' | 'last' | 'none' — How to set the time field if no timestamp is found - `latestDateAllowed` string — The latest timestamp value allowed relative to now, such as +42days. Parsed values after this date will be set to the Default time. - `spacer` string — UI layout spacer; no effect on event processing. - `earliestDateAllowed` string — The earliest timestamp value allowed relative to now, such as -42years. Parsed values prior to this date will be set to the Default time. - `timestamps` object[] — Add regex/strptime pairs to extract additional timestamp formats - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionCef - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'cef', required — Identifier of the Function. Always cef - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaCef, required - `outputField` string — The field to which the CEF formatted event will be output - `header` object[] — Set of header key/value pairs - … - `extension` object[] — Set of extension key-value pairs - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionChain - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'chain', required — Identifier of the Function. Always chain - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaChain, required - `processor` string — The data processor (Pack/Pipeline) to send events through - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionClone - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'clone', required — Identifier of the Function. Always clone - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaClone, required - `clones` object[] — Create clones with the following fields set - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionCode - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'code', required — Identifier of the Function. Always code - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaCode, required - `code` string — Caution: This Function will be evaluated in an unprotected context. This means that you will be able to execute almost any JavaScript code. - `maxNumOfIterations` number — The maximum number of allowed iterations within this Function. Defaults to 5,000. - `activeLogSampleRate` number — Rate at which this Function logs errors. For example, a value of 1 logs every error, a value of 1000 (the default) logs every thousandth error, and so on. - `useUniqueLogChannel` boolean — Logs from this Function will be sent to a unique channel in the form `func:code:${pipelineName}:${functionIndex}`. Disable to use the generic `func:code` log channel instead. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionComment - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'comment', required — Identifier of the Function. Always comment - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaComment, required - `comment` string — Optional, short description of this Function's purpose in the Pipeline - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionDistinct - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'distinct', required — Identifier of the Function. Always distinct - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaDistinct, required - `groupBy` string[] — Defines the properties that are concatenated to produce distinct key - `maxCombinations` number — maximum number of tracked combinations - `maxDepth` number — maximum number of groupBy properties - `isFederated` boolean — indicator that the operator runs on a federated executor - `suppressPreviews` boolean — Toggle this on to suppress generating previews of intermediate results - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionDnsLookup - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'dns_lookup', required — Identifier of the Function. Always dns_lookup - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaDnsLookup, required - `dnsLookupFields` object[] — List of field names on which to perform DNS lookup - … - `reverseLookupFields` object[] — List of field names on which to perform reverse DNS lookup - … - `dnsServers` string[] — IPs, in RFC 5952 format, of the DNS servers to use for resolution. Examples: IPv4 1.1.1.1, 4.2.2.2:53, or IPv6 [2001:4860:4860::8888], [2001:4860:4860::8888]:1053. If not specified, system's DNS will be used. - `cacheTTL` number — How frequently to expire and refetch DNS cache. Use 0 to disable. - `maxCacheSize` number — The maximum number of DNS resolutions to be cached locally. Leave at default unless you understand the implications of changing. - `useResolvConf` boolean — Attempt to resolve DNS short names using the search or domain directive from /etc/resolv.conf - `lookupFallback` boolean — If unable to resolve a DNS short name, make a DNS.lookup() call to resolve it. Caution: This might degrade performance in unrelated areas of @{product}. - `domainOverrides` string[] — Specify fallback values for the DNS resolver to use when it cannot resolve a DNS short name - `lookupFailLogLevel` 'silly' | 'debug' | 'info' | 'warn' | 'error' — Log level to use when a DNS lookup fails. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionDrop - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'drop', required — Identifier of the Function. Always drop - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaDrop, required - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionDropDimensions - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'drop_dimensions', required — Identifier of the Function. Always drop_dimensions - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaDropDimensions, required - `timeWindow` string — The time span of the tumbling window for aggregating events. Must be a valid time string (such as 10s). - `dropDimensions` string[] — One or more dimensions to be dropped. Supports wildcard expressions. Warning: Using wildcard '*' causes all dimensions in the event to be dropped. - `flushOnInputClose` boolean — Flush aggregations when an input stream is closed. If disabled, aggregations are flushed based on Time Window Settings instead. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionDynamicSampling - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'dynamic_sampling', required — Identifier of the Function. Always dynamic_sampling - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaDynamicSampling, required - `mode` 'log' | 'sqrt' — Defines how sample rate will be derived: log(previousPeriodCount) or sqrt(previousPeriodCount) - `keyExpr` string — Expression used to derive sample group key. Example:`${domain}:${status}`. Each sample group will have its own derived sampling rate based on volume. Defaults to `${host}`. - `samplePeriod` number — How often (in seconds) sample rates will be adjusted - `minEvents` number — Minimum number of events that must be received in previous sample period for sampling mode to be applied to current period. If the number of events received for a sample group is less than this minimum, a sample rate of 1:1 is used. - `maxSampleRate` number — Maximum sampling rate. If computed sampling rate is above this value, it will be limited to this value. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionEval - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'eval', required — Identifier of the Function. Always eval - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaEval, required - `add` object[] — Set of key-value pairs to evaluate and add/set - … - `keep` string[] — List of fields to keep. Supports * wildcards. Takes precedence over 'Remove fields'. - `remove` string[] — List of fields to remove. Supports * wildcards. Fields that match 'Keep fields' will not be removed. Enclose field names containing special characters in single or double quotes. - `printUndefineds` boolean — When enabled (e.g. for Cribl Search), convert undefined expression results to null so requested-but-missing fields appear in JSON output. When disabled (default), undefined is preserved. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionEventBreaker - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'event_breaker', required — Identifier of the Function. Always event_breaker - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` union, required - union - … - object - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionEventstats - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'eventstats', required — Identifier of the Function. Always eventstats - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaEventstats, required - `aggregations` string[] — Aggregate function(s) to perform on events. E.g., sum(bytes).where(action=='REJECT').as(TotalBytes) - `groupBys` string[] — Fields to group aggregates by, supports wildcard expressions. - `maxEvents` number — Specifies how many events are at max kept in memory to be enriched with aggregations - `flushOnInputClose` boolean — Determines if aggregations should flush when an input stream is closed. If disabled, time window settings will control flush behavior. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionExternaldata - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'externaldata', required — Identifier of the Function. Always externaldata - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaExternaldata, required - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionFlatten - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'flatten', required — Identifier of the Function. Always flatten - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaFlatten, required - `fields` string[] — List of top-level fields to include for flattening. Supports * wildcards, except when used on internal fields. Defaults to empty array, which means all fields. - `prefix` string — Prefix string for flattened field names. Defaults to empty. - `depth` number — Number representing the nested levels to consider for flattening. Defaults to 5. Minimum should be 1. - `delimiter` string — Delimiter to be used for flattening. Defaults to underscore. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionFoldkeys - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'foldkeys', required — Identifier of the Function. Always foldkeys - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaFoldkeys, required - `deleteOriginal` boolean — When enabled (default), only the folded keys are kept. When disabled, the original entries are retained alongside the folded keys. - `separator` string — Character or string used to separate key levels to be folded. Defaults to the dot (.) character. - `selectionRegExp` string — Optional regular expression to select a subset of the keys to fold. - `maxDepth` integer — Maximum recursion depth when traversing nested objects. Prevents infinite loops caused by cyclic references. Defaults to 20. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionGenStats - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'gen_stats', required — Identifier of the Function. Always gen_stats - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaGenStats, required - `fields` string[] — List of field names from which to generate statistics. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionGeoip - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'geoip', required — Identifier of the Function. Always geoip - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaGeoip, required - `file` string — Select an uploaded Maxmind database, or specify path to a Maxmind database with .mmdb extension - `inField` string — Field name in which to find an IP to look up. Can be nested. - `outField` string — Field name in which to store the GeoIP lookup results - `additionalFields` object[] — Additional IP fields on which to perform GeoIP lookups. - … - `outFieldMappings` object — Search-specific mappings for granular control over event enrichment - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionGrok - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'grok', required — Identifier of the Function. Always grok - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaGrok, required - `pattern` string — Grok pattern to extract fields. Syntax supported: %{PATTERN_NAME:FIELD_NAME} - `patternList` PatternListConfSerdeTypeGrok[] — Additional Grok patterns to apply to the source field. - … - `source` string — Field on which to perform Grok extractions - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionHandlebars - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'handlebars', required — Identifier of the Function. Always handlebars - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaHandlebars, required - `templates` object[] — Array of template definitions. Uses event.__template_id to select template at runtime. - … - `targetField` string — Field name to store the rendered template result. Defaults to _raw. - `parseJson` boolean — Parse the rendered template as JSON and store as an object instead of a string. Useful for building structured data like Slack blocks. - `removeOnNull` boolean — Remove the target field if the rendered result is empty or null. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionJoin - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'join', required — Identifier of the Function. Always join - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaJoin, required - `kind` string — Join kind, e.g. inner - `hints` object — Hints passed to the join function - `fieldConditions` object[] — Fields to use when joining - … - `searchJobId` string — The id for this search job. - `stageId` string — The stage we are joining with. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionJsonUnroll - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'json_unroll', required — Identifier of the Function. Always json_unroll - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaJsonUnroll, required - `path` string — Path to array to unroll, such as foo.0.bar - `name` string — Name of each exploded array element in each new event. Leave empty to expand the array element with its original name. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionLakeExport - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'lake_export', required — Identifier of the Function. Always lake_export - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaLakeExport, required - `searchJobId` string — Id of the search job this function is running on. - `dataset` string — Name of the dataset - `lake` string — Name of the lake - `tee` boolean — Tee results to search. When set to true results will be shipped instead of stats - `flushMs` number — How often are stats flushed in ms - `suppressPreviews` boolean — Disables generation of intermediate stats. When true stats will be emitted only on end - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionLimit - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'limit', required — Identifier of the Function. Always limit - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaLimit, required - `limit` integer — Number of qualifying events to pass through - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionLocalSearchDatatypeParser - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'local_search_datatype_parser', required — Identifier of the Function. Always local_search_datatype_parser - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaLocalSearchDatatypeParser, required - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionLocalSearchRulesetRunner - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'local_search_ruleset_runner', required — Identifier of the Function. Always local_search_ruleset_runner - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaLocalSearchRulesetRunner, required - `rulesetType` 'dataset' | 'datatype' — Type of ruleset to apply: dataset or datatype. - `rulesetId` string — ID of the ruleset to apply. - `ruleset` object — Full ruleset definition, used with live data capture for draft or unsaved rulesets. - `markAndIncludeDroppedEvents` boolean — Only for use with live data capture. Mark events that were dropped by dataset rules and still include them for capture - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionLocalSearchSchemaMapper - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'local_search_schema_mapper', required — Identifier of the Function. Always local_search_schema_mapper - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaLocalSearchSchemaMapper, required - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionLocalSearchTimeRangeNormalizer - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'local_search_time_range_normalizer', required — Identifier of the Function. Always local_search_time_range_normalizer - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaLocalSearchTimeRangeNormalizer, required - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionLocalSearchTransformer - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'local_search_transformer', required — Identifier of the Function. Always local_search_transformer - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaLocalSearchTransformer, required - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionLookup - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'lookup', required — Identifier of the Function. Always lookup - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaLookup, required - `file` string — Path to the lookup file. Reference environment variables via $. Example: $HOME/file.csv - `dbLookup` boolean — Enable to use a disk-based lookup. This option displays only the settings relevant to disk-based mode and hides those for in-memory lookups. - `matchMode` 'exact' | 'cidr' | 'regex' — Specifies the matching method based on the format and logic used in the lookup file - `matchType` 'first' | 'specific' | 'all' — Further defines how to handle multiple matches: return the first match, the most specific match, or all matches - `reloadPeriodSec` number — Checks the lookup file periodically for changes and reloads it if modified. Set to -1 to disable reloading (default). Useful for lookups not managed by Stream or not updated by an external process. [Learn more](https://docs.cribl.io/stream/lookup-function/#advanced-settings) - `inFields` object[] — Fields that should be used to key into the lookup table - … - `outFields` object[] — Fields to add to events after matching lookup. Defaults to all if not specified. - … - `addToEvent` boolean — Add the looked-up values to _raw, as key=value pairs - `ignoreCase` boolean — Whether to ignore case when performing lookups using Match Mode: Regex. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionMask - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'mask', required — Identifier of the Function. Always mask - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaMask, required - `rules` object[] — List of masking rules, each specifying a regex to match and an expression to replace matched content. - … - `fields` string[] — Fields on which to apply the masking rules. Supports * wildcards, except when used on internal fields. - `depth` integer — Depth to which the Mask Function will search for fields to mask - `flags` AddConfFunctionConfSchemaAggregation[] — Fields to evaluate if one or more masking rules are matched - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionMetricsExport - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'metrics_export', required — Identifier of the Function. Always metrics_export - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaMetricsExport, required - `searchJobId` string — Id of the search job this function is running on. - `dataset` string — Id of the metrics dataset - `nameField` NameFieldType - … - `timeField` NameFieldType - … - `valueField` NameFieldType - … - `typeField` NameFieldType - … - `labelFields` union - … - `tee` boolean — Tee results to search. When set to true results will be shipped instead of stats - `flushMs` number — How often stats are flushed in ms - `suppressPreviews` boolean — Disables generation of intermediate stats. When true stats will be emitted only on end - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionMvExpand - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'mv_expand', required — Identifier of the Function. Always mv_expand - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaMvExpand, required - `sourceFields` string[] — Array of property-/field-names to expand - `targetNames` string[] — stores the value as new target field name - `rowLimit` number — max. number of rows generated out of every source events - `itemIndexName` string — name of an optional index property generated into the output - `bagExpansionMode` 'bag' | 'array' — decides if bag-values are expanded to bags or arrays - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionMvPull - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'mv_pull', required — Identifier of the Function. Always mv_pull - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaMvPull, required - `arrayPath` string — Field name of the array within events that contains the data objects of interest. Can be a path. - `relativeKeyPath` string — Extract the K-V pair's key from this field, relative to the data object. - `relativeValuePath` string — Extract the K-V pair's value from this field, relative to the data object. - `targetBagPath` string — Optionally, specify a bag as the target for K-V entries. If not specified, these entries are stored on each top-level event. - `deleteOriginal` boolean — Toggle this on to remove each original array of data objects after extraction. If toggled off, arrays are retained. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionNotificationPolicies - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'notification_policies', required — Identifier of the Function. Always notification_policies - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaNotificationPolicies, required - `policies` object[] — List of notification routing policies evaluated in order - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionNotifications - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'notifications', required — Identifier of the Function. Always notifications - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaNotifications, required - `id` string — Notification ID - `field` string — Notification event state field name - `deduplicate` boolean — Toggle deduplication. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionNotify - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'notify', required — Identifier of the Function. Always notify - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaNotify, required - `group` string — Group the notification belongs to - `notificationId` string — Workspace within the deployment to send the search results to. - `searchId` string — Id of the search this function is running on. - `savedQueryId` string — Id of the saved query - `trigger` string — Js expression that filters events, a greater than 'Trigger Count' events will trigger the notification - `triggerType` 'custom' | 'resultsCount' — Type of the trigger condition. custom applies a kusto expression over the results, and results count applies a comparison over results count - `triggerComparator` '>' | '<' | '===' | '!==' | '>=' | '<=' — Operation to be applied over the results count - `triggerCount` number — How many results that match trigger the condition - `resultsLimit` number — Number of results to include in the notification event - `searchUrl` string — Url of the search results - `message` string — Message content template, available fields: searchId, resultSet, savedQueryId, notificationId, searchResultsUrl - `authToken` string — Auth token for sending notification messages - `messagesEndpoint` string — System messages api endpoint - `tenantId` string — Current tenant id - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionNumerify - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'numerify', required — Identifier of the Function. Always numerify - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` union, required - object - … - object - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionOtlpLogs - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'otlp_logs', required — Identifier of the Function. Always otlp_logs - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaOtlpLogs, required - `dropNonLogEvents` boolean — Drop events that are not OTLP log records. - `batchOTLPLogs` boolean — Batch OTLP log records by shared top-level `resource` attributes - `sendBatchSize` number — Number of log records after which a batch will be sent, regardless of the timeout - `timeout` number — Time duration after which a batch will be sent, regardless of size - `sendBatchMaxSize` number — Maximum batch size. Enter 0 for no maximum. - `metadataKeys` string[] — When set, this processor will create one batcher instance per distinct combination of values in the metadata - `metadataCardinalityLimit` number — Limit the number of unique combinations of metadata key values that will be processed over the lifetime of the process. After the limit is reached, events with new metadata key value combinations will be dropped. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionOtlpMetrics - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'otlp_metrics', required — Identifier of the Function. Always otlp_metrics - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaOtlpMetrics, required - `resourceAttributePrefixes` string[] — The prefixes of top-level attributes to add as resource attributes. Each attribute must match the regex pattern `^[a-zA-Z0-9_\.]+$`. Use Eval to copy nested attributes to the top level for matching. - `dropNonMetricEvents` boolean — Drop events that are not OTLP metric data points. - `otlpVersion` '0.10.0' | '1.3.1' — OTLP version - `batchOTLPMetrics` boolean — Batch OTLP metrics by shared top-level `resource` attributes - `sendBatchSize` number — Number of metric data points after which a batch will be sent, regardless of the timeout - `timeout` number — Time duration after which a batch will be sent, regardless of size - `sendBatchMaxSize` number — Maximum batch size. Enter 0 for no maximum. - `metadataKeys` string[] — When set, this processor will create one batcher instance per distinct combination of values in the metadata - `metadataCardinalityLimit` number — Limit the number of unique combinations of metadata key values that will be processed over the lifetime of the process. After the limit is reached, events with new metadata key value combinations will be dropped. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionOtlpTraces - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'otlp_traces', required — Identifier of the Function. Always otlp_traces - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaOtlpTraces, required - `dropNonTraceEvents` boolean — Drop events that are not OTLP trace spans. - `otlpVersion` '0.10.0' | '1.3.1' — OTLP version - `batchOTLPTraces` boolean — Batch OTLP traces by shared top-level `resource` attributes - `sendBatchSize` number — Number of spans after which a batch will be sent, regardless of the timeout - `timeout` number — Time duration after which a batch will be sent, regardless of size - `sendBatchMaxSize` number — Maximum batch size. Enter 0 for no maximum. - `metadataKeys` string[] — When set, this processor will create one batcher instance per distinct combination of values in the metadata - `metadataCardinalityLimit` number — Limit the number of unique combinations of metadata key values that will be processed over the lifetime of the process. After the limit is reached, events with new metadata key value combinations will be dropped. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionPack - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'pack', required — Identifier of the Function. Always pack - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaPack, required - `unpackedFields` string[] — List of fields to keep, everything else will be packed - `target` string — Name of the (packed) target field - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionPivot - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'pivot', required — Identifier of the Function. Always pivot - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaPivot, required - `labelField` string — Fields to be used for the left-most column. - `dataFields` string[] — Fields with the cell values (i.e. aggregates) - `qualifierFields` string[] — Fields to qualify or group data fields - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionPublishMetrics - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'publish_metrics', required — Identifier of the Function. Always publish_metrics - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaPublishMetrics, required - `fields` object[] — List of metrics from event to extract and format. Formatted metrics can be used by a destination to pass metrics to a metrics aggregation platform. - … - `overwrite` boolean — Overwrite previous metric specs. Leave disabled to append. - `dimensions` string[] — Optional list of dimensions to include in events. Wildcards supported. If you don't specify metrics, values will be appended to every metric found in the event. When you add a new metric, dimensions will be present only in those new metrics. - `removeMetrics` string[] — Optional list of metric field names to look for when removing metrics. When a metric's field name matches an element in this list, the metric will be removed from the event. - `removeDimensions` string[] — Optional list of dimensions to remove from every metric found in the event. Wildcards supported. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionRedis - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'redis', required — Identifier of the Function. Always redis - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` union, required - object - … - object - … - object - … - object - … - object - … - object - … - object - … - object - … - object - … - object - … - object - … - object - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionRegexExtract - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'regex_extract', required — Identifier of the Function. Always regex_extract - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaRegexExtract, required - `regex` string — Regex literal with named capturing groups, such as (?bar), or _NAME_ and _VALUE_ capturing groups, such as (?<_NAME_0>[^ =]+)=(?<_VALUE_0>[^,]+) - `regexList` RegexListConfSerdeTypeRegex[] — Additional regex patterns to apply for field extraction. - … - `source` string — Field on which to perform regex field extraction - `iterations` number — The maximum number of times to apply regex to source field when the global flag is set, or when using _NAME_ and _VALUE_ capturing groups - `fieldNameExpression` string — JavaScript expression to format field names when _NAME_n and _VALUE_n capturing groups are used. Original field name is in global variable 'name'. Example: To append XX to all field names, use `${name}_XX` (backticks are literal). If empty, names will be sanitized using this regex: /^[_0-9]+|[^a-zA-Z0-9_]+/g. You can access other fields values via __e.. - `overwrite` boolean — Overwrite existing event fields with extracted values. If disabled, existing fields will be converted to an array. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionRegexFilter - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'regex_filter', required — Identifier of the Function. Always regex_filter - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaRegexFilter, required - `regex` string — Regex to test against - `regexList` object[] — Additional regex patterns to test against the field. - … - `field` string — Name of the field to apply the regex on (defaults to _raw) - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionRename - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'rename', required — Identifier of the Function. Always rename - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaRename, required - `baseFields` string[] — Fields whose children will inherit the Rename fields and Rename expression operations. Supports wildcards. If empty, only top-level fields will be renamed. - `rename` object[] — Set of key-value pairs to rename fields, where key is the current name and value is the new name. Does not support internal fields. - … - `renameExpr` string — Optional JavaScript expression whose returned value will be used to rename fields. Use the 'name' and 'value' global variables to access field names/values. Example: `name.startsWith('data') ? name.toUpperCase() : name`. You can access other field values via __e.. - `wildcardDepth` integer — For wildcards specified in Parent fields, sets the maximum depth within events to match and rename fields. Enter `0` to match only top-level fields. Defaults to `5` levels down. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionRollupMetrics - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'rollup_metrics', required — Identifier of the Function. Always rollup_metrics - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaRollupMetrics, required - `dimensions` string[] — List of dimensions across which to perform rollups. Supports wildcards. Defaults to all original dimensions. - `timeWindow` string — The time span of the rollup window. Must be a valid time string (such as 10s). - `gaugeRollup` 'last' | 'max' | 'min' | 'avg' — The operation to use when rolling up gauge metrics. Defaults to last. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSampling - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'sampling', required — Identifier of the Function. Always sampling - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaSampling, required - `rules` object[] — Events matching these rules will be sampled at the given rate - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSearchEngineExport - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'search_engine_export', required — Identifier of the Function. Always search_engine_export - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaSearchEngineExport, required - `searchJobId` string — Id of the search job this function is running on. - `dataset` string — Id of the dataset - `tee` boolean — Tee results to search. When set to true results will be shipped instead of stats - `flushMs` number — How often are stats flushed in ms - `suppressPreviews` boolean — Disables generation of intermediate stats. When true stats will be emitted only on end - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSend - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'send', required — Identifier of the Function. Always send - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaSend, required - `url` string — Full URL to send search to. - `group` string — Group within the workspace we're sending to. - `workspace` string — Workspace within the deployment to send the search results to. - `sendUrlTemplate` string — Template to build the URL to send from. - `searchId` string — Id of the search this function is running on. - `tee` boolean — Tee results to search. When set to true results will be shipped instead of stats - `flushMs` number — How often are stats flushed in ms - `suppressPreviews` boolean — Disables generation of intermediate stats. When true stats will be emitted only on end - `mode` 'sender' | 'metrics' — In Sender mode, forwards search results directly to the destination. In Metrics mode, accumulates metrics from federated send operators, and forwards the aggregate metrics. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSensitiveDataScanner - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'sensitive_data_scanner', required — Identifier of the Function. Always sensitive_data_scanner - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaSensitiveDataScanner, required - `rules` object[] — List of scanning rulesets to apply, each with a ruleset ID and a mitigation expression. - … - `fields` string[] — Rulesets act on the events contained in these fields. Mitigation expressions apply to the scan results. Supports wildcards (*). - `excludeFields` string[] — Fields that the mitigation expression will not be applied to. Supports wildcards (*). - `flags` object[] — Fields to add when mitigation is applied to an event - … - `includeDetectedRules` boolean — Add matching ruleset IDs to a field called "__detected" - `backgroundDetection` boolean — Run detection in the background without blocking event processing. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSerde - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'serde', required — Identifier of the Function. Always serde - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` union, required - object - … - object - … - object - … - object - … - object - … - object - … - object - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSerialize - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'serialize', required — Identifier of the Function. Always serialize - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` union, required - object - … - object - … - object - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSidlookup - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'sidlookup', required — Identifier of the Function. Always sidlookup - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaSidlookup, required - `fields` object[] — Set of expressions matched to lookup responses - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSignalFilter - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'signal_filter', required — Identifier of the Function. Always signal_filter - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaSignalFilter, required - `signals` string[] — List of signal event types to filter - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSnmpTrapSerialize - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'snmp_trap_serialize', required — Identifier of the Function. Always snmp_trap_serialize - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaSnmpTrapSerialize, required - `strict` boolean — Prevent event serialization if any required fields are missing. When disabled, @{product} will attempt to serialize the event even if required fields are missing, which could cause unexpected behavior at the downstream receiver. - `dropFailedEvents` boolean — When disabled, `snmpSerializeErrors` will be set on the event, and the `__snmpRaw` field will be removed to prevent @{product} from sending the event from the SNMP Trap Destination - `v3User` union — SNMPv3 user configuration, including authentication and privacy protocol settings. - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSort - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'sort', required — Identifier of the Function. Always sort - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaSort, required - `sortId` string — Has to be unique if there are multiple sorts on the pipeline. - `comparisonExpression` string — The expression can access the events via the 'left' and 'right' properties. - `topN` number — Limits the output to N (highest/lowest) events - `maxEvents` number — Specifies the number of events that can flow into this function - `suppressPreviews` boolean — Toggle this on to suppress generating previews of intermediate results - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionStore - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'store', required — Identifier of the Function. Always store - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaStore, required - `type` string — The type of knowledge object, generated by the function (i.e., 'lookup') - `destination` string — Configures where and how the data should be stored - `description` string — The knowledge object's description - `fieldMapping` object — Mapping event property names to output field names - `separator` string — Character to be used as value delimiter in output - `overwrite` boolean — For existing files, an error is thrown if overwrite is false or the file is replaced if overwrite is true - `compress` string — True will compress output, false leaves it as it is and auto decides based on size - `tee` boolean — Tee results to the next operator - `maxEvents` number — Limits how many events can be stored - `suppressPreviews` boolean — Suppresses the timer-based export stats generating - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSuppress - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'suppress', required — Identifier of the Function. Always suppress - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaSuppress, required - `keyExpr` string — Suppression key expression used to uniquely identify events to suppress. For example, `${ip}:${port}` will use fields ip and port from each event to generate the key. - `allow` number — The number of events to allow per time period - `suppressPeriodSec` number — The number of seconds to suppress events after 'Number to allow' events are received - `dropEventsMode` boolean — If disabled, suppressed events will be tagged with suppress=1 but not dropped - `maxCacheSize` number — The maximum number of keys that can be cached before idle entries are removed. Leave at default unless you understand the implications of changing. - `cacheIdleTimeoutPeriods` number — The number of suppression periods 'Suppression Period' of inactivity before a cache entry is considered idle. Leave at default unless you understand the implications of changing. - `numEventsIdleTimeoutTrigger` number — Check cache for idle sessions every N events when cache size is > 'Maximum Cache Size'. Leave at default unless you understand the implications of changing. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionTee - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'tee', required — Identifier of the Function. Always tee - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaTee, required - `command` string — Command to execute and feed events to, via stdin. One JSON-formatted event per line. - `args` string[] — Command-line arguments to pass to the command. - `restartOnExit` boolean — Restart the process if it exits and/or we fail to write to it - `env` object — Environment variables to overwrite or set - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionTrimTimestamp - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'trim_timestamp', required — Identifier of the Function. Always trim_timestamp - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaTrimTimestamp, required - `field` string — Name of field in which to save the timestamp. (If empty, timestamp will not be saved to a field.) - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionUnion - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'union', required — Identifier of the Function. Always union - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaUnion, required - `searchJobId` string — The id for this search job. - `stageIds` string[] — The stages we are unioning with. - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionUnroll - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'unroll', required — Identifier of the Function. Always unroll - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaUnroll, required - `srcExpr` string — Field in which to find/calculate the array to unroll. Example: _raw, _raw.split(/\n/) - `dstField` string — Field in destination event in which to place the unrolled value - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionWindow - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'window', required — Identifier of the Function. Always window - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaWindow, required - `eventWindowId` number — Identifies the unique ID, used for a event window - `registeredFunctions` string[] — All window functions, tracked by this event window - `tailEventCount` number — Number of events to keep before the current event in the window - `headEventCount` number — Number of events to keep after the current event in the window - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionXmlUnroll - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'xml_unroll', required — Identifier of the Function. Always xml_unroll - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaXmlUnroll, required - `unroll` string — Path to array to unroll. Example: ^root\.child\.ElementToUnroll$ - `inherit` string — Regex matching elements to copy into each unrolled event. Example: ^root\.(childA|childB|childC)$ - `unrollIdxField` string — Add a field with this name, containing the index at which the item was located, starting from 0 - `pretty` boolean — Pretty print the output XML - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - `groups` object — Named groups of Pipeline functions for organizational display in the UI. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. ## Response `200` The updated Pipeline object in a single-item list. - CountedPipeline - `count` integer, required — number of items present in the items array - `items` Pipeline[], required — List of items in this response. - `id` string, required — Unique identifier for the Pipeline. - `conf` object, required — Configuration for the Pipeline, including functions and settings. - `asyncFuncTimeout` integer — Timeout (in milliseconds) for asynchronous Pipeline functions. - `output` string — The output destination for events processed by this Pipeline. - `description` string — Brief description of the Pipeline. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `functions` PipelineFunctionConf[] — List of Functions to pass data through the Pipeline. - union - PipelineFunctionAggregateMetrics - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'aggregate_metrics', required — Identifier of the Function. Always aggregate_metrics - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaAggregateMetrics, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionAggregation - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'aggregation', required — Identifier of the Function. Always aggregation - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaAggregation, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionAutoTimestamp - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'auto_timestamp', required — Identifier of the Function. Always auto_timestamp - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaAutoTimestamp, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionCef - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'cef', required — Identifier of the Function. Always cef - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaCef, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionChain - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'chain', required — Identifier of the Function. Always chain - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaChain, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionClone - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'clone', required — Identifier of the Function. Always clone - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaClone, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionCode - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'code', required — Identifier of the Function. Always code - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaCode, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionComment - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'comment', required — Identifier of the Function. Always comment - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaComment, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionDistinct - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'distinct', required — Identifier of the Function. Always distinct - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaDistinct, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionDnsLookup - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'dns_lookup', required — Identifier of the Function. Always dns_lookup - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaDnsLookup, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionDrop - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'drop', required — Identifier of the Function. Always drop - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaDrop, required - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionDropDimensions - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'drop_dimensions', required — Identifier of the Function. Always drop_dimensions - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaDropDimensions, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionDynamicSampling - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'dynamic_sampling', required — Identifier of the Function. Always dynamic_sampling - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaDynamicSampling, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionEval - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'eval', required — Identifier of the Function. Always eval - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaEval, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionEventBreaker - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'event_breaker', required — Identifier of the Function. Always event_breaker - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` union, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionEventstats - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'eventstats', required — Identifier of the Function. Always eventstats - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaEventstats, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionExternaldata - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'externaldata', required — Identifier of the Function. Always externaldata - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaExternaldata, required - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionFlatten - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'flatten', required — Identifier of the Function. Always flatten - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaFlatten, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionFoldkeys - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'foldkeys', required — Identifier of the Function. Always foldkeys - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaFoldkeys, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionGenStats - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'gen_stats', required — Identifier of the Function. Always gen_stats - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaGenStats, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionGeoip - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'geoip', required — Identifier of the Function. Always geoip - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaGeoip, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionGrok - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'grok', required — Identifier of the Function. Always grok - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaGrok, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionHandlebars - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'handlebars', required — Identifier of the Function. Always handlebars - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaHandlebars, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionJoin - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'join', required — Identifier of the Function. Always join - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaJoin, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionJsonUnroll - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'json_unroll', required — Identifier of the Function. Always json_unroll - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaJsonUnroll, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionLakeExport - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'lake_export', required — Identifier of the Function. Always lake_export - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaLakeExport, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionLimit - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'limit', required — Identifier of the Function. Always limit - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaLimit, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionLocalSearchDatatypeParser - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'local_search_datatype_parser', required — Identifier of the Function. Always local_search_datatype_parser - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaLocalSearchDatatypeParser, required - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionLocalSearchRulesetRunner - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'local_search_ruleset_runner', required — Identifier of the Function. Always local_search_ruleset_runner - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaLocalSearchRulesetRunner, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionLocalSearchSchemaMapper - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'local_search_schema_mapper', required — Identifier of the Function. Always local_search_schema_mapper - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaLocalSearchSchemaMapper, required - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionLocalSearchTimeRangeNormalizer - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'local_search_time_range_normalizer', required — Identifier of the Function. Always local_search_time_range_normalizer - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaLocalSearchTimeRangeNormalizer, required - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionLocalSearchTransformer - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'local_search_transformer', required — Identifier of the Function. Always local_search_transformer - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaLocalSearchTransformer, required - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionLookup - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'lookup', required — Identifier of the Function. Always lookup - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaLookup, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionMask - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'mask', required — Identifier of the Function. Always mask - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaMask, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionMetricsExport - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'metrics_export', required — Identifier of the Function. Always metrics_export - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaMetricsExport, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionMvExpand - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'mv_expand', required — Identifier of the Function. Always mv_expand - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaMvExpand, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionMvPull - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'mv_pull', required — Identifier of the Function. Always mv_pull - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaMvPull, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionNotificationPolicies - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'notification_policies', required — Identifier of the Function. Always notification_policies - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaNotificationPolicies, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionNotifications - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'notifications', required — Identifier of the Function. Always notifications - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaNotifications, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionNotify - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'notify', required — Identifier of the Function. Always notify - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaNotify, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionNumerify - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'numerify', required — Identifier of the Function. Always numerify - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` union, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionOtlpLogs - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'otlp_logs', required — Identifier of the Function. Always otlp_logs - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaOtlpLogs, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionOtlpMetrics - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'otlp_metrics', required — Identifier of the Function. Always otlp_metrics - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaOtlpMetrics, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionOtlpTraces - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'otlp_traces', required — Identifier of the Function. Always otlp_traces - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaOtlpTraces, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionPack - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'pack', required — Identifier of the Function. Always pack - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaPack, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionPivot - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'pivot', required — Identifier of the Function. Always pivot - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaPivot, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionPublishMetrics - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'publish_metrics', required — Identifier of the Function. Always publish_metrics - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaPublishMetrics, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionRedis - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'redis', required — Identifier of the Function. Always redis - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` union, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionRegexExtract - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'regex_extract', required — Identifier of the Function. Always regex_extract - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaRegexExtract, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionRegexFilter - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'regex_filter', required — Identifier of the Function. Always regex_filter - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaRegexFilter, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionRename - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'rename', required — Identifier of the Function. Always rename - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaRename, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionRollupMetrics - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'rollup_metrics', required — Identifier of the Function. Always rollup_metrics - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaRollupMetrics, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSampling - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'sampling', required — Identifier of the Function. Always sampling - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaSampling, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSearchEngineExport - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'search_engine_export', required — Identifier of the Function. Always search_engine_export - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaSearchEngineExport, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSend - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'send', required — Identifier of the Function. Always send - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaSend, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSensitiveDataScanner - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'sensitive_data_scanner', required — Identifier of the Function. Always sensitive_data_scanner - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaSensitiveDataScanner, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSerde - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'serde', required — Identifier of the Function. Always serde - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` union, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSerialize - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'serialize', required — Identifier of the Function. Always serialize - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` union, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSidlookup - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'sidlookup', required — Identifier of the Function. Always sidlookup - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaSidlookup, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSignalFilter - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'signal_filter', required — Identifier of the Function. Always signal_filter - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaSignalFilter, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSnmpTrapSerialize - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'snmp_trap_serialize', required — Identifier of the Function. Always snmp_trap_serialize - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaSnmpTrapSerialize, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSort - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'sort', required — Identifier of the Function. Always sort - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaSort, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionStore - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'store', required — Identifier of the Function. Always store - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaStore, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionSuppress - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'suppress', required — Identifier of the Function. Always suppress - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaSuppress, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionTee - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'tee', required — Identifier of the Function. Always tee - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaTee, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionTrimTimestamp - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'trim_timestamp', required — Identifier of the Function. Always trim_timestamp - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaTrimTimestamp, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionUnion - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'union', required — Identifier of the Function. Always union - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaUnion, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionUnroll - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'unroll', required — Identifier of the Function. Always unroll - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaUnroll, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionWindow - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'window', required — Identifier of the Function. Always window - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaWindow, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - PipelineFunctionXmlUnroll - `filter` string — JavaScript expression that selects data to pass through the Function. - `id` 'xml_unroll', required — Identifier of the Function. Always xml_unroll - `description` string — Brief description of the Pipeline function. - `disabled` boolean — If true, disable the Pipeline function so that events are not passed through it. Otherwise, false. - `final` boolean — If true, stop passing events to downstream Pipeline Functions after the Function executes. Otherwise, false. - `conf` FunctionConfSchemaXmlUnroll, required - … - `groupId` string — Unique identifier of the group that contains the Pipeline Function. - `groups` object — Named groups of Pipeline functions for organizational display in the UI. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. ## Other responses - `400` — Failed validation or malformed input, such as missing or invalid parameters. - `401` — Authentication failed (missing or invalid credentials or Bearer token). - `500` — Unexpected server error. --- [API](https://skmtc.net/criblio/apis/cribl-api-reference.md) · [All operations](https://skmtc.net/criblio/apis/cribl-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/criblio/cribl-api-reference/versions/e9bef570d106/schema)