--- title: "POST /api/v1/config/log-ingest-config" method: POST path: "/api/v1/config/log-ingest-config" tags: ["LogIngestConfig"] --- # POST /api/v1/config/log-ingest-config `POST /api/v1/config/log-ingest-config` ## Request body - Configv1CreateLogIngestConfigRequest - `dry_run` boolean — If `true`, validates the specified configuration without creating the LogIngestConfig. If the specified configuration is valid, the endpoint returns a partial response without the LogIngestConfig. If the specified configuration is invalid, the endpoint returns an error. - `log_ingest_config` Configv1LogIngestConfig — LogIngestConfig is a singleton configuration object that specifies the configuration for log ingest. - `created_at` string, date-time — Timestamp of when the LogIngestConfig was created. Cannot be set by clients. - `field_normalization` LogIngestConfigFieldNormalization — FieldNormalization allows you to map and normalize well-known fields from your logs. These mappings run after parsing to standardize common fields like timestamp, severity level, and message across different log formats. - `custom_field_normalization` LogIngestConfigNamedStringNormalization[] — Maps additional custom fields from your logs. These will not be indexed. Use these for any other fields you want to normalize, such as environment, region, or user ID. - `normalization` LogIngestConfigStringNormalization — StringNormalization defines how to extract and transform string values from log fields. - `default_value` string — Default value to use when no source fields contain values. - `sanitize_patterns` string[] — Optional regex patterns to extract and sanitize values. Each pattern must have exactly one capturing group that will be used as the result. For example: "^.*level=([A-Z]+).*$" to extract log level from a string. - `source` Configv1LogFieldPath[] — List of field paths to check for values, in priority order. The first non-empty value found will be used. - `selector` string — The log filter used to indicate the field path. Use `parent[child]` syntax to indicate nesting. - `value_map` object — Optional mapping to normalize values. For example: {"warn": "WARNING", "err": "ERROR"} to standardize severity levels. - `target` string — The name of the target field where the normalized value will be stored. - `message` LogIngestConfigStringNormalization — StringNormalization defines how to extract and transform string values from log fields. - `default_value` string — Default value to use when no source fields contain values. - `sanitize_patterns` string[] — Optional regex patterns to extract and sanitize values. Each pattern must have exactly one capturing group that will be used as the result. For example: "^.*level=([A-Z]+).*$" to extract log level from a string. - `source` Configv1LogFieldPath[] — List of field paths to check for values, in priority order. The first non-empty value found will be used. - `selector` string — The log filter used to indicate the field path. Use `parent[child]` syntax to indicate nesting. - `value_map` object — Optional mapping to normalize values. For example: {"warn": "WARNING", "err": "ERROR"} to standardize severity levels. - `service` LogIngestConfigStringNormalization — StringNormalization defines how to extract and transform string values from log fields. - `default_value` string — Default value to use when no source fields contain values. - `sanitize_patterns` string[] — Optional regex patterns to extract and sanitize values. Each pattern must have exactly one capturing group that will be used as the result. For example: "^.*level=([A-Z]+).*$" to extract log level from a string. - `source` Configv1LogFieldPath[] — List of field paths to check for values, in priority order. The first non-empty value found will be used. - `selector` string — The log filter used to indicate the field path. Use `parent[child]` syntax to indicate nesting. - `value_map` object — Optional mapping to normalize values. For example: {"warn": "WARNING", "err": "ERROR"} to standardize severity levels. - `severity` LogIngestConfigStringNormalization — StringNormalization defines how to extract and transform string values from log fields. - `default_value` string — Default value to use when no source fields contain values. - `sanitize_patterns` string[] — Optional regex patterns to extract and sanitize values. Each pattern must have exactly one capturing group that will be used as the result. For example: "^.*level=([A-Z]+).*$" to extract log level from a string. - `source` Configv1LogFieldPath[] — List of field paths to check for values, in priority order. The first non-empty value found will be used. - `selector` string — The log filter used to indicate the field path. Use `parent[child]` syntax to indicate nesting. - `value_map` object — Optional mapping to normalize values. For example: {"warn": "WARNING", "err": "ERROR"} to standardize severity levels. - `timestamp` LogIngestConfigTimestampNormalization — TimestampNormalization specifies which fields to check for timestamp values. - `source` Configv1LogFieldPath[] — List of field paths to check for timestamp values, in priority order. Common fields include "timestamp", "@timestamp", "time", "datetime". - `selector` string — The log filter used to indicate the field path. Use `parent[child]` syntax to indicate nesting. - `field_parsers` LogIngestConfigLogFieldParser[] — The parsers to apply to specific fields within structured logs or plaintext logs after those logs are parsed. - `destination` Configv1LogFieldPath - `selector` string — The log filter used to indicate the field path. Use `parent[child]` syntax to indicate nesting. - `mode` 'ENABLED' | 'DISABLED' - `parser` LogIngestConfigLogParser - `grok_parser` LogParserGrokParser - `pattern` string — The grok pattern to apply. Named capture groups become named fields in the extracted log. - `key_value_parser` LogParserKeyValueParser — A parser to extract key/value pairs from a string. If duplicate keys are found, the first instance is used. - `delimiter` string, required — The string for splitting the input into key/value pairs. - `pair_separator` string, required — The string for splitting each pair into its key and value. - `trim_set` string — Specifies the code points of any Unicode characters to trim from the beginning and end of keys and values. - `parser_type` 'JSON' | 'REGEX' | 'KEY_VALUE' | 'GROK' - `regex_parser` LogParserRegexParser - `regex` string — The regular expression parser pattern to apply. Must use RE2 syntax. Named capturing groups become named fields in the extracted log. - `source` Configv1LogFieldPath - `selector` string — The log filter used to indicate the field path. Use `parent[child]` syntax to indicate nesting. - `plaintext_parsers` LogIngestConfigPlaintextParser[] — The parsers to apply to plaintext logs. The first parser that matches the log is used. - `keep_original` boolean — If `true`, the original log is retained after parsing and stored in the key `plaintext_log`. If `false`, the original log is dropped after parsing. Default value: `false`. - `mode` 'ENABLED' | 'DISABLED' - `name` string — The name of the parser. Must be unique within the configuration. - `parser` LogIngestConfigLogParser - `grok_parser` LogParserGrokParser - `pattern` string — The grok pattern to apply. Named capture groups become named fields in the extracted log. - `key_value_parser` LogParserKeyValueParser — A parser to extract key/value pairs from a string. If duplicate keys are found, the first instance is used. - `delimiter` string, required — The string for splitting the input into key/value pairs. - `pair_separator` string, required — The string for splitting each pair into its key and value. - `trim_set` string — Specifies the code points of any Unicode characters to trim from the beginning and end of keys and values. - `parser_type` 'JSON' | 'REGEX' | 'KEY_VALUE' | 'GROK' - `regex_parser` LogParserRegexParser - `regex` string — The regular expression parser pattern to apply. Must use RE2 syntax. Named capturing groups become named fields in the extracted log. - `updated_at` string, date-time — Timestamp of when the LogIngestConfig was last updated. Cannot be set by clients. ## Response `200` A successful response containing the created LogIngestConfig. - Configv1CreateLogIngestConfigResponse - `log_ingest_config` Configv1LogIngestConfig — LogIngestConfig is a singleton configuration object that specifies the configuration for log ingest. - `created_at` string, date-time — Timestamp of when the LogIngestConfig was created. Cannot be set by clients. - `field_normalization` LogIngestConfigFieldNormalization — FieldNormalization allows you to map and normalize well-known fields from your logs. These mappings run after parsing to standardize common fields like timestamp, severity level, and message across different log formats. - `custom_field_normalization` LogIngestConfigNamedStringNormalization[] — Maps additional custom fields from your logs. These will not be indexed. Use these for any other fields you want to normalize, such as environment, region, or user ID. - `normalization` LogIngestConfigStringNormalization — StringNormalization defines how to extract and transform string values from log fields. - `default_value` string — Default value to use when no source fields contain values. - `sanitize_patterns` string[] — Optional regex patterns to extract and sanitize values. Each pattern must have exactly one capturing group that will be used as the result. For example: "^.*level=([A-Z]+).*$" to extract log level from a string. - `source` Configv1LogFieldPath[] — List of field paths to check for values, in priority order. The first non-empty value found will be used. - `selector` string — The log filter used to indicate the field path. Use `parent[child]` syntax to indicate nesting. - `value_map` object — Optional mapping to normalize values. For example: {"warn": "WARNING", "err": "ERROR"} to standardize severity levels. - `target` string — The name of the target field where the normalized value will be stored. - `message` LogIngestConfigStringNormalization — StringNormalization defines how to extract and transform string values from log fields. - `default_value` string — Default value to use when no source fields contain values. - `sanitize_patterns` string[] — Optional regex patterns to extract and sanitize values. Each pattern must have exactly one capturing group that will be used as the result. For example: "^.*level=([A-Z]+).*$" to extract log level from a string. - `source` Configv1LogFieldPath[] — List of field paths to check for values, in priority order. The first non-empty value found will be used. - `selector` string — The log filter used to indicate the field path. Use `parent[child]` syntax to indicate nesting. - `value_map` object — Optional mapping to normalize values. For example: {"warn": "WARNING", "err": "ERROR"} to standardize severity levels. - `service` LogIngestConfigStringNormalization — StringNormalization defines how to extract and transform string values from log fields. - `default_value` string — Default value to use when no source fields contain values. - `sanitize_patterns` string[] — Optional regex patterns to extract and sanitize values. Each pattern must have exactly one capturing group that will be used as the result. For example: "^.*level=([A-Z]+).*$" to extract log level from a string. - `source` Configv1LogFieldPath[] — List of field paths to check for values, in priority order. The first non-empty value found will be used. - `selector` string — The log filter used to indicate the field path. Use `parent[child]` syntax to indicate nesting. - `value_map` object — Optional mapping to normalize values. For example: {"warn": "WARNING", "err": "ERROR"} to standardize severity levels. - `severity` LogIngestConfigStringNormalization — StringNormalization defines how to extract and transform string values from log fields. - `default_value` string — Default value to use when no source fields contain values. - `sanitize_patterns` string[] — Optional regex patterns to extract and sanitize values. Each pattern must have exactly one capturing group that will be used as the result. For example: "^.*level=([A-Z]+).*$" to extract log level from a string. - `source` Configv1LogFieldPath[] — List of field paths to check for values, in priority order. The first non-empty value found will be used. - `selector` string — The log filter used to indicate the field path. Use `parent[child]` syntax to indicate nesting. - `value_map` object — Optional mapping to normalize values. For example: {"warn": "WARNING", "err": "ERROR"} to standardize severity levels. - `timestamp` LogIngestConfigTimestampNormalization — TimestampNormalization specifies which fields to check for timestamp values. - `source` Configv1LogFieldPath[] — List of field paths to check for timestamp values, in priority order. Common fields include "timestamp", "@timestamp", "time", "datetime". - `selector` string — The log filter used to indicate the field path. Use `parent[child]` syntax to indicate nesting. - `field_parsers` LogIngestConfigLogFieldParser[] — The parsers to apply to specific fields within structured logs or plaintext logs after those logs are parsed. - `destination` Configv1LogFieldPath - `selector` string — The log filter used to indicate the field path. Use `parent[child]` syntax to indicate nesting. - `mode` 'ENABLED' | 'DISABLED' - `parser` LogIngestConfigLogParser - `grok_parser` LogParserGrokParser - `pattern` string — The grok pattern to apply. Named capture groups become named fields in the extracted log. - `key_value_parser` LogParserKeyValueParser — A parser to extract key/value pairs from a string. If duplicate keys are found, the first instance is used. - `delimiter` string, required — The string for splitting the input into key/value pairs. - `pair_separator` string, required — The string for splitting each pair into its key and value. - `trim_set` string — Specifies the code points of any Unicode characters to trim from the beginning and end of keys and values. - `parser_type` 'JSON' | 'REGEX' | 'KEY_VALUE' | 'GROK' - `regex_parser` LogParserRegexParser - `regex` string — The regular expression parser pattern to apply. Must use RE2 syntax. Named capturing groups become named fields in the extracted log. - `source` Configv1LogFieldPath - `selector` string — The log filter used to indicate the field path. Use `parent[child]` syntax to indicate nesting. - `plaintext_parsers` LogIngestConfigPlaintextParser[] — The parsers to apply to plaintext logs. The first parser that matches the log is used. - `keep_original` boolean — If `true`, the original log is retained after parsing and stored in the key `plaintext_log`. If `false`, the original log is dropped after parsing. Default value: `false`. - `mode` 'ENABLED' | 'DISABLED' - `name` string — The name of the parser. Must be unique within the configuration. - `parser` LogIngestConfigLogParser - `grok_parser` LogParserGrokParser - `pattern` string — The grok pattern to apply. Named capture groups become named fields in the extracted log. - `key_value_parser` LogParserKeyValueParser — A parser to extract key/value pairs from a string. If duplicate keys are found, the first instance is used. - `delimiter` string, required — The string for splitting the input into key/value pairs. - `pair_separator` string, required — The string for splitting each pair into its key and value. - `trim_set` string — Specifies the code points of any Unicode characters to trim from the beginning and end of keys and values. - `parser_type` 'JSON' | 'REGEX' | 'KEY_VALUE' | 'GROK' - `regex_parser` LogParserRegexParser - `regex` string — The regular expression parser pattern to apply. Must use RE2 syntax. Named capturing groups become named fields in the extracted log. - `updated_at` string, date-time — Timestamp of when the LogIngestConfig was last updated. Cannot be set by clients. ## Other responses - `400` — Cannot create the LogIngestConfig because the request is invalid. - `409` — Cannot create the LogIngestConfig because there is a conflict with an existing LogIngestConfig. - `500` — An unexpected error response. - `default` — An undefined error response. --- [API](https://skmtc.dev/chronosphere/apis/data-v1-api.md) · [All operations](https://skmtc.dev/chronosphere/apis/data-v1-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/chronosphere/data-v1-api/revisions/ee91fd539ced/schema)