--- title: "Update a Collector" method: PATCH path: "/lib/jobs/{id}" tags: ["collectors"] --- # Update a Collector `PATCH /lib/jobs/{id}` Update the specified Collector.

Provide a complete representation of the Collector that you want to update in the request body. This endpoint does not support partial updates. Cribl removes any omitted fields when updating the Collector.

Confirm that the configuration in your request body is correct before sending the request. If the configuration is incorrect, the updated Collector might not function as expected. ## Path parameters - `id` string, required ## Query parameters - `criblPack` string ## Request body - union - SavedJobCollection - `id` string — Unique ID for this Job - `description` string - `type` 'collection' | 'executor' | 'scheduledSearch', required - `ttl` string — Time to keep the job's artifacts on disk after job completion. This also affects how long a job is listed in the Job Inspector. - `ignoreGroupJobsLimit` boolean — When enabled, this job's artifacts are not counted toward the Worker Group's finished job artifacts limit. Artifacts will be removed only after the Collector's configured time to live. - `removeFields` string[] — List of fields to remove from Discover results. Wildcards (for example, aws*) are allowed. This is useful when discovery returns sensitive fields that should not be exposed in the Jobs user interface. - `resumeOnBoot` boolean — Resume the ad hoc job if a failure condition causes Stream to restart during job execution - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `schedule` ScheduleTypeSavedJobCollection — Configuration for a scheduled job - `enabled` boolean — Enable to configure scheduling for this Collector - `skippable` boolean — Skippable jobs can be delayed, up to their next run time, if the system is hitting concurrency limits - `resumeMissed` boolean — If Stream Leader (or single instance) restarts, run all missed jobs according to their original schedules - `cronSchedule` string — A cron schedule on which to run this job - `maxConcurrentRuns` number — The maximum number of instances of this scheduled job that may be running at any time - `run` RunSettingsTypeSavedJobCollectionSchedule - `type` 'collection' - `rescheduleDroppedTasks` boolean — Reschedule tasks that failed with non-fatal errors - `maxTaskReschedule` number — Maximum number of times a task can be rescheduled - `logLevel` 'error' | 'warn' | 'info' | 'debug' | 'silly' — Level at which to set task logging - `jobTimeout` string — Maximum time the job is allowed to run. Time unit defaults to seconds if not specified (examples: 30, 45s, 15m). Enter 0 for unlimited time. - `mode` string, required — Job run mode. Preview will either return up to N matching results, or will run until capture time T is reached. Discovery will gather the list of files to turn into streaming tasks, without running the data collection job. Full Run will run the collection job. - `timeRangeType` string - `earliest` number — Earliest time to collect data for the selected timezone - `latest` number — Latest time to collect data for the selected timezone - `timestampTimezone` unknown - `timeWarning` MetricsStore - `expression` string — A filter for tokens in the provided collect path and/or the events being collected - `minTaskSize` string — Limits the bundle size for small tasks. For example, if your lower bundle size is 1MB, you can bundle up to five 200KB files into one task. - `maxTaskSize` string — Limits the bundle size for files above the lower task bundle size. For example, if your upper bundle size is 10MB, you can bundle up to five 2MB files into one task. Files greater than this size will be assigned to individual tasks. - `streamtags` string[] — Tags for filtering and grouping in @{product} - `workerAffinity` boolean — If enabled, tasks are created and run by the same Worker Node - `collector` union, required — Collector configuration - CollectorAzureBlob — AzureBlob collector configuration - `type` 'azure_blob', required — Collector type - `conf` union, required — Collector configuration - object - `outputName` string — An optional predefined Destination that will be used to auto-populate Collector settings - `authType` 'manual' — Enter authentication data directly, or select a secret referencing your auth data - `containerName` string, required — Container to collect from. This value can be a constant, or a JavaScript expression that can only be evaluated at init time. Example referencing a Global Variable: myBucket-${C.vars.myVar} - `path` string — The directory from which to collect data. Templating is supported, such as myDir/${datacenter}/${host}/${app}/. Time-based tokens are supported, such as myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/. - `extractors` object[] — Extractors allow use of template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)} will enrich discovery results with a human-readable "date" field. - … - `recurse` boolean — Recurse through subdirectories - `includeMetadata` boolean — Include Azure Blob metadata in collected events. In each event, metadata will be located at: __collectible.metadata. - `includeTags` boolean — Include Azure Blob tags in collected events. In each event, tags will be located at: __collectible.tags. Disable this feature when using a Shared Access Signature Connection String, to prevent errors. - `maxBatchSize` number — Maximum number of metadata objects to batch before recording as results - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk - `parquetChunkDownloadTimeout` number — The maximum time allowed for downloading a Parquet chunk. Processing will abort if a chunk cannot be downloaded within the time specified. - `connectionString` string, required — Enter your Azure storage account Connection String. If left blank, Cribl Stream will fall back to env.AZURE_STORAGE_CONNECTION_STRING. - object - `outputName` string — An optional predefined Destination that will be used to auto-populate Collector settings - `authType` 'secret' — Enter authentication data directly, or select a secret referencing your auth data - `containerName` string, required — Container to collect from. This value can be a constant, or a JavaScript expression that can only be evaluated at init time. Example referencing a Global Variable: myBucket-${C.vars.myVar} - `path` string — The directory from which to collect data. Templating is supported, such as myDir/${datacenter}/${host}/${app}/. Time-based tokens are supported, such as myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/. - `extractors` object[] — Extractors allow use of template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)} will enrich discovery results with a human-readable "date" field. - … - `recurse` boolean — Recurse through subdirectories - `includeMetadata` boolean — Include Azure Blob metadata in collected events. In each event, metadata will be located at: __collectible.metadata. - `includeTags` boolean — Include Azure Blob tags in collected events. In each event, tags will be located at: __collectible.tags. Disable this feature when using a Shared Access Signature Connection String, to prevent errors. - `maxBatchSize` number — Maximum number of metadata objects to batch before recording as results - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk - `parquetChunkDownloadTimeout` number — The maximum time allowed for downloading a Parquet chunk. Processing will abort if a chunk cannot be downloaded within the time specified. - `textSecret` string, required — Text secret - object - `outputName` string — An optional predefined Destination that will be used to auto-populate Collector settings - `authType` 'clientSecret' — Enter authentication data directly, or select a secret referencing your auth data - `containerName` string, required — Container to collect from. This value can be a constant, or a JavaScript expression that can only be evaluated at init time. Example referencing a Global Variable: myBucket-${C.vars.myVar} - `path` string — The directory from which to collect data. Templating is supported, such as myDir/${datacenter}/${host}/${app}/. Time-based tokens are supported, such as myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/. - `extractors` object[] — Extractors allow use of template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)} will enrich discovery results with a human-readable "date" field. - … - `recurse` boolean — Recurse through subdirectories - `includeMetadata` boolean — Include Azure Blob metadata in collected events. In each event, metadata will be located at: __collectible.metadata. - `includeTags` boolean — Include Azure Blob tags in collected events. In each event, tags will be located at: __collectible.tags. Disable this feature when using a Shared Access Signature Connection String, to prevent errors. - `maxBatchSize` number — Maximum number of metadata objects to batch before recording as results - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk - `parquetChunkDownloadTimeout` number — The maximum time allowed for downloading a Parquet chunk. Processing will abort if a chunk cannot be downloaded within the time specified. - `storageAccountName` string, required — The name of your Azure storage account - `tenantId` string, required — The service principal's tenant ID - `clientId` string, required — The service principal's client ID - `clientTextSecret` string, required — Text secret containing the client secret - `endpointSuffix` string — The endpoint suffix for the service URL. Takes precedence over the Azure Cloud setting. Defaults to core.windows.net. - `azureCloud` string — The Azure cloud to use. Defaults to Azure Public Cloud. - object - `outputName` string — An optional predefined Destination that will be used to auto-populate Collector settings - `authType` 'clientCert' — Enter authentication data directly, or select a secret referencing your auth data - `containerName` string, required — Container to collect from. This value can be a constant, or a JavaScript expression that can only be evaluated at init time. Example referencing a Global Variable: myBucket-${C.vars.myVar} - `path` string — The directory from which to collect data. Templating is supported, such as myDir/${datacenter}/${host}/${app}/. Time-based tokens are supported, such as myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/. - `extractors` object[] — Extractors allow use of template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)} will enrich discovery results with a human-readable "date" field. - … - `recurse` boolean — Recurse through subdirectories - `includeMetadata` boolean — Include Azure Blob metadata in collected events. In each event, metadata will be located at: __collectible.metadata. - `includeTags` boolean — Include Azure Blob tags in collected events. In each event, tags will be located at: __collectible.tags. Disable this feature when using a Shared Access Signature Connection String, to prevent errors. - `maxBatchSize` number — Maximum number of metadata objects to batch before recording as results - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk - `parquetChunkDownloadTimeout` number — The maximum time allowed for downloading a Parquet chunk. Processing will abort if a chunk cannot be downloaded within the time specified. - `storageAccountName` string, required — The name of your Azure storage account - `tenantId` string, required — The service principal's tenant ID - `clientId` string, required — The service principal's client ID - `certificate` CertificateTypeAzureBlobAuthTypeClientCert, required - … - `azureCloud` string — The Azure cloud to use. Defaults to Azure Public Cloud. - `endpointSuffix` string — The endpoint suffix for the service URL. Takes precedence over the Azure Cloud setting. Defaults to core.windows.net. - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorCriblLake — CriblLake collector configuration - `type` 'cribl_lake', required — Collector type - `conf` object, required — Collector configuration - `dataset` string, required — Lake dataset to collect data from. - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorDatabase — Database collector configuration - `type` 'database', required — Collector type - `conf` object, required — Collector configuration - `connectionId` string, required — Select an existing Connection, or go to Knowledge > Database Connections to add one - `query` string, required — An expression that resolves to the query string for selecting data from the database. Has access to the special ${earliest} and ${latest} variables, which will resolve to the Collector run's start and end time. - `queryValidationEnabled` boolean — Enforces a basic query validation that allows only a single 'select' statement. Disable for more complex queries or when using semicolons. Caution: Disabling query validation allows DDL and DML statements to be executed, which could be destructive to your database. - `defaultBreakers` 'Cribl' - `__scheduling` object - `stateTracking` object - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorFilesystem — Filesystem collector configuration - `type` 'filesystem', required — Collector type - `conf` object, required — Collector configuration - `outputName` string — Select a predefined configuration (a Destination) to auto-populate Collector settings - `path` string, required — The directory from which to collect data. Templating is supported, such as /myDir/${datacenter}/${host}/${app}/. Time-based tokens are also supported, such as /myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/. - `extractors` object[] — Allows using template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)}, will enrich discovery results with a human readable "date" field. - `key` string, required — A token from the template directory, such as epoch - `expression` string, required — JavaScript expression that receives token under "value" variable, and evaluates to populate event fields, such as {date: new Date(+value*1000)} - `recurse` boolean — Recurse through subdirectories - `maxBatchSize` number — Maximum number of metadata files to batch before recording as results - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorGoogleCloudStorage — GoogleCloudStorage collector configuration - `type` 'google_cloud_storage', required — Collector type - `conf` union, required — Collector configuration - object - `outputName` string — Name of the predefined Destination that will be used to auto-populate Collector settings - `bucket` string, required — Name of the bucket to collect from. This value can be a constant or a JavaScript expression that can only be evaluated at init time. Example referencing a Global Variable: `myBucket-${C.vars.myVar}`. - `path` string — The directory from which to collect data. Templating is supported, such as myDir/${datacenter}/${host}/${app}/. Time-based tokens are also supported, such as myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/. - `extractors` object[] — Allows using template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)}, will enrich discovery results with a human readable "date" field. - … - `endpoint` string — Google Cloud Storage service endpoint. If empty, the endpoint will default to https://storage.googleapis.com. - `disableTimeFilter` boolean — Used to disable Collector event time filtering when a date range is specified - `recurse` boolean — Recurse through subdirectories - `maxBatchSize` number — Maximum number of metadata objects to batch before recording as results - `authType` 'auto' — Enter account credentials manually, select a secret that references your credentials, or use Google Application Default Credentials - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk - `parquetChunkDownloadTimeout` number — The maximum time allowed for downloading a Parquet chunk. Processing will abort if a chunk cannot be downloaded within the time specified. - object - `outputName` string — Name of the predefined Destination that will be used to auto-populate Collector settings - `bucket` string, required — Name of the bucket to collect from. This value can be a constant or a JavaScript expression that can only be evaluated at init time. Example referencing a Global Variable: `myBucket-${C.vars.myVar}`. - `path` string — The directory from which to collect data. Templating is supported, such as myDir/${datacenter}/${host}/${app}/. Time-based tokens are also supported, such as myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/. - `extractors` object[] — Allows using template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)}, will enrich discovery results with a human readable "date" field. - … - `endpoint` string — Google Cloud Storage service endpoint. If empty, the endpoint will default to https://storage.googleapis.com. - `disableTimeFilter` boolean — Used to disable Collector event time filtering when a date range is specified - `recurse` boolean — Recurse through subdirectories - `maxBatchSize` number — Maximum number of metadata objects to batch before recording as results - `authType` 'manual' — Enter account credentials manually, select a secret that references your credentials, or use Google Application Default Credentials - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk - `parquetChunkDownloadTimeout` number — The maximum time allowed for downloading a Parquet chunk. Processing will abort if a chunk cannot be downloaded within the time specified. - `serviceAccountCredentials` string, required — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload button at this field's upper right. - object - `outputName` string — Name of the predefined Destination that will be used to auto-populate Collector settings - `bucket` string, required — Name of the bucket to collect from. This value can be a constant or a JavaScript expression that can only be evaluated at init time. Example referencing a Global Variable: `myBucket-${C.vars.myVar}`. - `path` string — The directory from which to collect data. Templating is supported, such as myDir/${datacenter}/${host}/${app}/. Time-based tokens are also supported, such as myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/. - `extractors` object[] — Allows using template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)}, will enrich discovery results with a human readable "date" field. - … - `endpoint` string — Google Cloud Storage service endpoint. If empty, the endpoint will default to https://storage.googleapis.com. - `disableTimeFilter` boolean — Used to disable Collector event time filtering when a date range is specified - `recurse` boolean — Recurse through subdirectories - `maxBatchSize` number — Maximum number of metadata objects to batch before recording as results - `authType` 'secret' — Enter account credentials manually, select a secret that references your credentials, or use Google Application Default Credentials - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk - `parquetChunkDownloadTimeout` number — The maximum time allowed for downloading a Parquet chunk. Processing will abort if a chunk cannot be downloaded within the time specified. - `textSecret` string, required — Select or create a stored text secret that references your credentials - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorHealthCheck — HealthCheck collector configuration - `type` 'health_check', required — Collector type - `conf` union, required - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'get', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'none', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectRequestParams` object[] — Optional health check request parameters. - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'get', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'basic', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectRequestParams` object[] — Optional health check request parameters. - … - `username` string, required — Basic authentication username - `password` string, required — Basic authentication password - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'get', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'basicSecret', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectRequestParams` object[] — Optional health check request parameters. - … - `credentialsSecret` string, required — Select or create a stored secret that references your credentials - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'get', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'login', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectRequestParams` object[] — Optional health check request parameters. - … - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST. - `username` string, required — Login username - `password` string, required — Login password - `loginBody` string, required — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeHealthCheckAuthenticationLoginAuthRequestHeaders[] — Optional authentication request headers. - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'get', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'loginSecret', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectRequestParams` object[] — Optional health check request parameters. - … - `loginUrl` string, required — URL to use for login API call, this call is expected to be a POST. - `credentialsSecret` string, required — Select or create a stored secret that references your login credentials - `loginBody` string, required — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. If left blank, the entire response body will be used to derive the authorization header. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeHealthCheckAuthenticationLoginAuthRequestHeaders[] — Optional authentication request headers. - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'get', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'oauth', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectRequestParams` object[] — Optional health check request parameters. - … - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST. - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login. - `clientSecretParamName` string, required — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters. - `clientSecretParamValue` string, required — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters - `authRequestParams` ItemsTypeHealthCheckAuthenticationOauthAuthRequestParams[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded. - … - `authRequestHeaders` ItemsTypeHealthCheckAuthenticationOauthAuthRequestHeaders[] — Optional authentication request headers. - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'get', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'oauthSecret', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectRequestParams` object[] — Optional health check request parameters. - … - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST. - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login. - `clientSecretParamName` string, required — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters. - `textSecret` string, required — Select or create a text secret that contains the client secret's value. - `authRequestParams` ItemsTypeHealthCheckAuthenticationOauthAuthRequestParams[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded. - … - `authRequestHeaders` ItemsTypeHealthCheckAuthenticationOauthAuthRequestHeaders[] — Optional authentication request headers. - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'post', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'none', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectRequestParams` ItemsTypeHealthCheckCollectMethodPostCollectRequestParams[] — Optional health check request parameters. - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'post', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'basic', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectRequestParams` ItemsTypeHealthCheckCollectMethodPostCollectRequestParams[] — Optional health check request parameters. - … - `username` string, required — Basic authentication username - `password` string, required — Basic authentication password - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'post', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'basicSecret', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectRequestParams` ItemsTypeHealthCheckCollectMethodPostCollectRequestParams[] — Optional health check request parameters. - … - `credentialsSecret` string, required — Select or create a stored secret that references your credentials - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'post', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'login', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectRequestParams` ItemsTypeHealthCheckCollectMethodPostCollectRequestParams[] — Optional health check request parameters. - … - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST. - `username` string, required — Login username - `password` string, required — Login password - `loginBody` string, required — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeHealthCheckAuthenticationLoginAuthRequestHeaders[] — Optional authentication request headers. - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'post', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'loginSecret', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectRequestParams` ItemsTypeHealthCheckCollectMethodPostCollectRequestParams[] — Optional health check request parameters. - … - `loginUrl` string, required — URL to use for login API call, this call is expected to be a POST. - `credentialsSecret` string, required — Select or create a stored secret that references your login credentials - `loginBody` string, required — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. If left blank, the entire response body will be used to derive the authorization header. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeHealthCheckAuthenticationLoginAuthRequestHeaders[] — Optional authentication request headers. - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'post', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'oauth', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectRequestParams` ItemsTypeHealthCheckCollectMethodPostCollectRequestParams[] — Optional health check request parameters. - … - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST. - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login. - `clientSecretParamName` string, required — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters. - `clientSecretParamValue` string, required — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters - `authRequestParams` ItemsTypeHealthCheckAuthenticationOauthAuthRequestParams[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded. - … - `authRequestHeaders` ItemsTypeHealthCheckAuthenticationOauthAuthRequestHeaders[] — Optional authentication request headers. - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'post', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'oauthSecret', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectRequestParams` ItemsTypeHealthCheckCollectMethodPostCollectRequestParams[] — Optional health check request parameters. - … - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST. - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login. - `clientSecretParamName` string, required — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters. - `textSecret` string, required — Select or create a text secret that contains the client secret's value. - `authRequestParams` ItemsTypeHealthCheckAuthenticationOauthAuthRequestParams[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded. - … - `authRequestHeaders` ItemsTypeHealthCheckAuthenticationOauthAuthRequestHeaders[] — Optional authentication request headers. - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'post_with_body', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'none', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectBody` string — Template for POST body to send with the health check request. You can reference parameters from the Discover response, using template params of the form: ${variable}. - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'post_with_body', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'basic', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectBody` string — Template for POST body to send with the health check request. You can reference parameters from the Discover response, using template params of the form: ${variable}. - `username` string, required — Basic authentication username - `password` string, required — Basic authentication password - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'post_with_body', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'basicSecret', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectBody` string — Template for POST body to send with the health check request. You can reference parameters from the Discover response, using template params of the form: ${variable}. - `credentialsSecret` string, required — Select or create a stored secret that references your credentials - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'post_with_body', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'login', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectBody` string — Template for POST body to send with the health check request. You can reference parameters from the Discover response, using template params of the form: ${variable}. - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST. - `username` string, required — Login username - `password` string, required — Login password - `loginBody` string, required — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeHealthCheckAuthenticationLoginAuthRequestHeaders[] — Optional authentication request headers. - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'post_with_body', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'loginSecret', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectBody` string — Template for POST body to send with the health check request. You can reference parameters from the Discover response, using template params of the form: ${variable}. - `loginUrl` string, required — URL to use for login API call, this call is expected to be a POST. - `credentialsSecret` string, required — Select or create a stored secret that references your login credentials - `loginBody` string, required — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. If left blank, the entire response body will be used to derive the authorization header. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeHealthCheckAuthenticationLoginAuthRequestHeaders[] — Optional authentication request headers. - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'post_with_body', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'oauth', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectBody` string — Template for POST body to send with the health check request. You can reference parameters from the Discover response, using template params of the form: ${variable}. - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST. - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login. - `clientSecretParamName` string, required — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters. - `clientSecretParamValue` string, required — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters - `authRequestParams` ItemsTypeHealthCheckAuthenticationOauthAuthRequestParams[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded. - … - `authRequestHeaders` ItemsTypeHealthCheckAuthenticationOauthAuthRequestHeaders[] — Optional authentication request headers. - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant). - `collectMethod` 'post_with_body', required — Health check HTTP method. - `collectRequestHeaders` object[] — Optional health check request headers. - … - `authenticateCollect` boolean — Enable to make auth health check call. - `authentication` 'oauthSecret', required — Authentication method for Discover and Collect REST calls. You can specify API Key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates). - `defaultBreakers` 'Cribl' - `safeHeaders` string[] — List of headers that are safe to log in plain text. - `retryRules` union - … - `collectBody` string — Template for POST body to send with the health check request. You can reference parameters from the Discover response, using template params of the form: ${variable}. - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST. - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login. - `clientSecretParamName` string, required — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters. - `textSecret` string, required — Select or create a text secret that contains the client secret's value. - `authRequestParams` ItemsTypeHealthCheckAuthenticationOauthAuthRequestParams[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded. - … - `authRequestHeaders` ItemsTypeHealthCheckAuthenticationOauthAuthRequestHeaders[] — Optional authentication request headers. - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorRest — Rest collector configuration - `type` 'rest', required — Collector type - `conf` union, required - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'get', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'none', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'get', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'basic', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `username` string, required - `password` string, required - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'get', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'basicSecret', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `credentialsSecret` string, required — Select or create a stored secret that references your credentials - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'get', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'login', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST. - `username` string, required - `password` string, required - `loginBody` string, required — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. - `getAuthTokenFromHeader` false — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'get', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'login', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST. - `username` string, required - `password` string, required - `loginBody` string, required — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. - `getAuthTokenFromHeader` true — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'get', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'loginSecret', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST. - `credentialsSecret` string, required — Select or create a stored secret that references your login credentials - `loginBody` string, required — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. - `getAuthTokenFromHeader` false — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'get', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'loginSecret', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST. - `credentialsSecret` string, required — Select or create a stored secret that references your login credentials - `loginBody` string, required — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. - `getAuthTokenFromHeader` true — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'get', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'oauth', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST. - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `clientSecretParamName` string, required — Defaults to 'client_secret'. Automatically added to request parameters using the value specified. - `clientSecretParamValue` string, required — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters. - `authRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded. - … - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'get', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'oauthSecret', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST. - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `clientSecretParamName` string, required — Defaults to 'client_secret'. Automatically added to request parameters using the value specified. - `textSecret` string, required — Select or create a text secret that contains the client secret's value - `authRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded. - … - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'get', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'google_oauth', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `scopes` string[], required — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information. - `serviceAccountCredentials` string, required — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right. - `subject` string, required — Email address of a user account with Super Admin permissions to the resources the collector will retrieve - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'get', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'google_oauthSecret', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `scopes` string[], required — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information. - `textSecret` string, required — Select or create a text secret that contains the Google service account credentials value - `subject` string, required — Email address of a user account with Super Admin permissions to the resources the collector will retrieve - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'get', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'hmac', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `hmacFunctionId` string, required — Select or create an HMAC Function to use with authentication - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'none', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'basic', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `username` string, required - `password` string, required - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'basicSecret', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `credentialsSecret` string, required — Select or create a stored secret that references your credentials - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'login', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST. - `username` string, required - `password` string, required - `loginBody` string, required — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. - `getAuthTokenFromHeader` false — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'login', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST. - `username` string, required - `password` string, required - `loginBody` string, required — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. - `getAuthTokenFromHeader` true — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'loginSecret', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST. - `credentialsSecret` string, required — Select or create a stored secret that references your login credentials - `loginBody` string, required — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. - `getAuthTokenFromHeader` false — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'loginSecret', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST. - `credentialsSecret` string, required — Select or create a stored secret that references your login credentials - `loginBody` string, required — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. - `getAuthTokenFromHeader` true — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'oauth', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST. - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `clientSecretParamName` string, required — Defaults to 'client_secret'. Automatically added to request parameters using the value specified. - `clientSecretParamValue` string, required — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters. - `authRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded. - … - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'oauthSecret', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST. - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `clientSecretParamName` string, required — Defaults to 'client_secret'. Automatically added to request parameters using the value specified. - `textSecret` string, required — Select or create a text secret that contains the client secret's value - `authRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded. - … - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'google_oauth', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `scopes` string[], required — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information. - `serviceAccountCredentials` string, required — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right. - `subject` string, required — Email address of a user account with Super Admin permissions to the resources the collector will retrieve - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'google_oauthSecret', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `scopes` string[], required — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information. - `textSecret` string, required — Select or create a text secret that contains the Google service account credentials value - `subject` string, required — Email address of a user account with Super Admin permissions to the resources the collector will retrieve - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'hmac', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `hmacFunctionId` string, required — Select or create an HMAC Function to use with authentication - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post_with_body', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'none', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectBody` string, required — Template for POST body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template params: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post_with_body', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'basic', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectBody` string, required — Template for POST body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template params: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `username` string, required - `password` string, required - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post_with_body', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'basicSecret', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectBody` string, required — Template for POST body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template params: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `credentialsSecret` string, required — Select or create a stored secret that references your credentials - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post_with_body', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'login', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectBody` string, required — Template for POST body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template params: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST. - `username` string, required - `password` string, required - `loginBody` string, required — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. - `getAuthTokenFromHeader` false — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post_with_body', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'login', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectBody` string, required — Template for POST body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template params: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST. - `username` string, required - `password` string, required - `loginBody` string, required — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. - `getAuthTokenFromHeader` true — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post_with_body', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'loginSecret', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectBody` string, required — Template for POST body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template params: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST. - `credentialsSecret` string, required — Select or create a stored secret that references your login credentials - `loginBody` string, required — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. - `getAuthTokenFromHeader` false — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post_with_body', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'loginSecret', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectBody` string, required — Template for POST body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template params: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST. - `credentialsSecret` string, required — Select or create a stored secret that references your login credentials - `loginBody` string, required — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. - `getAuthTokenFromHeader` true — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post_with_body', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'oauth', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectBody` string, required — Template for POST body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template params: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST. - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `clientSecretParamName` string, required — Defaults to 'client_secret'. Automatically added to request parameters using the value specified. - `clientSecretParamValue` string, required — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters. - `authRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded. - … - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post_with_body', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'oauthSecret', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectBody` string, required — Template for POST body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template params: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST. - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `clientSecretParamName` string, required — Defaults to 'client_secret'. Automatically added to request parameters using the value specified. - `textSecret` string, required — Select or create a text secret that contains the client secret's value - `authRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded. - … - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post_with_body', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'google_oauth', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectBody` string, required — Template for POST body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template params: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `scopes` string[], required — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information. - `serviceAccountCredentials` string, required — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right. - `subject` string, required — Email address of a user account with Super Admin permissions to the resources the collector will retrieve - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post_with_body', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'google_oauthSecret', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectBody` string, required — Template for POST body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template params: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `scopes` string[], required — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information. - `textSecret` string, required — Select or create a text secret that contains the Google service account credentials value - `subject` string, required — Email address of a user account with Super Admin permissions to the resources the collector will retrieve - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'post_with_body', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'hmac', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectBody` string, required — Template for POST body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template params: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `hmacFunctionId` string, required — Select or create an HMAC Function to use with authentication - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'other', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'none', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectVerb` string, required — Custom HTTP method to use for the Collect operation - `collectBody` string — Template for body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template parameters: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'other', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'basic', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectVerb` string, required — Custom HTTP method to use for the Collect operation - `collectBody` string — Template for body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template parameters: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `username` string, required - `password` string, required - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'other', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'basicSecret', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectVerb` string, required — Custom HTTP method to use for the Collect operation - `collectBody` string — Template for body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template parameters: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `credentialsSecret` string, required — Select or create a stored secret that references your credentials - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'other', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'login', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectVerb` string, required — Custom HTTP method to use for the Collect operation - `collectBody` string — Template for body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template parameters: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST. - `username` string, required - `password` string, required - `loginBody` string, required — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. - `getAuthTokenFromHeader` false — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'other', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'login', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectVerb` string, required — Custom HTTP method to use for the Collect operation - `collectBody` string — Template for body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template parameters: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST. - `username` string, required - `password` string, required - `loginBody` string, required — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. - `getAuthTokenFromHeader` true — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'other', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'loginSecret', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectVerb` string, required — Custom HTTP method to use for the Collect operation - `collectBody` string — Template for body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template parameters: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST. - `credentialsSecret` string, required — Select or create a stored secret that references your login credentials - `loginBody` string, required — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. - `getAuthTokenFromHeader` false — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'other', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'loginSecret', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectVerb` string, required — Custom HTTP method to use for the Collect operation - `collectBody` string — Template for body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template parameters: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST. - `credentialsSecret` string, required — Select or create a stored secret that references your login credentials - `loginBody` string, required — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. - `getAuthTokenFromHeader` true — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'other', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'oauth', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectVerb` string, required — Custom HTTP method to use for the Collect operation - `collectBody` string — Template for body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template parameters: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST. - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `clientSecretParamName` string, required — Defaults to 'client_secret'. Automatically added to request parameters using the value specified. - `clientSecretParamValue` string, required — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters. - `authRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded. - … - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'other', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'oauthSecret', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectVerb` string, required — Custom HTTP method to use for the Collect operation - `collectBody` string — Template for body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template parameters: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST. - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header. - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'. - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login. - `clientSecretParamName` string, required — Defaults to 'client_secret'. Automatically added to request parameters using the value specified. - `textSecret` string, required — Select or create a text secret that contains the client secret's value - `authRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded. - … - `authRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'other', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'google_oauth', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectVerb` string, required — Custom HTTP method to use for the Collect operation - `collectBody` string — Template for body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template parameters: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `scopes` string[], required — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information. - `serviceAccountCredentials` string, required — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right. - `subject` string, required — Email address of a user account with Super Admin permissions to the resources the collector will retrieve - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'other', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'google_oauthSecret', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectVerb` string, required — Custom HTTP method to use for the Collect operation - `collectBody` string — Template for body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template parameters: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `scopes` string[], required — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information. - `textSecret` string, required — Select or create a text secret that contains the Google service account credentials value - `subject` string, required — Email address of a user account with Super Admin permissions to the resources the collector will retrieve - object — Collector configuration - `discovery` union - … - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation - `collectMethod` 'other', required - `collectRequestHeaders` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `pagination` union - … - `authentication` 'hmac', required — Authentication method for Discover and Collect REST calls. You can specify API key–based authentication by adding the appropriate Collect headers. - `timeout` number — HTTP request inactivity timeout. Use 0 to disable. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests) - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events - `safeHeaders` string[] — List of headers that are safe to log in plain text - `retryRules` union - … - `__scheduling` object - … - `collectVerb` string, required — Custom HTTP method to use for the Collect operation - `collectBody` string — Template for body to send with the Collect request. Reference global variables, functions, or parameters from the Discover response using template parameters: `${C.vars.myVar}`, or `${Date.now()}`, `${param}` - `collectRequestParams` ItemsTypeRestCollectMethodGetCollectRequestParams[] - … - `hmacFunctionId` string, required — Select or create an HMAC Function to use with authentication - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorS3 — S3 collector configuration - `type` 's3', required — Collector type - `conf` union, required - object — Collector configuration - `outputName` string — Name of the predefined Destination that will be used to auto-populate Collector settings - `bucket` string, required — S3 Bucket from which to collect data - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk - `parquetChunkDownloadTimeout` number — Maximum time allowed for downloading a Parquet chunk. Processing will stop if a chunk cannot be downloaded within the time specified. - `region` string — Region from which to retrieve data - `path` string — Directory where data will be collected. Templating (such as 'myDir/${datacenter}/${host}/${app}/') and time-based tokens (such as 'myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/') are supported. Can be a constant (enclosed in quotes) or a JavaScript expression. - `partitioningScheme` 'ddss' — Partitioning scheme used for this dataset. Using a known scheme like DDSS enables more efficient data reading and retrieval. - `extractors` object[] — Allows using template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)}, will enrich discovery results with a human readable "date" field. - … - `awsAuthenticationMethod` 'auto' — AWS authentication method. Choose Auto to use IAM roles. - `endpoint` string — Must point to an S3-compatible endpoint. If empty, defaults to an AWS region-specific endpoint. - `signatureVersion` 'v2' | 'v4' — Signature version to use for signing S3 requests - `enableAssumeRole` boolean — Use AssumeRole credentials - `assumeRoleArn` string — Amazon Resource Name (ARN) of the role to assume - `assumeRoleExternalId` string — External ID to use when assuming role - `durationSeconds` number — Duration of the Assumed Role's session, in seconds. Minimum is 900 (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12 hours). - `maxBatchSize` number — Maximum number of metadata objects to batch before recording as results - `reuseConnections` boolean — Reuse connections between requests to improve performance - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as a self-signed certificate) - `verifyPermissions` boolean — Disable if you can access files within the bucket but not the bucket itself. Resolves errors of the form "discover task initialization failed...error: Forbidden". - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - object — Collector configuration - `outputName` string — Name of the predefined Destination that will be used to auto-populate Collector settings - `bucket` string, required — S3 Bucket from which to collect data - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk - `parquetChunkDownloadTimeout` number — Maximum time allowed for downloading a Parquet chunk. Processing will stop if a chunk cannot be downloaded within the time specified. - `region` string — Region from which to retrieve data - `path` string — Directory where data will be collected. Templating (such as 'myDir/${datacenter}/${host}/${app}/') and time-based tokens (such as 'myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/') are supported. Can be a constant (enclosed in quotes) or a JavaScript expression. - `partitioningScheme` 'ddss' — Partitioning scheme used for this dataset. Using a known scheme like DDSS enables more efficient data reading and retrieval. - `extractors` object[] — Allows using template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)}, will enrich discovery results with a human readable "date" field. - … - `awsAuthenticationMethod` 'manual' — AWS authentication method. Choose Auto to use IAM roles. - `endpoint` string — Must point to an S3-compatible endpoint. If empty, defaults to an AWS region-specific endpoint. - `signatureVersion` 'v2' | 'v4' — Signature version to use for signing S3 requests - `enableAssumeRole` boolean — Use AssumeRole credentials - `assumeRoleArn` string — Amazon Resource Name (ARN) of the role to assume - `assumeRoleExternalId` string — External ID to use when assuming role - `durationSeconds` number — Duration of the Assumed Role's session, in seconds. Minimum is 900 (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12 hours). - `maxBatchSize` number — Maximum number of metadata objects to batch before recording as results - `reuseConnections` boolean — Reuse connections between requests to improve performance - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as a self-signed certificate) - `verifyPermissions` boolean — Disable if you can access files within the bucket but not the bucket itself. Resolves errors of the form "discover task initialization failed...error: Forbidden". - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `awsApiKey` string — Access key. If not present, will fall back to env.AWS_ACCESS_KEY_ID, or to the metadata endpoint for IAM creds. Optional when running on AWS. This value can be a constant or a JavaScript expression. - `awsSecretKey` string — Secret key. If not present, will fall back to env.AWS_SECRET_ACCESS_KEY, or to the metadata endpoint for IAM creds. Optional when running on AWS. This value can be a constant or a JavaScript expression. - object — Collector configuration - `outputName` string — Name of the predefined Destination that will be used to auto-populate Collector settings - `bucket` string, required — S3 Bucket from which to collect data - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk - `parquetChunkDownloadTimeout` number — Maximum time allowed for downloading a Parquet chunk. Processing will stop if a chunk cannot be downloaded within the time specified. - `region` string — Region from which to retrieve data - `path` string — Directory where data will be collected. Templating (such as 'myDir/${datacenter}/${host}/${app}/') and time-based tokens (such as 'myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/') are supported. Can be a constant (enclosed in quotes) or a JavaScript expression. - `partitioningScheme` 'ddss' — Partitioning scheme used for this dataset. Using a known scheme like DDSS enables more efficient data reading and retrieval. - `extractors` object[] — Allows using template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)}, will enrich discovery results with a human readable "date" field. - … - `awsAuthenticationMethod` 'secret' — AWS authentication method. Choose Auto to use IAM roles. - `endpoint` string — Must point to an S3-compatible endpoint. If empty, defaults to an AWS region-specific endpoint. - `signatureVersion` 'v2' | 'v4' — Signature version to use for signing S3 requests - `enableAssumeRole` boolean — Use AssumeRole credentials - `assumeRoleArn` string — Amazon Resource Name (ARN) of the role to assume - `assumeRoleExternalId` string — External ID to use when assuming role - `durationSeconds` number — Duration of the Assumed Role's session, in seconds. Minimum is 900 (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12 hours). - `maxBatchSize` number — Maximum number of metadata objects to batch before recording as results - `reuseConnections` boolean — Reuse connections between requests to improve performance - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as a self-signed certificate) - `verifyPermissions` boolean — Disable if you can access files within the bucket but not the bucket itself. Resolves errors of the form "discover task initialization failed...error: Forbidden". - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `awsSecret` string — Select or create a stored secret that references AWS access key and secret key. - object — Collector configuration - `outputName` string — Name of the predefined Destination that will be used to auto-populate Collector settings - `bucket` string, required — S3 Bucket from which to collect data - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk - `parquetChunkDownloadTimeout` number — Maximum time allowed for downloading a Parquet chunk. Processing will stop if a chunk cannot be downloaded within the time specified. - `region` string — Region from which to retrieve data - `path` string — Directory where data will be collected. Templating (such as 'myDir/${datacenter}/${host}/${app}/') and time-based tokens (such as 'myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/') are supported. Can be a constant (enclosed in quotes) or a JavaScript expression. - `partitioningScheme` 'none' — Partitioning scheme used for this dataset. Using a known scheme like DDSS enables more efficient data reading and retrieval. - `extractors` object[] — Allows using template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)}, will enrich discovery results with a human readable "date" field. - … - `awsAuthenticationMethod` 'auto' — AWS authentication method. Choose Auto to use IAM roles. - `endpoint` string — Must point to an S3-compatible endpoint. If empty, defaults to an AWS region-specific endpoint. - `signatureVersion` 'v2' | 'v4' — Signature version to use for signing S3 requests - `enableAssumeRole` boolean — Use AssumeRole credentials - `assumeRoleArn` string — Amazon Resource Name (ARN) of the role to assume - `assumeRoleExternalId` string — External ID to use when assuming role - `durationSeconds` number — Duration of the Assumed Role's session, in seconds. Minimum is 900 (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12 hours). - `maxBatchSize` number — Maximum number of metadata objects to batch before recording as results - `reuseConnections` boolean — Reuse connections between requests to improve performance - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as a self-signed certificate) - `verifyPermissions` boolean — Disable if you can access files within the bucket but not the bucket itself. Resolves errors of the form "discover task initialization failed...error: Forbidden". - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `recurse` boolean — Traverse and include files from subdirectories. Leave this option enabled to ensure that all nested directories are searched and their contents collected. - object — Collector configuration - `outputName` string — Name of the predefined Destination that will be used to auto-populate Collector settings - `bucket` string, required — S3 Bucket from which to collect data - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk - `parquetChunkDownloadTimeout` number — Maximum time allowed for downloading a Parquet chunk. Processing will stop if a chunk cannot be downloaded within the time specified. - `region` string — Region from which to retrieve data - `path` string — Directory where data will be collected. Templating (such as 'myDir/${datacenter}/${host}/${app}/') and time-based tokens (such as 'myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/') are supported. Can be a constant (enclosed in quotes) or a JavaScript expression. - `partitioningScheme` 'none' — Partitioning scheme used for this dataset. Using a known scheme like DDSS enables more efficient data reading and retrieval. - `extractors` object[] — Allows using template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)}, will enrich discovery results with a human readable "date" field. - … - `awsAuthenticationMethod` 'manual' — AWS authentication method. Choose Auto to use IAM roles. - `endpoint` string — Must point to an S3-compatible endpoint. If empty, defaults to an AWS region-specific endpoint. - `signatureVersion` 'v2' | 'v4' — Signature version to use for signing S3 requests - `enableAssumeRole` boolean — Use AssumeRole credentials - `assumeRoleArn` string — Amazon Resource Name (ARN) of the role to assume - `assumeRoleExternalId` string — External ID to use when assuming role - `durationSeconds` number — Duration of the Assumed Role's session, in seconds. Minimum is 900 (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12 hours). - `maxBatchSize` number — Maximum number of metadata objects to batch before recording as results - `reuseConnections` boolean — Reuse connections between requests to improve performance - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as a self-signed certificate) - `verifyPermissions` boolean — Disable if you can access files within the bucket but not the bucket itself. Resolves errors of the form "discover task initialization failed...error: Forbidden". - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `recurse` boolean — Traverse and include files from subdirectories. Leave this option enabled to ensure that all nested directories are searched and their contents collected. - `awsApiKey` string — Access key. If not present, will fall back to env.AWS_ACCESS_KEY_ID, or to the metadata endpoint for IAM creds. Optional when running on AWS. This value can be a constant or a JavaScript expression. - `awsSecretKey` string — Secret key. If not present, will fall back to env.AWS_SECRET_ACCESS_KEY, or to the metadata endpoint for IAM creds. Optional when running on AWS. This value can be a constant or a JavaScript expression. - object — Collector configuration - `outputName` string — Name of the predefined Destination that will be used to auto-populate Collector settings - `bucket` string, required — S3 Bucket from which to collect data - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk - `parquetChunkDownloadTimeout` number — Maximum time allowed for downloading a Parquet chunk. Processing will stop if a chunk cannot be downloaded within the time specified. - `region` string — Region from which to retrieve data - `path` string — Directory where data will be collected. Templating (such as 'myDir/${datacenter}/${host}/${app}/') and time-based tokens (such as 'myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/') are supported. Can be a constant (enclosed in quotes) or a JavaScript expression. - `partitioningScheme` 'none' — Partitioning scheme used for this dataset. Using a known scheme like DDSS enables more efficient data reading and retrieval. - `extractors` object[] — Allows using template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)}, will enrich discovery results with a human readable "date" field. - … - `awsAuthenticationMethod` 'secret' — AWS authentication method. Choose Auto to use IAM roles. - `endpoint` string — Must point to an S3-compatible endpoint. If empty, defaults to an AWS region-specific endpoint. - `signatureVersion` 'v2' | 'v4' — Signature version to use for signing S3 requests - `enableAssumeRole` boolean — Use AssumeRole credentials - `assumeRoleArn` string — Amazon Resource Name (ARN) of the role to assume - `assumeRoleExternalId` string — External ID to use when assuming role - `durationSeconds` number — Duration of the Assumed Role's session, in seconds. Minimum is 900 (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12 hours). - `maxBatchSize` number — Maximum number of metadata objects to batch before recording as results - `reuseConnections` boolean — Reuse connections between requests to improve performance - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as a self-signed certificate) - `verifyPermissions` boolean — Disable if you can access files within the bucket but not the bucket itself. Resolves errors of the form "discover task initialization failed...error: Forbidden". - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified - `recurse` boolean — Traverse and include files from subdirectories. Leave this option enabled to ensure that all nested directories are searched and their contents collected. - `awsSecret` string — Select or create a stored secret that references AWS access key and secret key. - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorScript — Script collector configuration - `type` 'script', required — Collector type - `conf` object, required — Collector configuration - `discoverScript` string, required — Script to discover what to collect. Should output one task per line in stdout. - `collectScript` string, required — Script to run to perform data collections. Task passed in as $CRIBL_COLLECT_ARG. Should output results to stdout. - `shell` string — Shell to use to execute scripts. - `envVars` object[] — Environment variables to expose to the discover and collect scripts. - `name` string, required — Environment variable name - `value` string, required — JavaScript expression to compute environment variable's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorSplunk — Splunk collector configuration - `type` 'splunk', required — Collector type - `conf` union, required — Collector configuration - object - `searchHead` string, required — Search head base URL. Can be an expression. Default is https://localhost:8089. - `search` string, required — Examples: 'index=myAppLogs level=error channel=myApp' OR '| mstats avg(myStat) as myStat WHERE index=myStatsIndex.' - `earliest` string — The earliest time boundary for the search. Can be an exact or relative time. Examples: '2022-01-14T12:00:00Z' or '-16m@m' - `latest` string — The latest time boundary for the search. Can be an exact or relative time. Examples: '2022-01-14T12:00:00Z' or '-1m@m' - `endpoint` string, required — REST API used to create a search - `outputMode` 'csv' | 'json', required — Format of the returned output - `collectRequestParams` object[] — Optional collect request parameters - … - `collectRequestHeaders` object[] — Optional collect request headers - … - `authentication` 'none', required — Authentication method for Discover and Collect REST calls - `timeout` number — HTTP request inactivity timeout. Use 0 for no timeout. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable collector event time filtering when a date range is specified - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `handleEscapedChars` boolean — Escape characters (\") in search queries will be passed directly to Splunk - `retryRules` union - … - object - `searchHead` string, required — Search head base URL. Can be an expression. Default is https://localhost:8089. - `search` string, required — Examples: 'index=myAppLogs level=error channel=myApp' OR '| mstats avg(myStat) as myStat WHERE index=myStatsIndex.' - `earliest` string — The earliest time boundary for the search. Can be an exact or relative time. Examples: '2022-01-14T12:00:00Z' or '-16m@m' - `latest` string — The latest time boundary for the search. Can be an exact or relative time. Examples: '2022-01-14T12:00:00Z' or '-1m@m' - `endpoint` string, required — REST API used to create a search - `outputMode` 'csv' | 'json', required — Format of the returned output - `collectRequestParams` object[] — Optional collect request parameters - … - `collectRequestHeaders` object[] — Optional collect request headers - … - `authentication` 'basic', required — Authentication method for Discover and Collect REST calls - `timeout` number — HTTP request inactivity timeout. Use 0 for no timeout. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable collector event time filtering when a date range is specified - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `handleEscapedChars` boolean — Escape characters (\") in search queries will be passed directly to Splunk - `retryRules` union - … - `username` string, required — Basic authentication username - `password` string, required — Basic authentication password - object - `searchHead` string, required — Search head base URL. Can be an expression. Default is https://localhost:8089. - `search` string, required — Examples: 'index=myAppLogs level=error channel=myApp' OR '| mstats avg(myStat) as myStat WHERE index=myStatsIndex.' - `earliest` string — The earliest time boundary for the search. Can be an exact or relative time. Examples: '2022-01-14T12:00:00Z' or '-16m@m' - `latest` string — The latest time boundary for the search. Can be an exact or relative time. Examples: '2022-01-14T12:00:00Z' or '-1m@m' - `endpoint` string, required — REST API used to create a search - `outputMode` 'csv' | 'json', required — Format of the returned output - `collectRequestParams` object[] — Optional collect request parameters - … - `collectRequestHeaders` object[] — Optional collect request headers - … - `authentication` 'basicSecret', required — Authentication method for Discover and Collect REST calls - `timeout` number — HTTP request inactivity timeout. Use 0 for no timeout. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable collector event time filtering when a date range is specified - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `handleEscapedChars` boolean — Escape characters (\") in search queries will be passed directly to Splunk - `retryRules` union - … - `credentialsSecret` string, required — Select or create a stored secret that references your credentials - object - `searchHead` string, required — Search head base URL. Can be an expression. Default is https://localhost:8089. - `search` string, required — Examples: 'index=myAppLogs level=error channel=myApp' OR '| mstats avg(myStat) as myStat WHERE index=myStatsIndex.' - `earliest` string — The earliest time boundary for the search. Can be an exact or relative time. Examples: '2022-01-14T12:00:00Z' or '-16m@m' - `latest` string — The latest time boundary for the search. Can be an exact or relative time. Examples: '2022-01-14T12:00:00Z' or '-1m@m' - `endpoint` string, required — REST API used to create a search - `outputMode` 'csv' | 'json', required — Format of the returned output - `collectRequestParams` object[] — Optional collect request parameters - … - `collectRequestHeaders` object[] — Optional collect request headers - … - `authentication` 'token', required — Authentication method for Discover and Collect REST calls - `timeout` number — HTTP request inactivity timeout. Use 0 for no timeout. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable collector event time filtering when a date range is specified - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `handleEscapedChars` boolean — Escape characters (\") in search queries will be passed directly to Splunk - `retryRules` union - … - `token` string, required - object - `searchHead` string, required — Search head base URL. Can be an expression. Default is https://localhost:8089. - `search` string, required — Examples: 'index=myAppLogs level=error channel=myApp' OR '| mstats avg(myStat) as myStat WHERE index=myStatsIndex.' - `earliest` string — The earliest time boundary for the search. Can be an exact or relative time. Examples: '2022-01-14T12:00:00Z' or '-16m@m' - `latest` string — The latest time boundary for the search. Can be an exact or relative time. Examples: '2022-01-14T12:00:00Z' or '-1m@m' - `endpoint` string, required — REST API used to create a search - `outputMode` 'csv' | 'json', required — Format of the returned output - `collectRequestParams` object[] — Optional collect request parameters - … - `collectRequestHeaders` object[] — Optional collect request headers - … - `authentication` 'tokenSecret', required — Authentication method for Discover and Collect REST calls - `timeout` number — HTTP request inactivity timeout. Use 0 for no timeout. - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order. - `disableTimeFilter` boolean — Disable collector event time filtering when a date range is specified - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `handleEscapedChars` boolean — Escape characters (\") in search queries will be passed directly to Splunk - `retryRules` union - … - `tokenSecret` string, required — Select or create a stored secret that references your Bearer token - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - `input` TypeCollectionWithBreakerRulesetsConstraint - `type` 'collection' - `breakerRulesets` string[] — A list of event-breaking rulesets that will be applied, in order, to the input data stream - `staleChannelFlushMs` number — How long (in milliseconds) the Event Breaker will wait for new data to be sent to a specific channel before flushing the data stream out, as is, to the Pipelines - `sendToRoutes` boolean — Send events to normal routing and event processing. Disable to select a specific Pipeline/Destination combination. - `preprocess` PreprocessType - `disabled` boolean, required - `command` string — Command to feed the data through (via stdin) and process its output (stdout) - `args` string[] — Arguments to be added to the custom command - `throttleRatePerSec` string — Rate (in bytes per second) to throttle while writing to an output. Accepts values with multiple-byte units, such as KB, MB, and GB. (Example: 42 MB) Default value of 0 specifies no throttling. - `metadata` ItemsTypeMetadata[] — Fields to add to events from this input - `name` string, required - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `pipeline` string — Pipeline to process results - `output` string — Destination to send results to - SavedJobExecutor - `id` string — Unique ID for this Job - `description` string - `type` 'collection' | 'executor' | 'scheduledSearch', required - `ttl` string — Time to keep the job's artifacts on disk after job completion. This also affects how long a job is listed in the Job Inspector. - `ignoreGroupJobsLimit` boolean — When enabled, this job's artifacts are not counted toward the Worker Group's finished job artifacts limit. Artifacts will be removed only after the Collector's configured time to live. - `removeFields` string[] — List of fields to remove from Discover results. Wildcards (for example, aws*) are allowed. This is useful when discovery returns sensitive fields that should not be exposed in the Jobs user interface. - `resumeOnBoot` boolean — Resume the ad hoc job if a failure condition causes Stream to restart during job execution - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `schedule` ScheduleTypeSavedJobCollection — Configuration for a scheduled job - `enabled` boolean — Enable to configure scheduling for this Collector - `skippable` boolean — Skippable jobs can be delayed, up to their next run time, if the system is hitting concurrency limits - `resumeMissed` boolean — If Stream Leader (or single instance) restarts, run all missed jobs according to their original schedules - `cronSchedule` string — A cron schedule on which to run this job - `maxConcurrentRuns` number — The maximum number of instances of this scheduled job that may be running at any time - `run` RunSettingsTypeSavedJobCollectionSchedule - `type` 'collection' - `rescheduleDroppedTasks` boolean — Reschedule tasks that failed with non-fatal errors - `maxTaskReschedule` number — Maximum number of times a task can be rescheduled - … truncated; see the full OpenAPI document linked below ## Response `200` a list of SavedJob objects - CountedSavedJob - `count` integer — number of items present in the items array - `items` SavedJob[] - union - SavedJobCollection - `id` string — Unique ID for this Job - `description` string - `type` 'collection' | 'executor' | 'scheduledSearch', required - `ttl` string — Time to keep the job's artifacts on disk after job completion. This also affects how long a job is listed in the Job Inspector. - `ignoreGroupJobsLimit` boolean — When enabled, this job's artifacts are not counted toward the Worker Group's finished job artifacts limit. Artifacts will be removed only after the Collector's configured time to live. - `removeFields` string[] — List of fields to remove from Discover results. Wildcards (for example, aws*) are allowed. This is useful when discovery returns sensitive fields that should not be exposed in the Jobs user interface. - `resumeOnBoot` boolean — Resume the ad hoc job if a failure condition causes Stream to restart during job execution - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `schedule` ScheduleTypeSavedJobCollection — Configuration for a scheduled job - `enabled` boolean — Enable to configure scheduling for this Collector - `skippable` boolean — Skippable jobs can be delayed, up to their next run time, if the system is hitting concurrency limits - `resumeMissed` boolean — If Stream Leader (or single instance) restarts, run all missed jobs according to their original schedules - `cronSchedule` string — A cron schedule on which to run this job - `maxConcurrentRuns` number — The maximum number of instances of this scheduled job that may be running at any time - `run` RunSettingsTypeSavedJobCollectionSchedule - `type` 'collection' - `rescheduleDroppedTasks` boolean — Reschedule tasks that failed with non-fatal errors - `maxTaskReschedule` number — Maximum number of times a task can be rescheduled - `logLevel` 'error' | 'warn' | 'info' | 'debug' | 'silly' — Level at which to set task logging - `jobTimeout` string — Maximum time the job is allowed to run. Time unit defaults to seconds if not specified (examples: 30, 45s, 15m). Enter 0 for unlimited time. - `mode` string, required — Job run mode. Preview will either return up to N matching results, or will run until capture time T is reached. Discovery will gather the list of files to turn into streaming tasks, without running the data collection job. Full Run will run the collection job. - `timeRangeType` string - `earliest` number — Earliest time to collect data for the selected timezone - `latest` number — Latest time to collect data for the selected timezone - `timestampTimezone` unknown - `timeWarning` MetricsStore - `expression` string — A filter for tokens in the provided collect path and/or the events being collected - `minTaskSize` string — Limits the bundle size for small tasks. For example, if your lower bundle size is 1MB, you can bundle up to five 200KB files into one task. - `maxTaskSize` string — Limits the bundle size for files above the lower task bundle size. For example, if your upper bundle size is 10MB, you can bundle up to five 2MB files into one task. Files greater than this size will be assigned to individual tasks. - `streamtags` string[] — Tags for filtering and grouping in @{product} - `workerAffinity` boolean — If enabled, tasks are created and run by the same Worker Node - `collector` union, required — Collector configuration - CollectorAzureBlob — AzureBlob collector configuration - `type` 'azure_blob', required — Collector type - `conf` union, required — Collector configuration - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorCriblLake — CriblLake collector configuration - `type` 'cribl_lake', required — Collector type - `conf` object, required — Collector configuration - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorDatabase — Database collector configuration - `type` 'database', required — Collector type - `conf` object, required — Collector configuration - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorFilesystem — Filesystem collector configuration - `type` 'filesystem', required — Collector type - `conf` object, required — Collector configuration - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorGoogleCloudStorage — GoogleCloudStorage collector configuration - `type` 'google_cloud_storage', required — Collector type - `conf` union, required — Collector configuration - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorHealthCheck — HealthCheck collector configuration - `type` 'health_check', required — Collector type - `conf` union, required - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorRest — Rest collector configuration - `type` 'rest', required — Collector type - `conf` union, required - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorS3 — S3 collector configuration - `type` 's3', required — Collector type - `conf` union, required - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorScript — Script collector configuration - `type` 'script', required — Collector type - `conf` object, required — Collector configuration - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorSplunk — Splunk collector configuration - `type` 'splunk', required — Collector type - `conf` union, required — Collector configuration - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - `input` TypeCollectionWithBreakerRulesetsConstraint - `type` 'collection' - `breakerRulesets` string[] — A list of event-breaking rulesets that will be applied, in order, to the input data stream - `staleChannelFlushMs` number — How long (in milliseconds) the Event Breaker will wait for new data to be sent to a specific channel before flushing the data stream out, as is, to the Pipelines - `sendToRoutes` boolean — Send events to normal routing and event processing. Disable to select a specific Pipeline/Destination combination. - `preprocess` PreprocessType - `disabled` boolean, required - `command` string — Command to feed the data through (via stdin) and process its output (stdout) - `args` string[] — Arguments to be added to the custom command - `throttleRatePerSec` string — Rate (in bytes per second) to throttle while writing to an output. Accepts values with multiple-byte units, such as KB, MB, and GB. (Example: 42 MB) Default value of 0 specifies no throttling. - `metadata` ItemsTypeMetadata[] — Fields to add to events from this input - `name` string, required - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `pipeline` string — Pipeline to process results - `output` string — Destination to send results to - SavedJobExecutor - `id` string — Unique ID for this Job - `description` string - `type` 'collection' | 'executor' | 'scheduledSearch', required - `ttl` string — Time to keep the job's artifacts on disk after job completion. This also affects how long a job is listed in the Job Inspector. - `ignoreGroupJobsLimit` boolean — When enabled, this job's artifacts are not counted toward the Worker Group's finished job artifacts limit. Artifacts will be removed only after the Collector's configured time to live. - `removeFields` string[] — List of fields to remove from Discover results. Wildcards (for example, aws*) are allowed. This is useful when discovery returns sensitive fields that should not be exposed in the Jobs user interface. - `resumeOnBoot` boolean — Resume the ad hoc job if a failure condition causes Stream to restart during job execution - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `schedule` ScheduleTypeSavedJobCollection — Configuration for a scheduled job - `enabled` boolean — Enable to configure scheduling for this Collector - `skippable` boolean — Skippable jobs can be delayed, up to their next run time, if the system is hitting concurrency limits - `resumeMissed` boolean — If Stream Leader (or single instance) restarts, run all missed jobs according to their original schedules - `cronSchedule` string — A cron schedule on which to run this job - `maxConcurrentRuns` number — The maximum number of instances of this scheduled job that may be running at any time - `run` RunSettingsTypeSavedJobCollectionSchedule - `type` 'collection' - `rescheduleDroppedTasks` boolean — Reschedule tasks that failed with non-fatal errors - `maxTaskReschedule` number — Maximum number of times a task can be rescheduled - `logLevel` 'error' | 'warn' | 'info' | 'debug' | 'silly' — Level at which to set task logging - `jobTimeout` string — Maximum time the job is allowed to run. Time unit defaults to seconds if not specified (examples: 30, 45s, 15m). Enter 0 for unlimited time. - `mode` string, required — Job run mode. Preview will either return up to N matching results, or will run until capture time T is reached. Discovery will gather the list of files to turn into streaming tasks, without running the data collection job. Full Run will run the collection job. - `timeRangeType` string - `earliest` number — Earliest time to collect data for the selected timezone - `latest` number — Latest time to collect data for the selected timezone - `timestampTimezone` unknown - `timeWarning` MetricsStore - `expression` string — A filter for tokens in the provided collect path and/or the events being collected - `minTaskSize` string — Limits the bundle size for small tasks. For example, if your lower bundle size is 1MB, you can bundle up to five 200KB files into one task. - `maxTaskSize` string — Limits the bundle size for files above the lower task bundle size. For example, if your upper bundle size is 10MB, you can bundle up to five 2MB files into one task. Files greater than this size will be assigned to individual tasks. - `streamtags` string[] — Tags for filtering and grouping in @{product} - `executor` ExecutorTypeRunnableJobExecutor, required - `type` string, required — The type of executor to run - `storeTaskResults` boolean — Determines whether or not to write task results to disk - `conf` ExecutorSpecificSettingsTypeRunnableJobExecutorExecutor - SavedJobScheduledSearch - `id` string — Unique ID for this Job - `description` string - `type` 'collection' | 'executor' | 'scheduledSearch', required - `ttl` string — Time to keep the job's artifacts on disk after job completion. This also affects how long a job is listed in the Job Inspector. - `ignoreGroupJobsLimit` boolean — When enabled, this job's artifacts are not counted toward the Worker Group's finished job artifacts limit. Artifacts will be removed only after the Collector's configured time to live. - `removeFields` string[] — List of fields to remove from Discover results. Wildcards (for example, aws*) are allowed. This is useful when discovery returns sensitive fields that should not be exposed in the Jobs user interface. - `resumeOnBoot` boolean — Resume the ad hoc job if a failure condition causes Stream to restart during job execution - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `schedule` ScheduleTypeSavedJobCollection — Configuration for a scheduled job - `enabled` boolean — Enable to configure scheduling for this Collector - `skippable` boolean — Skippable jobs can be delayed, up to their next run time, if the system is hitting concurrency limits - `resumeMissed` boolean — If Stream Leader (or single instance) restarts, run all missed jobs according to their original schedules - `cronSchedule` string — A cron schedule on which to run this job - `maxConcurrentRuns` number — The maximum number of instances of this scheduled job that may be running at any time - `run` RunSettingsTypeSavedJobCollectionSchedule - `type` 'collection' - `rescheduleDroppedTasks` boolean — Reschedule tasks that failed with non-fatal errors - `maxTaskReschedule` number — Maximum number of times a task can be rescheduled - `logLevel` 'error' | 'warn' | 'info' | 'debug' | 'silly' — Level at which to set task logging - `jobTimeout` string — Maximum time the job is allowed to run. Time unit defaults to seconds if not specified (examples: 30, 45s, 15m). Enter 0 for unlimited time. - `mode` string, required — Job run mode. Preview will either return up to N matching results, or will run until capture time T is reached. Discovery will gather the list of files to turn into streaming tasks, without running the data collection job. Full Run will run the collection job. - `timeRangeType` string - `earliest` number — Earliest time to collect data for the selected timezone - `latest` number — Latest time to collect data for the selected timezone - `timestampTimezone` unknown - `timeWarning` MetricsStore - `expression` string — A filter for tokens in the provided collect path and/or the events being collected - `minTaskSize` string — Limits the bundle size for small tasks. For example, if your lower bundle size is 1MB, you can bundle up to five 200KB files into one task. - `maxTaskSize` string — Limits the bundle size for files above the lower task bundle size. For example, if your upper bundle size is 10MB, you can bundle up to five 2MB files into one task. Files greater than this size will be assigned to individual tasks. - `streamtags` string[] — Tags for filtering and grouping in @{product} - `savedQueryId` string, required — Identifies which search query to run ## Other responses - `401` — Unauthorized - `500` — Unexpected error ## Changes - **2026-03-06** `11df16b26c1d` — 8 breaking, 64 warning, 10 info - added `subschema #1` to the `oneOf[#/components/schemas/SavedJobCollection]/collector/oneOf[#/components/schemas/CollectorRest]/allOf[subschema #2]/conf/allOf[subschema #2]/oneOf[#/components/schemas/RestAuthenticationLoginSecret]/` request property `allOf` list - added `subschema #1` to the `oneOf[#/components/schemas/SavedJobCollection]/collector/oneOf[#/components/schemas/CollectorRest]/allOf[subschema #2]/conf/allOf[subschema #2]/oneOf[#/components/schemas/RestAuthenticationLogin]/` request property `allOf` list - added `subschema #1` to the `oneOf[#/components/schemas/SavedJobCollection]/collector/oneOf[#/components/schemas/CollectorRest]/allOf[subschema #2]/conf/retryRules/allOf[subschema #1]/oneOf[#/components/schemas/RestRetryRulesTypeBackoff]/` request property `allOf` list - added `subschema #1` to the `oneOf[#/components/schemas/SavedJobCollection]/collector/oneOf[#/components/schemas/CollectorRest]/allOf[subschema #2]/conf/retryRules/allOf[subschema #1]/oneOf[#/components/schemas/RestRetryRulesTypeStatic]/` request property `allOf` list - …78 more - **2026-01-24** `84748faee3ef` — 1 info - endpoint added - …this revision’s changelog is incomplete - **2026-01-19** `62472462b0c0` — 1 breaking - api path removed without deprecation - …this revision’s changelog is incomplete - **2026-01-19** `78a6165ee901` — 1 info - endpoint added - …this revision’s changelog is incomplete [Change history](https://skmtc.dev/criblio/apis/cribl-api-reference/changes/lib/jobs/:id/patch.md) --- [API](https://skmtc.dev/criblio/apis/cribl-api-reference.md) · [All operations](https://skmtc.dev/criblio/apis/cribl-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/criblio/cribl-api-reference/revisions/11df16b26c1d/schema)