--- title: "Update a Pipeline" method: PATCH path: "/pipelines/{id}" tags: ["pipelines"] --- # Update a Pipeline `PATCH /pipelines/{id}` Update the specified Pipeline.

Provide a complete representation of the Pipeline that you want to update in the request body. This endpoint does not support partial updates. Cribl removes any omitted fields when updating the Pipeline.

Confirm that the configuration in your request body is correct before sending the request. If the configuration is incorrect, the updated Pipeline might not function as expected. ## Path parameters - `id` string, required ## Request body - Pipeline - `id` string, required - `conf` object, required - `asyncFuncTimeout` integer — Time (in ms) to wait for an async function to complete processing of a data item - `output` string — The output destination for events processed by this Pipeline - `description` string - `streamtags` string[] — Tags for filtering and grouping in @{product} - `functions` PipelineFunctionConf[] — List of Functions to pass data through - union - PipelineFunctionAggregateMetrics - `filter` string — Filter that selects data to be fed through this Function - `id` 'aggregate_metrics', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - object - … - object - … - `groupId` string — Group ID - PipelineFunctionAggregation - `filter` string — Filter that selects data to be fed through this Function - `id` 'aggregation', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - object - … - object - … - `groupId` string — Group ID - PipelineFunctionAutoTimestamp - `filter` string — Filter that selects data to be fed through this Function - `id` 'auto_timestamp', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaAutoTimestamp, required - `srcField` string — Field to search for a timestamp - `dstField` string — Field to place timestamp in - `defaultTimezone` string — Timezone to assign to timestamps without timezone info - `timeExpression` string — Expression to use to format time. Current time, as a JavaScript Date object, is in global `time`. You can access other fields' values via __e.. - `offset` number — The offset into the string from which to look for a timestamp - `maxLen` number — Maximum string length at which to look for a timestamp - `defaultTime` 'now' | 'last' | 'none' — How to set the time field if no timestamp is found - `latestDateAllowed` string — The latest timestamp value allowed relative to now, such as +42days. Parsed values after this date will be set to the Default time. - `spacer` string - `earliestDateAllowed` string — The earliest timestamp value allowed relative to now, such as -42years. Parsed values prior to this date will be set to the Default time. - `timestamps` object[] — Add regex/strptime pairs to extract additional timestamp formats - … - `groupId` string — Group ID - PipelineFunctionCef - `filter` string — Filter that selects data to be fed through this Function - `id` 'cef', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaCef, required - `outputField` string — The field to which the CEF formatted event will be output - `header` object[] — Set of header key/value pairs - … - `extension` object[] — Set of extension key-value pairs - … - `groupId` string — Group ID - PipelineFunctionChain - `filter` string — Filter that selects data to be fed through this Function - `id` 'chain', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaChain, required - `processor` string — The data processor (Pack/Pipeline) to send events through - `groupId` string — Group ID - PipelineFunctionClone - `filter` string — Filter that selects data to be fed through this Function - `id` 'clone', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaClone, required - `clones` object[] — Create clones with the following fields set - … - `groupId` string — Group ID - PipelineFunctionCode - `filter` string — Filter that selects data to be fed through this Function - `id` 'code', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaCode, required - `code` string — Caution: This Function will be evaluated in an unprotected context. This means that you will be able to execute almost any JavaScript code. - `maxNumOfIterations` number — The maximum number of allowed iterations within this Function. Defaults to 5,000. - `activeLogSampleRate` number — Rate at which this Function logs errors. For example, a value of 1 (the default) logs every error, a value of 10 logs every tenth error, and so on. - `useUniqueLogChannel` boolean — Logs from this Function will be sent to a unique channel in the form `func:code:${pipelineName}:${functionIndex}`. Disable to use the generic `func:code` log channel instead. - `groupId` string — Group ID - PipelineFunctionComment - `filter` string — Filter that selects data to be fed through this Function - `id` 'comment', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaComment, required - `comment` string — Optional, short description of this Function's purpose in the Pipeline - `groupId` string — Group ID - PipelineFunctionDistinct - `filter` string — Filter that selects data to be fed through this Function - `id` 'distinct', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaDistinct, required - `groupBy` string[] — Defines the properties that are concatenated to produce distinct key - `maxCombinations` number — maximum number of tracked combinations - `maxDepth` number — maximum number of groupBy properties - `isFederated` boolean — indicator that the operator runs on a federated executor - `suppressPreviews` boolean — Toggle this on to suppress generating previews of intermediate results - `groupId` string — Group ID - PipelineFunctionDnsLookup - `filter` string — Filter that selects data to be fed through this Function - `id` 'dns_lookup', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaDnsLookup, required - `dnsLookupFields` object[] — List of field names on which to perform DNS lookup - … - `reverseLookupFields` object[] — List of field names on which to perform reverse DNS lookup - … - `dnsServers` string[] — IPs, in RFC 5952 format, of the DNS servers to use for resolution. Examples: IPv4 1.1.1.1, 4.2.2.2:53, or IPv6 [2001:4860:4860::8888], [2001:4860:4860::8888]:1053. If not specified, system's DNS will be used. - `cacheTTL` number — How frequently to expire and refetch DNS cache. Use 0 to disable. - `maxCacheSize` number — The maximum number of DNS resolutions to be cached locally. Leave at default unless you understand the implications of changing. - `useResolvConf` boolean — Attempt to resolve DNS short names using the search or domain directive from /etc/resolv.conf - `lookupFallback` boolean — If unable to resolve a DNS short name, make a DNS.lookup() call to resolve it. Caution: This might degrade performance in unrelated areas of @{product}. - `domainOverrides` string[] — Specify fallback values for the DNS resolver to use when it cannot resolve a DNS short name - `lookupFailLogLevel` 'silly' | 'debug' | 'info' | 'warn' | 'error' - `groupId` string — Group ID - PipelineFunctionDrop - `filter` string — Filter that selects data to be fed through this Function - `id` 'drop', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaDrop, required - `groupId` string — Group ID - PipelineFunctionDropDimensions - `filter` string — Filter that selects data to be fed through this Function - `id` 'drop_dimensions', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaDropDimensions, required - `timeWindow` string — The time span of the tumbling window for aggregating events. Must be a valid time string (such as 10s). - `dropDimensions` string[] — One or more dimensions to be dropped. Supports wildcard expressions. Warning: Using wildcard '*' causes all dimensions in the event to be dropped. - `flushOnInputClose` boolean — Flush aggregations when an input stream is closed. If disabled, aggregations are flushed based on Time Window Settings instead. - `groupId` string — Group ID - PipelineFunctionDynamicSampling - `filter` string — Filter that selects data to be fed through this Function - `id` 'dynamic_sampling', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaDynamicSampling, required - `mode` 'log' | 'sqrt' — Defines how sample rate will be derived: log(previousPeriodCount) or sqrt(previousPeriodCount) - `keyExpr` string — Expression used to derive sample group key. Example:`${domain}:${status}`. Each sample group will have its own derived sampling rate based on volume. Defaults to `${host}`. - `samplePeriod` number — How often (in seconds) sample rates will be adjusted - `minEvents` number — Minimum number of events that must be received in previous sample period for sampling mode to be applied to current period. If the number of events received for a sample group is less than this minimum, a sample rate of 1:1 is used. - `maxSampleRate` number — Maximum sampling rate. If computed sampling rate is above this value, it will be limited to this value. - `groupId` string — Group ID - PipelineFunctionEval - `filter` string — Filter that selects data to be fed through this Function - `id` 'eval', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaEval, required - `add` object[] — Set of key-value pairs to evaluate and add/set - … - `keep` string[] — List of fields to keep. Supports * wildcards. Takes precedence over 'Remove fields'. - `remove` string[] — List of fields to remove. Supports * wildcards. Fields that match 'Keep fields' will not be removed. Enclose field names containing special characters in single or double quotes. - `groupId` string — Group ID - PipelineFunctionEventBreaker - `filter` string — Filter that selects data to be fed through this Function - `id` 'event_breaker', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - union - … - object - … - `groupId` string — Group ID - PipelineFunctionEventstats - `filter` string — Filter that selects data to be fed through this Function - `id` 'eventstats', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaEventstats, required - `aggregations` string[] — Aggregate function(s) to perform on events. E.g., sum(bytes).where(action=='REJECT').as(TotalBytes) - `groupBys` string[] — Fields to group aggregates by, supports wildcard expressions. - `maxEvents` number — Specifies how many events are at max kept in memory to be enriched with aggregations - `flushOnInputClose` boolean — Determines if aggregations should flush when an input stream is closed. If disabled, time window settings will control flush behavior. - `groupId` string — Group ID - PipelineFunctionExternaldata - `filter` string — Filter that selects data to be fed through this Function - `id` 'externaldata', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaExternaldata, required - `groupId` string — Group ID - PipelineFunctionFlatten - `filter` string — Filter that selects data to be fed through this Function - `id` 'flatten', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaFlatten, required - `fields` string[] — List of top-level fields to include for flattening. Supports * wildcards, except when used on internal fields. Defaults to empty array, which means all fields. - `prefix` string — Prefix string for flattened field names. Defaults to empty. - `depth` number — Number representing the nested levels to consider for flattening. Defaults to 5. Minimum should be 1. - `delimiter` string — Delimiter to be used for flattening. Defaults to underscore. - `groupId` string — Group ID - PipelineFunctionFoldkeys - `filter` string — Filter that selects data to be fed through this Function - `id` 'foldkeys', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaFoldkeys, required - `deleteOriginal` boolean — When enabled (default), only the folded keys are kept. When disabled, the original entries are retained alongside the folded keys. - `separator` string — Character or string used to separate key levels to be folded. Defaults to the dot (.) character. - `selectionRegExp` string — Optional regular expression to select a subset of the keys to fold. - `groupId` string — Group ID - PipelineFunctionGenStats - `filter` string — Filter that selects data to be fed through this Function - `id` 'gen_stats', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaGenStats, required - `fields` string[] - `groupId` string — Group ID - PipelineFunctionGeoip - `filter` string — Filter that selects data to be fed through this Function - `id` 'geoip', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaGeoip, required - `file` string — Select an uploaded Maxmind database, or specify path to a Maxmind database with .mmdb extension - `inField` string — Field name in which to find an IP to look up. Can be nested. - `outField` string — Field name in which to store the GeoIP lookup results - `additionalFields` object[] - … - `outFieldMappings` object — Search-specific mappings for granular control over event enrichment - `groupId` string — Group ID - PipelineFunctionGrok - `filter` string — Filter that selects data to be fed through this Function - `id` 'grok', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaGrok, required - `pattern` string — Grok pattern to extract fields. Syntax supported: %{PATTERN_NAME:FIELD_NAME} - `patternList` ItemsTypeSerdeTypeGrokPatternList[] - … - `source` string — Field on which to perform Grok extractions - `groupId` string — Group ID - PipelineFunctionHandlebars - `filter` string — Filter that selects data to be fed through this Function - `id` 'handlebars', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaHandlebars, required - `templates` object[] — Array of template definitions. Uses event.__template_id to select template at runtime. - … - `targetField` string — Field name to store the rendered template result. Defaults to _raw. - `parseJson` boolean — Parse the rendered template as JSON and store as an object instead of a string. Useful for building structured data like Slack blocks. - `removeOnNull` boolean — Remove the target field if the rendered result is empty or null. - `groupId` string — Group ID - PipelineFunctionJoin - `filter` string — Filter that selects data to be fed through this Function - `id` 'join', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaJoin, required - `kind` string — Join kind, e.g. inner - `hints` object — Hints passed to the join function - `fieldConditions` object[] — Fields to use when joining - … - `searchJobId` string — The id for this search job. - `stageId` string — The stage we are joining with. - `groupId` string — Group ID - PipelineFunctionJsonUnroll - `filter` string — Filter that selects data to be fed through this Function - `id` 'json_unroll', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaJsonUnroll, required - `path` string — Path to array to unroll, such as foo.0.bar - `name` string — Name of each exploded array element in each new event. Leave empty to expand the array element with its original name. - `groupId` string — Group ID - PipelineFunctionLakeExport - `filter` string — Filter that selects data to be fed through this Function - `id` 'lake_export', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaLakeExport, required - `searchJobId` string — Id of the search job this function is running on. - `dataset` string — Name of the dataset - `lake` string — Name of the lake - `tee` boolean — Tee results to search. When set to true results will be shipped instead of stats - `flushMs` number — How often are stats flushed in ms - `suppressPreviews` boolean — Disables generation of intermediate stats. When true stats will be emitted only on end - `groupId` string — Group ID - PipelineFunctionLimit - `filter` string — Filter that selects data to be fed through this Function - `id` 'limit', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaLimit, required - `limit` integer — Number of qualifying events to pass through - `groupId` string — Group ID - PipelineFunctionLocalSearchDatatypeParser - `filter` string — Filter that selects data to be fed through this Function - `id` 'local_search_datatype_parser', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaLocalSearchDatatypeParser, required - `groupId` string — Group ID - PipelineFunctionLocalSearchRulesetRunner - `filter` string — Filter that selects data to be fed through this Function - `id` 'local_search_ruleset_runner', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaLocalSearchRulesetRunner, required - `rulesetType` 'dataset' | 'datatype' - `rulesetId` string - `ruleset` object - `markAndIncludeDroppedEvents` boolean — Only for use with live data capture. Mark events that were dropped by dataset rules and still include them for capture - `groupId` string — Group ID - PipelineFunctionLocalSearchTransformer - `filter` string — Filter that selects data to be fed through this Function - `id` 'local_search_transformer', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaLocalSearchTransformer, required - `groupId` string — Group ID - PipelineFunctionLookup - `filter` string — Filter that selects data to be fed through this Function - `id` 'lookup', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - object - … - union - … - `groupId` string — Group ID - PipelineFunctionMask - `filter` string — Filter that selects data to be fed through this Function - `id` 'mask', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaMask, required - `rules` object[] - … - `fields` string[] — Fields on which to apply the masking rules. Supports * wildcards, except when used on internal fields. - `depth` integer — Depth to which the Mask Function will search for fields to mask - `flags` ItemsTypeAdd[] — Fields to evaluate if one or more masking rules are matched - … - `groupId` string — Group ID - PipelineFunctionMvExpand - `filter` string — Filter that selects data to be fed through this Function - `id` 'mv_expand', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaMvExpand, required - `sourceFields` string[] — Array of property-/field-names to expand - `targetNames` string[] — stores the value as new target field name - `rowLimit` number — max. number of rows generated out of every source events - `itemIndexName` string — name of an optional index property generated into the output - `bagExpansionMode` 'bag' | 'array' — decides if bag-values are expanded to bags or arrays - `groupId` string — Group ID - PipelineFunctionMvPull - `filter` string — Filter that selects data to be fed through this Function - `id` 'mv_pull', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaMvPull, required - `arrayPath` string — Field name of the array within events that contains the data objects of interest. Can be a path. - `relativeKeyPath` string — Extract the K-V pair's key from this field, relative to the data object. - `relativeValuePath` string — Extract the K-V pair's value from this field, relative to the data object. - `targetBagPath` string — Optionally, specify a bag as the target for K-V entries. If not specified, these entries are stored on each top-level event. - `deleteOriginal` boolean — Toggle this on to remove each original array of data objects after extraction. If toggled off, arrays are retained. - `groupId` string — Group ID - PipelineFunctionNotificationPolicies - `filter` string — Filter that selects data to be fed through this Function - `id` 'notification_policies', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaNotificationPolicies, required - `policies` object[] — List of notification routing policies evaluated in order - … - `groupId` string — Group ID - PipelineFunctionNotifications - `filter` string — Filter that selects data to be fed through this Function - `id` 'notifications', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaNotifications, required - `id` string — Notification ID - `field` string — Notification event state field name - `deduplicate` boolean — Toggle deduplication. - `groupId` string — Group ID - PipelineFunctionNotify - `filter` string — Filter that selects data to be fed through this Function - `id` 'notify', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaNotify, required - `group` string — Group the notification belongs to - `notificationId` string — Workspace within the deployment to send the search results to. - `searchId` string — Id of the search this function is running on. - `savedQueryId` string — Id of the saved query - `trigger` string — Js expression that filters events, a greater than 'Trigger Count' events will trigger the notification - `triggerType` 'custom' | 'resultsCount' — Type of the trigger condition. custom applies a kusto expression over the results, and results count applies a comparison over results count - `triggerComparator` '>' | '<' | '===' | '!==' | '>=' | '<=' — Operation to be applied over the results count - `triggerCount` number — How many results that match trigger the condition - `resultsLimit` number — Number of results to include in the notification event - `searchUrl` string — Url of the search results - `message` string — Message content template, available fields: searchId, resultSet, savedQueryId, notificationId, searchResultsUrl - `authToken` string — Auth token for sending notification messages - `messagesEndpoint` string — System messages api endpoint - `tenantId` string — Current tenant id - `groupId` string — Group ID - PipelineFunctionNumerify - `filter` string — Filter that selects data to be fed through this Function - `id` 'numerify', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - object - … - object - … - `groupId` string — Group ID - PipelineFunctionOtlpLogs - `filter` string — Filter that selects data to be fed through this Function - `id` 'otlp_logs', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - object - … - object - … - `groupId` string — Group ID - PipelineFunctionOtlpMetrics - `filter` string — Filter that selects data to be fed through this Function - `id` 'otlp_metrics', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - object - … - object - … - `groupId` string — Group ID - PipelineFunctionOtlpTraces - `filter` string — Filter that selects data to be fed through this Function - `id` 'otlp_traces', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - object - … - object - … - `groupId` string — Group ID - PipelineFunctionPack - `filter` string — Filter that selects data to be fed through this Function - `id` 'pack', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaPack, required - `unpackedFields` string[] — List of fields to keep, everything else will be packed - `target` string — Name of the (packed) target field - `groupId` string — Group ID - PipelineFunctionPivot - `filter` string — Filter that selects data to be fed through this Function - `id` 'pivot', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaPivot, required - `labelField` string — Fields to be used for the left-most column. - `dataFields` string[] — Fields with the cell values (i.e. aggregates) - `qualifierFields` string[] — Fields to qualify or group data fields - `groupId` string — Group ID - PipelineFunctionPublishMetrics - `filter` string — Filter that selects data to be fed through this Function - `id` 'publish_metrics', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaPublishMetrics, required - `fields` object[] — List of metrics from event to extract and format. Formatted metrics can be used by a destination to pass metrics to a metrics aggregation platform. - … - `overwrite` boolean — Overwrite previous metric specs. Leave disabled to append. - `dimensions` string[] — Optional list of dimensions to include in events. Wildcards supported. If you don't specify metrics, values will be appended to every metric found in the event. When you add a new metric, dimensions will be present only in those new metrics. - `removeMetrics` string[] — Optional list of metric field names to look for when removing metrics. When a metric's field name matches an element in this list, the metric will be removed from the event. - `removeDimensions` string[] — Optional list of dimensions to remove from every metric found in the event. Wildcards supported. - `groupId` string — Group ID - PipelineFunctionRedis - `filter` string — Filter that selects data to be fed through this Function - `id` 'redis', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - object - … - object - … - object - … - object - … - object - … - object - … - object - … - object - … - object - … - object - … - object - … - object - … - object - … - object - … - object - … - object - … - object - … - object - … - object - … - object - … - `groupId` string — Group ID - PipelineFunctionRegexExtract - `filter` string — Filter that selects data to be fed through this Function - `id` 'regex_extract', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaRegexExtract, required - `regex` string — Regex literal with named capturing groups, such as (?bar), or _NAME_ and _VALUE_ capturing groups, such as (?<_NAME_0>[^ =]+)=(?<_VALUE_0>[^,]+) - `regexList` ItemsTypeSerdeTypeRegexRegexList[] - … - `source` string — Field on which to perform regex field extraction - `iterations` number — The maximum number of times to apply regex to source field when the global flag is set, or when using _NAME_ and _VALUE_ capturing groups - `fieldNameExpression` string — JavaScript expression to format field names when _NAME_n and _VALUE_n capturing groups are used. Original field name is in global variable 'name'. Example: To append XX to all field names, use `${name}_XX` (backticks are literal). If empty, names will be sanitized using this regex: /^[_0-9]+|[^a-zA-Z0-9_]+/g. You can access other fields values via __e.. - `overwrite` boolean — Overwrite existing event fields with extracted values. If disabled, existing fields will be converted to an array. - `groupId` string — Group ID - PipelineFunctionRegexFilter - `filter` string — Filter that selects data to be fed through this Function - `id` 'regex_filter', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaRegexFilter, required - `regex` string — Regex to test against - `regexList` object[] - … - `field` string — Name of the field to apply the regex on (defaults to _raw) - `groupId` string — Group ID - PipelineFunctionRename - `filter` string — Filter that selects data to be fed through this Function - `id` 'rename', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaRename, required - `baseFields` string[] — Fields whose children will inherit the Rename fields and Rename expression operations. Supports wildcards. If empty, only top-level fields will be renamed. - `rename` object[] — Set of key-value pairs to rename fields, where key is the current name and value is the new name. Does not support internal fields. - … - `renameExpr` string — Optional JavaScript expression whose returned value will be used to rename fields. Use the 'name' and 'value' global variables to access field names/values. Example: `name.startsWith('data') ? name.toUpperCase() : name`. You can access other field values via __e.. - `wildcardDepth` integer — For wildcards specified in Parent fields, sets the maximum depth within events to match and rename fields. Enter `0` to match only top-level fields. Defaults to `5` levels down. - `groupId` string — Group ID - PipelineFunctionRollupMetrics - `filter` string — Filter that selects data to be fed through this Function - `id` 'rollup_metrics', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaRollupMetrics, required - `dimensions` string[] — List of dimensions across which to perform rollups. Supports wildcards. Defaults to all original dimensions. - `timeWindow` string — The time span of the rollup window. Must be a valid time string (such as 10s). - `gaugeRollup` 'last' | 'max' | 'min' | 'avg' — The operation to use when rolling up gauge metrics. Defaults to last. - `groupId` string — Group ID - PipelineFunctionSampling - `filter` string — Filter that selects data to be fed through this Function - `id` 'sampling', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaSampling, required - `rules` object[] — Events matching these rules will be sampled at the given rate - … - `groupId` string — Group ID - PipelineFunctionSend - `filter` string — Filter that selects data to be fed through this Function - `id` 'send', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaSend, required - `url` string — Full URL to send search to. - `group` string — Group within the workspace we're sending to. - `workspace` string — Workspace within the deployment to send the search results to. - `sendUrlTemplate` string — Template to build the URL to send from. - `searchId` string — Id of the search this function is running on. - `tee` boolean — Tee results to search. When set to true results will be shipped instead of stats - `flushMs` number — How often are stats flushed in ms - `suppressPreviews` boolean — Disables generation of intermediate stats. When true stats will be emitted only on end - `mode` 'sender' | 'metrics' — In Sender mode, forwards search results directly to the destination. In Metrics mode, accumulates metrics from federated send operators, and forwards the aggregate metrics. - `groupId` string — Group ID - PipelineFunctionSensitiveDataScanner - `filter` string — Filter that selects data to be fed through this Function - `id` 'sensitive_data_scanner', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaSensitiveDataScanner, required - `rules` object[] - … - `fields` string[] — Rulesets act on the events contained in these fields. Mitigation expressions apply to the scan results. Supports wildcards (*). - `excludeFields` string[] — Fields that the mitigation expression will not be applied to. Supports wildcards (*). - `flags` object[] — Fields to add when mitigation is applied to an event - … - `includeDetectedRules` boolean — Add matching ruleset IDs to a field called "__detected" - `backgroundDetection` boolean - `groupId` string — Group ID - PipelineFunctionSerde - `filter` string — Filter that selects data to be fed through this Function - `id` 'serde', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - object - … - object - … - object - … - object - … - object - … - object - … - `groupId` string — Group ID - PipelineFunctionSerialize - `filter` string — Filter that selects data to be fed through this Function - `id` 'serialize', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - object - … - object - … - object - … - `groupId` string — Group ID - PipelineFunctionSidlookup - `filter` string — Filter that selects data to be fed through this Function - `id` 'sidlookup', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaSidlookup, required - `fields` object[] — Set of expressions matched to lookup responses - … - `groupId` string — Group ID - PipelineFunctionSignalFilter - `filter` string — Filter that selects data to be fed through this Function - `id` 'signal_filter', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaSignalFilter, required - `signals` string[] — List of signal event types to filter - `groupId` string — Group ID - PipelineFunctionSnmpTrapSerialize - `filter` string — Filter that selects data to be fed through this Function - `id` 'snmp_trap_serialize', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaSnmpTrapSerialize, required - `strict` boolean — Prevent event serialization if any required fields are missing. When disabled, @{product} will attempt to serialize the event even if required fields are missing, which could cause unexpected behavior at the downstream receiver. - `dropFailedEvents` boolean — When disabled, `snmpSerializeErrors` will be set on the event, and the `__snmpRaw` field will be removed to prevent @{product} from sending the event from the SNMP Trap Destination - `v3User` union - … - `groupId` string — Group ID - PipelineFunctionSort - `filter` string — Filter that selects data to be fed through this Function - `id` 'sort', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaSort, required - `sortId` string — Has to be unique if there are multiple sorts on the pipeline. - `comparisonExpression` string — The expression can access the events via the 'left' and 'right' properties. - `topN` number — Limits the output to N (highest/lowest) events - `maxEvents` number — Specifies the number of events that can flow into this function - `suppressPreviews` boolean — Toggle this on to suppress generating previews of intermediate results - `groupId` string — Group ID - PipelineFunctionStore - `filter` string — Filter that selects data to be fed through this Function - `id` 'store', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaStore, required - `type` string — The type of knowledge object, generated by the function (i.e., 'lookup') - `destination` string — Configures where and how the data should be stored - `description` string — The knowledge object's description - `fieldMapping` object — Mapping event property names to output field names - `separator` string — Character to be used as value delimiter in output - `overwrite` boolean — For existing files, an error is thrown if overwrite is false or the file is replaced if overwrite is true - `compress` string — True will compress output, false leaves it as it is and auto decides based on size - `tee` boolean — Tee results to the next operator - `maxEvents` number — Limits how many events can be stored - `suppressPreviews` boolean — Suppresses the timer-based export stats generating - `groupId` string — Group ID - PipelineFunctionSuppress - `filter` string — Filter that selects data to be fed through this Function - `id` 'suppress', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaSuppress, required - `keyExpr` string — Suppression key expression used to uniquely identify events to suppress. For example, `${ip}:${port}` will use fields ip and port from each event to generate the key. - `allow` number — The number of events to allow per time period - `suppressPeriodSec` number — The number of seconds to suppress events after 'Number to allow' events are received - `dropEventsMode` boolean — If disabled, suppressed events will be tagged with suppress=1 but not dropped - `maxCacheSize` number — The maximum number of keys that can be cached before idle entries are removed. Leave at default unless you understand the implications of changing. - `cacheIdleTimeoutPeriods` number — The number of suppression periods 'Suppression Period' of inactivity before a cache entry is considered idle. Leave at default unless you understand the implications of changing. - `numEventsIdleTimeoutTrigger` number — Check cache for idle sessions every N events when cache size is > 'Maximum Cache Size'. Leave at default unless you understand the implications of changing. - `groupId` string — Group ID - PipelineFunctionTee - `filter` string — Filter that selects data to be fed through this Function - `id` 'tee', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaTee, required - `command` string — Command to execute and feed events to, via stdin. One JSON-formatted event per line. - `args` string[] - `restartOnExit` boolean — Restart the process if it exits and/or we fail to write to it - `env` object — Environment variables to overwrite or set - `groupId` string — Group ID - PipelineFunctionTrimTimestamp - `filter` string — Filter that selects data to be fed through this Function - `id` 'trim_timestamp', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaTrimTimestamp, required - `field` string — Name of field in which to save the timestamp. (If empty, timestamp will not be saved to a field.) - `groupId` string — Group ID - PipelineFunctionUnion - `filter` string — Filter that selects data to be fed through this Function - `id` 'union', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaUnion, required - `searchJobId` string — The id for this search job. - `stageIds` string[] — The stages we are unioning with. - `groupId` string — Group ID - PipelineFunctionUnroll - `filter` string — Filter that selects data to be fed through this Function - `id` 'unroll', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaUnroll, required - `srcExpr` string — Field in which to find/calculate the array to unroll. Example: _raw, _raw.split(/\n/) - `dstField` string — Field in destination event in which to place the unrolled value - `groupId` string — Group ID - PipelineFunctionWindow - `filter` string — Filter that selects data to be fed through this Function - `id` 'window', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaWindow, required - `eventWindowId` number — Identifies the unique ID, used for a event window - `registeredFunctions` string[] — All window functions, tracked by this event window - `tailEventCount` number — Number of events to keep before the current event in the window - `headEventCount` number — Number of events to keep after the current event in the window - `groupId` string — Group ID - PipelineFunctionXmlUnroll - `filter` string — Filter that selects data to be fed through this Function - `id` 'xml_unroll', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaXmlUnroll, required - `unroll` string — Path to array to unroll. Example: ^root\.child\.ElementToUnroll$ - `inherit` string — Regex matching elements to copy into each unrolled event. Example: ^root\.(childA|childB|childC)$ - `unrollIdxField` string — Add a field with this name, containing the index at which the item was located, starting from 0 - `pretty` boolean — Pretty print the output XML - `groupId` string — Group ID - `groups` object ## Response `200` a list of Pipeline objects - CountedPipeline - `count` integer — number of items present in the items array - `items` Pipeline[] - `id` string, required - `conf` object, required - `asyncFuncTimeout` integer — Time (in ms) to wait for an async function to complete processing of a data item - `output` string — The output destination for events processed by this Pipeline - `description` string - `streamtags` string[] — Tags for filtering and grouping in @{product} - `functions` PipelineFunctionConf[] — List of Functions to pass data through - union - PipelineFunctionAggregateMetrics - `filter` string — Filter that selects data to be fed through this Function - `id` 'aggregate_metrics', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - … - `groupId` string — Group ID - PipelineFunctionAggregation - `filter` string — Filter that selects data to be fed through this Function - `id` 'aggregation', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - … - `groupId` string — Group ID - PipelineFunctionAutoTimestamp - `filter` string — Filter that selects data to be fed through this Function - `id` 'auto_timestamp', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaAutoTimestamp, required - … - `groupId` string — Group ID - PipelineFunctionCef - `filter` string — Filter that selects data to be fed through this Function - `id` 'cef', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaCef, required - … - `groupId` string — Group ID - PipelineFunctionChain - `filter` string — Filter that selects data to be fed through this Function - `id` 'chain', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaChain, required - … - `groupId` string — Group ID - PipelineFunctionClone - `filter` string — Filter that selects data to be fed through this Function - `id` 'clone', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaClone, required - … - `groupId` string — Group ID - PipelineFunctionCode - `filter` string — Filter that selects data to be fed through this Function - `id` 'code', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaCode, required - … - `groupId` string — Group ID - PipelineFunctionComment - `filter` string — Filter that selects data to be fed through this Function - `id` 'comment', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaComment, required - … - `groupId` string — Group ID - PipelineFunctionDistinct - `filter` string — Filter that selects data to be fed through this Function - `id` 'distinct', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaDistinct, required - … - `groupId` string — Group ID - PipelineFunctionDnsLookup - `filter` string — Filter that selects data to be fed through this Function - `id` 'dns_lookup', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaDnsLookup, required - … - `groupId` string — Group ID - PipelineFunctionDrop - `filter` string — Filter that selects data to be fed through this Function - `id` 'drop', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaDrop, required - `groupId` string — Group ID - PipelineFunctionDropDimensions - `filter` string — Filter that selects data to be fed through this Function - `id` 'drop_dimensions', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaDropDimensions, required - … - `groupId` string — Group ID - PipelineFunctionDynamicSampling - `filter` string — Filter that selects data to be fed through this Function - `id` 'dynamic_sampling', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaDynamicSampling, required - … - `groupId` string — Group ID - PipelineFunctionEval - `filter` string — Filter that selects data to be fed through this Function - `id` 'eval', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaEval, required - … - `groupId` string — Group ID - PipelineFunctionEventBreaker - `filter` string — Filter that selects data to be fed through this Function - `id` 'event_breaker', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - … - `groupId` string — Group ID - PipelineFunctionEventstats - `filter` string — Filter that selects data to be fed through this Function - `id` 'eventstats', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaEventstats, required - … - `groupId` string — Group ID - PipelineFunctionExternaldata - `filter` string — Filter that selects data to be fed through this Function - `id` 'externaldata', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaExternaldata, required - `groupId` string — Group ID - PipelineFunctionFlatten - `filter` string — Filter that selects data to be fed through this Function - `id` 'flatten', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaFlatten, required - … - `groupId` string — Group ID - PipelineFunctionFoldkeys - `filter` string — Filter that selects data to be fed through this Function - `id` 'foldkeys', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaFoldkeys, required - … - `groupId` string — Group ID - PipelineFunctionGenStats - `filter` string — Filter that selects data to be fed through this Function - `id` 'gen_stats', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaGenStats, required - … - `groupId` string — Group ID - PipelineFunctionGeoip - `filter` string — Filter that selects data to be fed through this Function - `id` 'geoip', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaGeoip, required - … - `groupId` string — Group ID - PipelineFunctionGrok - `filter` string — Filter that selects data to be fed through this Function - `id` 'grok', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaGrok, required - … - `groupId` string — Group ID - PipelineFunctionHandlebars - `filter` string — Filter that selects data to be fed through this Function - `id` 'handlebars', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaHandlebars, required - … - `groupId` string — Group ID - PipelineFunctionJoin - `filter` string — Filter that selects data to be fed through this Function - `id` 'join', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaJoin, required - … - `groupId` string — Group ID - PipelineFunctionJsonUnroll - `filter` string — Filter that selects data to be fed through this Function - `id` 'json_unroll', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaJsonUnroll, required - … - `groupId` string — Group ID - PipelineFunctionLakeExport - `filter` string — Filter that selects data to be fed through this Function - `id` 'lake_export', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaLakeExport, required - … - `groupId` string — Group ID - PipelineFunctionLimit - `filter` string — Filter that selects data to be fed through this Function - `id` 'limit', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaLimit, required - … - `groupId` string — Group ID - PipelineFunctionLocalSearchDatatypeParser - `filter` string — Filter that selects data to be fed through this Function - `id` 'local_search_datatype_parser', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaLocalSearchDatatypeParser, required - `groupId` string — Group ID - PipelineFunctionLocalSearchRulesetRunner - `filter` string — Filter that selects data to be fed through this Function - `id` 'local_search_ruleset_runner', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaLocalSearchRulesetRunner, required - … - `groupId` string — Group ID - PipelineFunctionLocalSearchTransformer - `filter` string — Filter that selects data to be fed through this Function - `id` 'local_search_transformer', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaLocalSearchTransformer, required - `groupId` string — Group ID - PipelineFunctionLookup - `filter` string — Filter that selects data to be fed through this Function - `id` 'lookup', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - … - `groupId` string — Group ID - PipelineFunctionMask - `filter` string — Filter that selects data to be fed through this Function - `id` 'mask', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaMask, required - … - `groupId` string — Group ID - PipelineFunctionMvExpand - `filter` string — Filter that selects data to be fed through this Function - `id` 'mv_expand', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaMvExpand, required - … - `groupId` string — Group ID - PipelineFunctionMvPull - `filter` string — Filter that selects data to be fed through this Function - `id` 'mv_pull', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaMvPull, required - … - `groupId` string — Group ID - PipelineFunctionNotificationPolicies - `filter` string — Filter that selects data to be fed through this Function - `id` 'notification_policies', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaNotificationPolicies, required - … - `groupId` string — Group ID - PipelineFunctionNotifications - `filter` string — Filter that selects data to be fed through this Function - `id` 'notifications', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaNotifications, required - … - `groupId` string — Group ID - PipelineFunctionNotify - `filter` string — Filter that selects data to be fed through this Function - `id` 'notify', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaNotify, required - … - `groupId` string — Group ID - PipelineFunctionNumerify - `filter` string — Filter that selects data to be fed through this Function - `id` 'numerify', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - … - `groupId` string — Group ID - PipelineFunctionOtlpLogs - `filter` string — Filter that selects data to be fed through this Function - `id` 'otlp_logs', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - … - `groupId` string — Group ID - PipelineFunctionOtlpMetrics - `filter` string — Filter that selects data to be fed through this Function - `id` 'otlp_metrics', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - … - `groupId` string — Group ID - PipelineFunctionOtlpTraces - `filter` string — Filter that selects data to be fed through this Function - `id` 'otlp_traces', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - … - `groupId` string — Group ID - PipelineFunctionPack - `filter` string — Filter that selects data to be fed through this Function - `id` 'pack', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaPack, required - … - `groupId` string — Group ID - PipelineFunctionPivot - `filter` string — Filter that selects data to be fed through this Function - `id` 'pivot', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaPivot, required - … - `groupId` string — Group ID - PipelineFunctionPublishMetrics - `filter` string — Filter that selects data to be fed through this Function - `id` 'publish_metrics', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaPublishMetrics, required - … - `groupId` string — Group ID - PipelineFunctionRedis - `filter` string — Filter that selects data to be fed through this Function - `id` 'redis', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - … - `groupId` string — Group ID - PipelineFunctionRegexExtract - `filter` string — Filter that selects data to be fed through this Function - `id` 'regex_extract', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaRegexExtract, required - … - `groupId` string — Group ID - PipelineFunctionRegexFilter - `filter` string — Filter that selects data to be fed through this Function - `id` 'regex_filter', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaRegexFilter, required - … - `groupId` string — Group ID - PipelineFunctionRename - `filter` string — Filter that selects data to be fed through this Function - `id` 'rename', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaRename, required - … - `groupId` string — Group ID - PipelineFunctionRollupMetrics - `filter` string — Filter that selects data to be fed through this Function - `id` 'rollup_metrics', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaRollupMetrics, required - … - `groupId` string — Group ID - PipelineFunctionSampling - `filter` string — Filter that selects data to be fed through this Function - `id` 'sampling', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaSampling, required - … - `groupId` string — Group ID - PipelineFunctionSend - `filter` string — Filter that selects data to be fed through this Function - `id` 'send', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaSend, required - … - `groupId` string — Group ID - PipelineFunctionSensitiveDataScanner - `filter` string — Filter that selects data to be fed through this Function - `id` 'sensitive_data_scanner', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaSensitiveDataScanner, required - … - `groupId` string — Group ID - PipelineFunctionSerde - `filter` string — Filter that selects data to be fed through this Function - `id` 'serde', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - … - `groupId` string — Group ID - PipelineFunctionSerialize - `filter` string — Filter that selects data to be fed through this Function - `id` 'serialize', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` union, required - … - `groupId` string — Group ID - PipelineFunctionSidlookup - `filter` string — Filter that selects data to be fed through this Function - `id` 'sidlookup', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaSidlookup, required - … - `groupId` string — Group ID - PipelineFunctionSignalFilter - `filter` string — Filter that selects data to be fed through this Function - `id` 'signal_filter', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaSignalFilter, required - … - `groupId` string — Group ID - PipelineFunctionSnmpTrapSerialize - `filter` string — Filter that selects data to be fed through this Function - `id` 'snmp_trap_serialize', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaSnmpTrapSerialize, required - … - `groupId` string — Group ID - PipelineFunctionSort - `filter` string — Filter that selects data to be fed through this Function - `id` 'sort', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaSort, required - … - `groupId` string — Group ID - PipelineFunctionStore - `filter` string — Filter that selects data to be fed through this Function - `id` 'store', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaStore, required - … - `groupId` string — Group ID - PipelineFunctionSuppress - `filter` string — Filter that selects data to be fed through this Function - `id` 'suppress', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaSuppress, required - … - `groupId` string — Group ID - PipelineFunctionTee - `filter` string — Filter that selects data to be fed through this Function - `id` 'tee', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaTee, required - … - `groupId` string — Group ID - PipelineFunctionTrimTimestamp - `filter` string — Filter that selects data to be fed through this Function - `id` 'trim_timestamp', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaTrimTimestamp, required - … - `groupId` string — Group ID - PipelineFunctionUnion - `filter` string — Filter that selects data to be fed through this Function - `id` 'union', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaUnion, required - … - `groupId` string — Group ID - PipelineFunctionUnroll - `filter` string — Filter that selects data to be fed through this Function - `id` 'unroll', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaUnroll, required - … - `groupId` string — Group ID - PipelineFunctionWindow - `filter` string — Filter that selects data to be fed through this Function - `id` 'window', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaWindow, required - … - `groupId` string — Group ID - PipelineFunctionXmlUnroll - `filter` string — Filter that selects data to be fed through this Function - `id` 'xml_unroll', required — Function ID - `description` string — Simple description of this step - `disabled` boolean — If true, data will not be pushed through this function - `final` boolean — If enabled, stops the results of this Function from being passed to the downstream Functions - `conf` FunctionConfSchemaXmlUnroll, required - … - `groupId` string — Group ID - `groups` object ## Other responses - `401` — Unauthorized - `500` — Unexpected error ## Changes - **2026-03-06** `11df16b26c1d` — 13 breaking, 28 warning, 16 info - added `subschema #1` to the `conf/functions/items/oneOf[#/components/schemas/PipelineFunctionAggregateMetrics]/conf/allOf[#/components/schemas/FunctionConfSchemaAggregateMetrics]/` request property `allOf` list - added `subschema #1` to the `conf/functions/items/oneOf[#/components/schemas/PipelineFunctionAggregation]/conf/allOf[#/components/schemas/FunctionConfSchemaAggregation]/` request property `allOf` list - added `subschema #1` to the `conf/functions/items/oneOf[#/components/schemas/PipelineFunctionEventBreaker]/conf/allOf[#/components/schemas/FunctionConfSchemaEventBreaker]/` request property `allOf` list - added `subschema #1` to the `conf/functions/items/oneOf[#/components/schemas/PipelineFunctionLookup]/conf/allOf[#/components/schemas/FunctionConfSchemaLookup]/` request property `allOf` list - …53 more - …earlier changes not shown [Full history](https://skmtc.dev/criblio/apis/cribl-api-reference/changes/pipelines/:id/patch.md) --- [API](https://skmtc.dev/criblio/apis/cribl-api-reference.md) · [All operations](https://skmtc.dev/criblio/apis/cribl-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/criblio/cribl-api-reference/revisions/11df16b26c1d/schema)