import * as pulumi from "@pulumi/pulumi"; import * as inputs from "../types/input"; import * as outputs from "../types/output"; /** * A parser is a configuration that parses raw logs of a specific log type into Unified Data Model (UDM) events. * Chronicle supports both customer-created custom parsers and Google-provided prebuilt parsers. * * To get more information about Parser, see: * * * [API documentation](https://cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.logTypes.parsers) * * How-to Guides * * [Custom parsers overview](https://cloud.google.com/chronicle/docs/detection/custom-parsers-overview) * * ## Example Usage * * ### Chronicle Parser Basic * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const example = new gcp.chronicle.Parser("example", { * location: "us", * instance: "00000000-0000-0000-0000-000000000000", * logtype: "WINDOWS_DHCP", * validationSkipped: true, * cbn: "ZHVtbXkgcGFyc2VyIGNvbmZpZw==", * }); * ``` * ### Chronicle Parser Full * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const example = new gcp.chronicle.Parser("example", { * location: "us", * instance: "00000000-0000-0000-0000-000000000000", * logtype: "LINUX_DHCP", * validatedOnEmptyLogs: false, * validationSkipped: true, * lowCode: { * log: "ZHVtbXkgbG9nIGJ5dGVz", * fieldExtractors: { * logFormat: "JSON", * appendRepeatedFields: true, * preprocessConfig: { * grokRegex: "(?P.*)", * target: "message", * }, * extractors: [ * { * fieldPath: "$.ip", * destinationPath: "udm.principal.ip", * preconditionOp: "EQUALS", * preconditionPath: "$.event", * preconditionValue: "login", * }, * { * destinationPath: "udm.metadata.product_name", * value: "Google", * }, * ], * }, * }, * versionInfo: { * autoUpgradeDisabled: false, * }, * }); * ``` * * ## Import * * Parser can be imported using any of these accepted formats: * * * `projects/{{project}}/locations/{{location}}/instances/{{instance}}/logTypes/{{logtype}}/parsers/{{parser}}` * * `{{project}}/{{location}}/{{instance}}/{{logtype}}/{{parser}}` * * `{{location}}/{{instance}}/{{logtype}}/{{parser}}` * * When using the `pulumi import` command, Parser can be imported using one of the formats above. For example: * * ```sh * $ pulumi import gcp:chronicle/parser:Parser default projects/{{project}}/locations/{{location}}/instances/{{instance}}/logTypes/{{logtype}}/parsers/{{parser}} * $ pulumi import gcp:chronicle/parser:Parser default {{project}}/{{location}}/{{instance}}/{{logtype}}/{{parser}} * $ pulumi import gcp:chronicle/parser:Parser default {{location}}/{{instance}}/{{logtype}}/{{parser}} * ``` */ export declare class Parser extends pulumi.CustomResource { /** * Get an existing Parser resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input, state?: ParserState, opts?: pulumi.CustomResourceOptions): Parser; /** * Returns true if the given object is an instance of Parser. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is Parser; /** * if the parser is built using config * documentation: * https://cloud.google.com/chronicle/docs/preview/parser-extensions/parsing-overview */ readonly cbn: pulumi.Output; /** * Changelogs of a parser. * Structure is documented below. */ readonly changelogs: pulumi.Output; /** * (Output) * Time at which changelog was created. */ readonly createTime: pulumi.Output; /** * Information about the creator of the parser. * Structure is documented below. */ readonly creators: pulumi.Output; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ readonly deletionPolicy: pulumi.Output; /** * Dynamic parsing config applied over the parser, if any. */ readonly dynamicParsingConfig: pulumi.Output; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ readonly instance: pulumi.Output; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ readonly location: pulumi.Output; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ readonly logtype: pulumi.Output; /** * Message to represent LowCodeParser. * Structure is documented below. */ readonly lowCode: pulumi.Output; /** * name of the parser resource. */ readonly name: pulumi.Output; /** * Output only. The server-generated ID of the parser. */ readonly parser: pulumi.Output; /** * Extension applied over the parser, if any. */ readonly parserExtension: pulumi.Output; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ readonly project: pulumi.Output; /** * The release stage of the parser * After internal validations the prebuilt parser will directly start as * Release Candidate. The releaseStage of prebuilt parsers are changed * after every release cycle: * The prebuilt Release Candidate parser is promoted as Release parser. * The existing prebuilt Release parser is moved to Rollback state. * and existing prebuilt rollback parser is moved to Archived. * In case of custom parser: * When the customer submits a validation passed custom parser it starts as * Release state. * And existing one is moved to Rollback stage. * And the existing rollback is moved to Archived. * In case a release or release candidate parser is found faulty, * the parser is marked FAULTY, * if it is release parser then rollback candidate is moved to release. * Possible values: * RELEASE * RELEASE_CANDIDATE * ROLLBACK_CANDIDATE * ARCHIVED * FAULTY * ARCHIVED_IN_USE */ readonly releaseStage: pulumi.Output; /** * The state of the parser * Possible values: * ACTIVE * INACTIVE */ readonly state: pulumi.Output; /** * The type of the parser * Possible values: * CUSTOM * PREBUILT */ readonly type: pulumi.Output; /** * Flag to bypass parser validation when no logs are found. * If enabled, the parser won't be be rejected during the validation * phase when no logs are found. */ readonly validatedOnEmptyLogs: pulumi.Output; /** * The Validation report generated during parser validation. */ readonly validationReport: pulumi.Output; /** * If true, bypasses parser validation. * If enabled, the parser won't be rejected during the validation * phase and validation will be skipped. */ readonly validationSkipped: pulumi.Output; /** * The validation stage of the parser * When a customer submits a new parser for validation, it starts with a * new stage. * When parser is picked for validation, it changes to Validation state. * If validation failed it is marked as failed, and * existing failed is moved to deleteCandidate stage. * If passes it is moved to passed stage. * If customer opts to submit it, the parser is moved to Release State. * Possible values: * NEW * VALIDATING * PASSED * FAILED * DELETE_CANDIDATE * INTERNAL_ERROR * VALIDATION_SKIPPED */ readonly validationStage: pulumi.Output; /** * ParserVersionInfo gives the version information of the parser and related * properties like pinned etc. * Structure is documented below. */ readonly versionInfo: pulumi.Output; /** * Create a Parser resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args: ParserArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering Parser resources. */ export interface ParserState { /** * if the parser is built using config * documentation: * https://cloud.google.com/chronicle/docs/preview/parser-extensions/parsing-overview */ cbn?: pulumi.Input; /** * Changelogs of a parser. * Structure is documented below. */ changelogs?: pulumi.Input[] | undefined>; /** * (Output) * Time at which changelog was created. */ createTime?: pulumi.Input; /** * Information about the creator of the parser. * Structure is documented below. */ creators?: pulumi.Input[] | undefined>; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ deletionPolicy?: pulumi.Input; /** * Dynamic parsing config applied over the parser, if any. */ dynamicParsingConfig?: pulumi.Input; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ instance?: pulumi.Input; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ location?: pulumi.Input; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ logtype?: pulumi.Input; /** * Message to represent LowCodeParser. * Structure is documented below. */ lowCode?: pulumi.Input; /** * name of the parser resource. */ name?: pulumi.Input; /** * Output only. The server-generated ID of the parser. */ parser?: pulumi.Input; /** * Extension applied over the parser, if any. */ parserExtension?: pulumi.Input; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ project?: pulumi.Input; /** * The release stage of the parser * After internal validations the prebuilt parser will directly start as * Release Candidate. The releaseStage of prebuilt parsers are changed * after every release cycle: * The prebuilt Release Candidate parser is promoted as Release parser. * The existing prebuilt Release parser is moved to Rollback state. * and existing prebuilt rollback parser is moved to Archived. * In case of custom parser: * When the customer submits a validation passed custom parser it starts as * Release state. * And existing one is moved to Rollback stage. * And the existing rollback is moved to Archived. * In case a release or release candidate parser is found faulty, * the parser is marked FAULTY, * if it is release parser then rollback candidate is moved to release. * Possible values: * RELEASE * RELEASE_CANDIDATE * ROLLBACK_CANDIDATE * ARCHIVED * FAULTY * ARCHIVED_IN_USE */ releaseStage?: pulumi.Input; /** * The state of the parser * Possible values: * ACTIVE * INACTIVE */ state?: pulumi.Input; /** * The type of the parser * Possible values: * CUSTOM * PREBUILT */ type?: pulumi.Input; /** * Flag to bypass parser validation when no logs are found. * If enabled, the parser won't be be rejected during the validation * phase when no logs are found. */ validatedOnEmptyLogs?: pulumi.Input; /** * The Validation report generated during parser validation. */ validationReport?: pulumi.Input; /** * If true, bypasses parser validation. * If enabled, the parser won't be rejected during the validation * phase and validation will be skipped. */ validationSkipped?: pulumi.Input; /** * The validation stage of the parser * When a customer submits a new parser for validation, it starts with a * new stage. * When parser is picked for validation, it changes to Validation state. * If validation failed it is marked as failed, and * existing failed is moved to deleteCandidate stage. * If passes it is moved to passed stage. * If customer opts to submit it, the parser is moved to Release State. * Possible values: * NEW * VALIDATING * PASSED * FAILED * DELETE_CANDIDATE * INTERNAL_ERROR * VALIDATION_SKIPPED */ validationStage?: pulumi.Input; /** * ParserVersionInfo gives the version information of the parser and related * properties like pinned etc. * Structure is documented below. */ versionInfo?: pulumi.Input; } /** * The set of arguments for constructing a Parser resource. */ export interface ParserArgs { /** * if the parser is built using config * documentation: * https://cloud.google.com/chronicle/docs/preview/parser-extensions/parsing-overview */ cbn?: pulumi.Input; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ deletionPolicy?: pulumi.Input; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ instance: pulumi.Input; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ location: pulumi.Input; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ logtype: pulumi.Input; /** * Message to represent LowCodeParser. * Structure is documented below. */ lowCode?: pulumi.Input; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ project?: pulumi.Input; /** * Flag to bypass parser validation when no logs are found. * If enabled, the parser won't be be rejected during the validation * phase when no logs are found. */ validatedOnEmptyLogs?: pulumi.Input; /** * If true, bypasses parser validation. * If enabled, the parser won't be rejected during the validation * phase and validation will be skipped. */ validationSkipped?: pulumi.Input; /** * ParserVersionInfo gives the version information of the parser and related * properties like pinned etc. * Structure is documented below. */ versionInfo?: pulumi.Input; } //# sourceMappingURL=parser.d.ts.map