import * as pulumi from "@pulumi/pulumi"; import * as inputs from "../types/input"; import * as outputs from "../types/output"; /** * A parser extension allows customers to extend or customize the behavior of an existing prebuilt or custom parser. * It enables extracting additional fields from raw logs without modifying the base parser. * * To get more information about ParserExtension, see: * * * [API documentation](https://cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.logTypes.parserExtensions) * * How-to Guides * * [Custom parsers overview](https://cloud.google.com/chronicle/docs/detection/custom-parsers-overview) * * ## Example Usage * * ### Chronicle Parserextension Basic * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const example = new gcp.chronicle.ParserExtension("example", { * location: "us", * instance: "00000000-0000-0000-0000-000000000000", * logType: "CISCO_DHCP", * validationSkipped: true, * cbnSnippet: "ZHVtbXkgZXh0ZW5zaW9uIHNuaXBwZXQ=", * }); * ``` * ### Chronicle Parserextension Full * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const example = new gcp.chronicle.ParserExtension("example", { * location: "us", * instance: "00000000-0000-0000-0000-000000000000", * logType: "AKAMAI_DHCP", * validationSkipped: true, * log: "ZHVtbXkgbG9n", * fieldExtractors: { * logFormat: "JSON", * appendRepeatedFields: true, * preprocessConfig: { * grokRegex: "(?P.*)", * target: "message", * }, * extractors: [ * { * fieldPath: "$.user", * destinationPath: "udm.principal.user.userid", * value: "static-override", * }, * { * fieldPath: "$.event", * destinationPath: "udm.metadata.event_type", * preconditionOp: "EQUALS", * preconditionPath: "$.event", * preconditionValue: "login", * }, * ], * }, * }); * ``` * ### Chronicle Parserextension Dynamic * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const example = new gcp.chronicle.ParserExtension("example", { * location: "us", * instance: "00000000-0000-0000-0000-000000000000", * logType: "AKAMAI_DHCP", * validationSkipped: true, * log: "ZHVtbXkgbG9n", * dynamicParsing: { * optedFields: [{ * path: "$.ip", * sampleValue: "1.1.1.1", * }], * }, * }); * ``` * * ## Import * * ParserExtension can be imported using any of these accepted formats: * * * `projects/{{project}}/locations/{{location}}/instances/{{instance}}/logTypes/{{log_type}}/parserExtensions/{{parserextension}}` * * `{{project}}/{{location}}/{{instance}}/{{log_type}}/{{parserextension}}` * * `{{location}}/{{instance}}/{{log_type}}/{{parserextension}}` * * When using the `pulumi import` command, ParserExtension can be imported using one of the formats above. For example: * * ```sh * $ pulumi import gcp:chronicle/parserExtension:ParserExtension default projects/{{project}}/locations/{{location}}/instances/{{instance}}/logTypes/{{log_type}}/parserExtensions/{{parserextension}} * $ pulumi import gcp:chronicle/parserExtension:ParserExtension default {{project}}/{{location}}/{{instance}}/{{log_type}}/{{parserextension}} * $ pulumi import gcp:chronicle/parserExtension:ParserExtension default {{location}}/{{instance}}/{{log_type}}/{{parserextension}} * ``` */ export declare class ParserExtension extends pulumi.CustomResource { /** * Get an existing ParserExtension resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input, state?: ParserExtensionState, opts?: pulumi.CustomResourceOptions): ParserExtension; /** * Returns true if the given object is an instance of ParserExtension. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is ParserExtension; /** * Parser config could be a cbn snippet. */ readonly cbnSnippet: pulumi.Output; /** * The time the parser extension was created. */ readonly createTime: pulumi.Output; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ readonly deletionPolicy: pulumi.Output; /** * A representation of a parser extension as dynamic parsing config. * Structure is documented below. */ readonly dynamicParsing: pulumi.Output; /** * The latest extension * validation report for this extension. */ readonly extensionValidationReport: pulumi.Output; /** * A representation of a parser extension as a set of field extractors. * Structure is documented below. */ readonly fieldExtractors: pulumi.Output; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ readonly instance: pulumi.Output; /** * The time the config was last serving live traffic. */ readonly lastLiveTime: pulumi.Output; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ readonly location: pulumi.Output; /** * Raw log used to assist the user in creation of augmentation. */ readonly log: pulumi.Output; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ readonly logType: pulumi.Output; /** * Format: * projects/{project}/locations/{location}/instances/{instance}/logTypes/{logtype}/parserExtensions/{parserExtension} */ readonly name: pulumi.Output; /** * Output only. The server-generated ID of the parser extension. */ readonly parserextension: pulumi.Output; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ readonly project: pulumi.Output; /** * The state of the parser extension * Possible values: * NEW * VALIDATING * LIVE * REJECTED * INTERNAL_ERROR * VALIDATED * ARCHIVED * VALIDATION_SKIPPED */ readonly state: pulumi.Output; /** * The time the config state was last changed. */ readonly stateLastChangedTime: pulumi.Output; /** * The validation report generated during extension validation. */ readonly validationReport: pulumi.Output; /** * Flag to bypass parser extension validation. * If enabled, the parser extension won't be rejected during the validation * phase and validation will be skipped. */ readonly validationSkipped: pulumi.Output; /** * Create a ParserExtension resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args: ParserExtensionArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering ParserExtension resources. */ export interface ParserExtensionState { /** * Parser config could be a cbn snippet. */ cbnSnippet?: pulumi.Input; /** * The time the parser extension was created. */ createTime?: pulumi.Input; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ deletionPolicy?: pulumi.Input; /** * A representation of a parser extension as dynamic parsing config. * Structure is documented below. */ dynamicParsing?: pulumi.Input; /** * The latest extension * validation report for this extension. */ extensionValidationReport?: pulumi.Input; /** * A representation of a parser extension as a set of field extractors. * Structure is documented below. */ fieldExtractors?: pulumi.Input; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ instance?: pulumi.Input; /** * The time the config was last serving live traffic. */ lastLiveTime?: pulumi.Input; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ location?: pulumi.Input; /** * Raw log used to assist the user in creation of augmentation. */ log?: pulumi.Input; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ logType?: pulumi.Input; /** * Format: * projects/{project}/locations/{location}/instances/{instance}/logTypes/{logtype}/parserExtensions/{parserExtension} */ name?: pulumi.Input; /** * Output only. The server-generated ID of the parser extension. */ parserextension?: pulumi.Input; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ project?: pulumi.Input; /** * The state of the parser extension * Possible values: * NEW * VALIDATING * LIVE * REJECTED * INTERNAL_ERROR * VALIDATED * ARCHIVED * VALIDATION_SKIPPED */ state?: pulumi.Input; /** * The time the config state was last changed. */ stateLastChangedTime?: pulumi.Input; /** * The validation report generated during extension validation. */ validationReport?: pulumi.Input; /** * Flag to bypass parser extension validation. * If enabled, the parser extension won't be rejected during the validation * phase and validation will be skipped. */ validationSkipped?: pulumi.Input; } /** * The set of arguments for constructing a ParserExtension resource. */ export interface ParserExtensionArgs { /** * Parser config could be a cbn snippet. */ cbnSnippet?: pulumi.Input; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ deletionPolicy?: pulumi.Input; /** * A representation of a parser extension as dynamic parsing config. * Structure is documented below. */ dynamicParsing?: pulumi.Input; /** * A representation of a parser extension as a set of field extractors. * Structure is documented below. */ fieldExtractors?: pulumi.Input; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ instance: pulumi.Input; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ location: pulumi.Input; /** * Raw log used to assist the user in creation of augmentation. */ log?: pulumi.Input; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ logType: pulumi.Input; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ project?: pulumi.Input; /** * Flag to bypass parser extension validation. * If enabled, the parser extension won't be rejected during the validation * phase and validation will be skipped. */ validationSkipped?: pulumi.Input; } //# sourceMappingURL=parserExtension.d.ts.map