import * as pulumi from "@pulumi/pulumi"; import * as inputs from "./types/input"; import * as outputs from "./types/output"; /** * Provides a Sumologic Log Search. * * ## Example Usage * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as sumologic from "@pulumi/sumologic"; * * const personalFolder = sumologic.getPersonalFolder({}); * const exampleLogSearch = new sumologic.LogSearch("example_log_search", { * name: "Demo Search", * description: "Demo search description", * parentId: personalFolder.then(personalFolder => personalFolder.id), * queryString: ` _sourceCategory=api * | parse "parameter1=*," as parameter1 * | parse "parameter2=*," as parameter2 * | where parameter1 matches {{param1}} * | where parameter2 matches {{param2}} * | count by _sourceHost * `, * parsingMode: "AutoParse", * runByReceiptTime: true, * timeRange: { * beginBoundedTimeRange: { * from: { * relativeTimeRange: { * relativeTime: "-30m", * }, * }, * }, * }, * queryParameters: [ * { * name: "param1", * description: "Description for param1", * dataType: "STRING", * value: "*", * }, * { * name: "param2", * description: "Description for param2", * dataType: "STRING", * value: "*", * }, * ], * schedule: { * cronExpression: "0 0 * * * ? *", * muteErrorEmails: false, * notification: { * emailSearchNotification: { * includeCsvAttachment: false, * includeHistogram: false, * includeQuery: true, * includeResultSet: true, * subjectTemplate: "Search Alert: {{TriggerCondition}} found for {{SearchName}}", * toLists: ["will@acme.com"], * }, * }, * parseableTimeRange: { * beginBoundedTimeRange: { * from: { * relativeTimeRange: { * relativeTime: "-15m", * }, * }, * }, * }, * scheduleType: "1Week", * threshold: { * count: 10, * operator: "gt", * thresholdType: "group", * }, * timeZone: "America/Los_Angeles", * parameters: [ * { * name: "param1", * value: "*", * }, * { * name: "param2", * value: "*", * }, * ], * }, * }); * ``` * * ## Attributes reference * * In addition to all arguments above, the following attributes are exported: * * - `id` - The ID of the log search. * * ## Import * * A log search can be imported using it's identifier, e.g.: * * hcl * * ```sh * $ pulumi import sumologic:index/logSearch:LogSearch example_search 0000000007FFD79D * ``` */ export declare class LogSearch extends pulumi.CustomResource { /** * Get an existing LogSearch resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input, state?: LogSearchState, opts?: pulumi.CustomResourceOptions): LogSearch; /** * Returns true if the given object is an instance of LogSearch. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is LogSearch; /** * Description of the search. */ readonly description: pulumi.Output; /** * Name of the search. */ readonly name: pulumi.Output; /** * The identifier of the folder to create the log search in. */ readonly parentId: pulumi.Output; /** * Define the parsing mode to scan the JSON format log messages. Possible values are: * `AutoParse` and `Manual`. Default value is `Manual`. * * In `AutoParse` mode, the system automatically figures out fields to parse based on the search query. While in * the `Manual` mode, no fields are parsed out automatically. For more information see * [Dynamic Parsing](https://help.sumologic.com/?cid=0011). */ readonly parsingMode: pulumi.Output; /** * Up to 10 `queryParameter` blocks can be added one for each parameter in the `queryString`. * See query parameter schema. */ readonly queryParameters: pulumi.Output; /** * Log query to perform. */ readonly queryString: pulumi.Output; /** * This has the value `true` if the search is to be run by receipt time and * `false` if it is to be run by message time. Default value is `false`. */ readonly runByReceiptTime: pulumi.Output; /** * Schedule of the log search. See schedule schema */ readonly schedule: pulumi.Output; /** * Time range of the log search. See time range schema */ readonly timeRange: pulumi.Output; /** * Create a LogSearch resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args: LogSearchArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering LogSearch resources. */ export interface LogSearchState { /** * Description of the search. */ description?: pulumi.Input; /** * Name of the search. */ name?: pulumi.Input; /** * The identifier of the folder to create the log search in. */ parentId?: pulumi.Input; /** * Define the parsing mode to scan the JSON format log messages. Possible values are: * `AutoParse` and `Manual`. Default value is `Manual`. * * In `AutoParse` mode, the system automatically figures out fields to parse based on the search query. While in * the `Manual` mode, no fields are parsed out automatically. For more information see * [Dynamic Parsing](https://help.sumologic.com/?cid=0011). */ parsingMode?: pulumi.Input; /** * Up to 10 `queryParameter` blocks can be added one for each parameter in the `queryString`. * See query parameter schema. */ queryParameters?: pulumi.Input[]>; /** * Log query to perform. */ queryString?: pulumi.Input; /** * This has the value `true` if the search is to be run by receipt time and * `false` if it is to be run by message time. Default value is `false`. */ runByReceiptTime?: pulumi.Input; /** * Schedule of the log search. See schedule schema */ schedule?: pulumi.Input; /** * Time range of the log search. See time range schema */ timeRange?: pulumi.Input; } /** * The set of arguments for constructing a LogSearch resource. */ export interface LogSearchArgs { /** * Description of the search. */ description?: pulumi.Input; /** * Name of the search. */ name?: pulumi.Input; /** * The identifier of the folder to create the log search in. */ parentId: pulumi.Input; /** * Define the parsing mode to scan the JSON format log messages. Possible values are: * `AutoParse` and `Manual`. Default value is `Manual`. * * In `AutoParse` mode, the system automatically figures out fields to parse based on the search query. While in * the `Manual` mode, no fields are parsed out automatically. For more information see * [Dynamic Parsing](https://help.sumologic.com/?cid=0011). */ parsingMode?: pulumi.Input; /** * Up to 10 `queryParameter` blocks can be added one for each parameter in the `queryString`. * See query parameter schema. */ queryParameters?: pulumi.Input[]>; /** * Log query to perform. */ queryString: pulumi.Input; /** * This has the value `true` if the search is to be run by receipt time and * `false` if it is to be run by message time. Default value is `false`. */ runByReceiptTime?: pulumi.Input; /** * Schedule of the log search. See schedule schema */ schedule?: pulumi.Input; /** * Time range of the log search. See time range schema */ timeRange: pulumi.Input; }