Create pipelines

Saves the given log parsing pipelines as the new config version for the caller's org and starts deploying it.

POST /v1/o11y/logs/pipelines

O11y → · All API references → · Get started →


Address	`https://api.hanzo.ai/v1/o11y/logs/pipelines`
Method	`POST`
Operation	`post_o11y_logs_pipelines`
Auth	`Authorization: Bearer $HANZO_API_KEY`

Saves the given log parsing pipelines as the new config version for the caller's org and starts deploying it. The set REPLACES the current one: a pipeline left out of the request is dropped from the new version, and an empty set drops them all.

Callers need the editor role; the runtime's own gate enforces it.

Request

55 fields, body application/json (required).

Field	In	Type	Required	Description
`pipelines`	body	o11y.O11yLogPostablePipeline[]	—	Pipelines are the pipelines the new version holds, in order.
`pipelines[].alias`	body	string	—	Alias is the pipeline's short name.
`pipelines[].config`	body	o11y.O11yLogPipelineOperator[]	—	Config is the pipeline's processors, in order.
`pipelines[].config[].default`	body	string	—	Default is the id of the processor a router falls through to.
`pipelines[].config[].enable_flattening`	body	boolean	—	EnableFlattening flattens parsed JSON one level when true.
`pipelines[].config[].enable_paths`	body	boolean	—	EnablePaths keeps the JSON path in flattened keys when true.
`pipelines[].config[].enabled`	body	boolean	—	Enabled turns the processor on.
`pipelines[].config[].expr`	body	string	—	Expr is a router route's expression.
`pipelines[].config[].field`	body	string	—	Field is the field an add/remove processor works on.
`pipelines[].config[].fields`	body	string[]	—	Fields are the fields a retain processor keeps.
`pipelines[].config[].from`	body	string	—	From is the source field of a move or copy.
`pipelines[].config[].id`	body	string	—	ID is the processor's id, unique within the pipeline.
`pipelines[].config[].if`	body	string	—	If gates the processor on an expression.
`pipelines[].config[].layout`	body	string	—	Layout is a time parser's layout.
`pipelines[].config[].layout_type`	body	string	—	LayoutType is the layout's kind, e.g.
`pipelines[].config[].mapping`	body	object	—	Mapping maps severity levels (or flattened keys) to the values that mean them.
`pipelines[].config[].mapping.*`	body	string[]	—
`pipelines[].config[].name`	body	string	—	Name is the processor's display name.
`pipelines[].config[].on_error`	body	string	—	OnError says what to do when the processor fails, e.g.
`pipelines[].config[].orderId`	body	integer	—	OrderID is the processor's 1-based position in the pipeline.
`pipelines[].config[].output`	body	string	—	Output is the id of the processor that runs next.
`pipelines[].config[].overwrite_text`	body	boolean	—	OverwriteSeverityText rewrites the severity text alongside the number when true.
`pipelines[].config[].parse_from`	body	string	—	ParseFrom is where a parser reads from.
`pipelines[].config[].parse_to`	body	string	—	ParseTo is where a parser writes its result.
`pipelines[].config[].path_prefix`	body	string	—	PathPrefix prefixes flattened keys.
`pipelines[].config[].pattern`	body	string	—	Pattern is a grok parser's pattern.
`pipelines[].config[].regex`	body	string	—	Regex is a regex parser's expression.
`pipelines[].config[].routes`	body	o11y.O11yLogPipelineRoute[]	—	Routes are a router processor's routes.
`pipelines[].config[].routes[].expr`	body	string	—	Expr is the expression that selects the route.
`pipelines[].config[].routes[].output`	body	string	—	Output is the id of the processor the route sends to.
`pipelines[].config[].span_id`	body	o11y.O11yLogParseFrom	—
`pipelines[].config[].span_id.parse_from`	body	string	—	ParseFrom is the field to read.
`pipelines[].config[].to`	body	string	—	To is the destination field of a move or copy.
`pipelines[].config[].trace_flags`	body	o11y.O11yLogParseFrom	—
`pipelines[].config[].trace_flags.parse_from`	body	string	—	ParseFrom is the field to read.
`pipelines[].config[].trace_id`	body	o11y.O11yLogParseFrom	—
`pipelines[].config[].trace_id.parse_from`	body	string	—	ParseFrom is the field to read.
`pipelines[].config[].type`	body	string	—	Type is the processor type, e.g.
`pipelines[].config[].value`	body	string	—	Value is the value an add processor writes.
`pipelines[].description`	body	string	—	Description says what the pipeline is for.
`pipelines[].enabled`	body	boolean	—	Enabled turns the pipeline on.
`pipelines[].filter`	body	o11y.O11yLogFilter	—
`pipelines[].filter.items`	body	o11y.O11yLogFilterItem[]	—	Items are the predicates.
`pipelines[].filter.items[].key`	body	o11y.O11yLogFilterKey	—
`pipelines[].filter.items[].key.dataType`	body	string	—	DataType is the field's data type, e.g.
`pipelines[].filter.items[].key.isColumn`	body	boolean	—	IsColumn marks a field materialized as its own column.
`pipelines[].filter.items[].key.isJSON`	body	boolean	—	IsJSON marks a path into the record's JSON body.
`pipelines[].filter.items[].key.key`	body	string	—	Key is the field's name.
`pipelines[].filter.items[].key.type`	body	string	—	Type is where the field lives: tag or resource.
`pipelines[].filter.items[].op`	body	string	—	Op is the comparison, e.g.
`pipelines[].filter.items[].value`	body	any	—	Value is what it tests against, in the value's own JSON type.
`pipelines[].filter.op`	body	string	—	Op combines the items: AND or OR.
`pipelines[].id`	body	string	—	ID is the pipeline's id.
`pipelines[].name`	body	string	—	Name is the pipeline's display name.
`pipelines[].orderId`	body	integer	—	OrderID is the pipeline's 1-based position in the set.

Response

Status	Body	Meaning
`200`	o11y.O11yLogPipelinesOut	ok

200 body — 90 fields.

Field	In	Type	Always	Description
`data`	body	o11y.O11yLogPipelines	—
`data.config`	body	string	—	Config is the rendered collector config the version deployed.
`data.createdAt`	body	string (date-time)	—	CreatedAt is when the version was created.
`data.createdBy`	body	string	—	CreatedBy is the id of who created the version.
`data.createdByName`	body	string	—	CreatedByName is the display name of who created the version.
`data.deployResult`	body	string	—	DeployResult is the deployment's outcome message.
`data.deploySequence`	body	integer	—	DeploySequence orders this deployment among the version's deployments.
`data.deployStatus`	body	string	—	DeployStatus is where the deployment stands, e.g.
`data.elementType`	body	string	—	ElementType is the config element this version carries — log_pipelines.
`data.history`	body	o11y.O11yLogConfigVersion[]	—	History is the recent version history, newest first.
`data.history[].config`	body	string	—	Config is the rendered collector config the version deployed.
`data.history[].createdAt`	body	string (date-time)	—	CreatedAt is when the version was created.
`data.history[].createdBy`	body	string	—	CreatedBy is the id of who created the version.
`data.history[].createdByName`	body	string	—	CreatedByName is the display name of who created the version.
`data.history[].deployResult`	body	string	—	DeployResult is the deployment's outcome message.
`data.history[].deploySequence`	body	integer	—	DeploySequence orders this deployment among the version's deployments.
`data.history[].deployStatus`	body	string	—	DeployStatus is where the deployment stands, e.g.
`data.history[].elementType`	body	string	—	ElementType is the config element the version carries — log_pipelines.
`data.history[].id`	body	string	—	ID is the version record's id.
`data.history[].lastHash`	body	string	—	LastHash is the deployed config's hash.
`data.history[].orgId`	body	string	—	OrgID is the org the version belongs to.
`data.history[].updatedAt`	body	string (date-time)	—	UpdatedAt is when the version last changed.
`data.history[].updatedBy`	body	string	—	UpdatedBy is the id of who last changed it.
`data.history[].version`	body	integer	—	Version is the config version number.
`data.id`	body	string	—	ID is the version record's id.
`data.lastHash`	body	string	—	LastHash is the deployed config's hash.
`data.orgId`	body	string	—	OrgID is the org the version belongs to.
`data.pipelines`	body	o11y.O11yLogPipeline[]	—	Pipelines are the version's pipelines, in order.
`data.pipelines[].alias`	body	string	—	Alias is the pipeline's short name.
`data.pipelines[].config`	body	o11y.O11yLogPipelineOperator[]	—	Config is the pipeline's processors, in order.
`data.pipelines[].config[].default`	body	string	—	Default is the id of the processor a router falls through to.
`data.pipelines[].config[].enable_flattening`	body	boolean	—	EnableFlattening flattens parsed JSON one level when true.
`data.pipelines[].config[].enable_paths`	body	boolean	—	EnablePaths keeps the JSON path in flattened keys when true.
`data.pipelines[].config[].enabled`	body	boolean	—	Enabled turns the processor on.
`data.pipelines[].config[].expr`	body	string	—	Expr is a router route's expression.
`data.pipelines[].config[].field`	body	string	—	Field is the field an add/remove processor works on.
`data.pipelines[].config[].fields`	body	string[]	—	Fields are the fields a retain processor keeps.
`data.pipelines[].config[].from`	body	string	—	From is the source field of a move or copy.
`data.pipelines[].config[].id`	body	string	—	ID is the processor's id, unique within the pipeline.
`data.pipelines[].config[].if`	body	string	—	If gates the processor on an expression.
`data.pipelines[].config[].layout`	body	string	—	Layout is a time parser's layout.
`data.pipelines[].config[].layout_type`	body	string	—	LayoutType is the layout's kind, e.g.
`data.pipelines[].config[].mapping`	body	object	—	Mapping maps severity levels (or flattened keys) to the values that mean them.
`data.pipelines[].config[].mapping.*`	body	string[]	—
`data.pipelines[].config[].name`	body	string	—	Name is the processor's display name.
`data.pipelines[].config[].on_error`	body	string	—	OnError says what to do when the processor fails, e.g.
`data.pipelines[].config[].orderId`	body	integer	—	OrderID is the processor's 1-based position in the pipeline.
`data.pipelines[].config[].output`	body	string	—	Output is the id of the processor that runs next.
`data.pipelines[].config[].overwrite_text`	body	boolean	—	OverwriteSeverityText rewrites the severity text alongside the number when true.
`data.pipelines[].config[].parse_from`	body	string	—	ParseFrom is where a parser reads from.
`data.pipelines[].config[].parse_to`	body	string	—	ParseTo is where a parser writes its result.
`data.pipelines[].config[].path_prefix`	body	string	—	PathPrefix prefixes flattened keys.
`data.pipelines[].config[].pattern`	body	string	—	Pattern is a grok parser's pattern.
`data.pipelines[].config[].regex`	body	string	—	Regex is a regex parser's expression.
`data.pipelines[].config[].routes`	body	o11y.O11yLogPipelineRoute[]	—	Routes are a router processor's routes.
`data.pipelines[].config[].routes[].expr`	body	string	—	Expr is the expression that selects the route.
`data.pipelines[].config[].routes[].output`	body	string	—	Output is the id of the processor the route sends to.
`data.pipelines[].config[].span_id`	body	o11y.O11yLogParseFrom	—
`data.pipelines[].config[].span_id.parse_from`	body	string	—	ParseFrom is the field to read.
`data.pipelines[].config[].to`	body	string	—	To is the destination field of a move or copy.
`data.pipelines[].config[].trace_flags`	body	o11y.O11yLogParseFrom	—
`data.pipelines[].config[].trace_flags.parse_from`	body	string	—	ParseFrom is the field to read.
`data.pipelines[].config[].trace_id`	body	o11y.O11yLogParseFrom	—
`data.pipelines[].config[].trace_id.parse_from`	body	string	—	ParseFrom is the field to read.
`data.pipelines[].config[].type`	body	string	—	Type is the processor type, e.g.
`data.pipelines[].config[].value`	body	string	—	Value is the value an add processor writes.
`data.pipelines[].createdAt`	body	string (date-time)	—	CreatedAt is when the pipeline was created.
`data.pipelines[].createdBy`	body	string	—	CreatedBy is the id of who created the pipeline.
`data.pipelines[].description`	body	string	—	Description says what the pipeline is for.
`data.pipelines[].enabled`	body	boolean	—	Enabled says whether the pipeline is on.
`data.pipelines[].filter`	body	o11y.O11yLogFilter	—
`data.pipelines[].filter.items`	body	o11y.O11yLogFilterItem[]	—	Items are the predicates.
`data.pipelines[].filter.items[].key`	body	o11y.O11yLogFilterKey	—
`data.pipelines[].filter.items[].key.dataType`	body	string	—	DataType is the field's data type, e.g.
`data.pipelines[].filter.items[].key.isColumn`	body	boolean	—	IsColumn marks a field materialized as its own column.
`data.pipelines[].filter.items[].key.isJSON`	body	boolean	—	IsJSON marks a path into the record's JSON body.
`data.pipelines[].filter.items[].key.key`	body	string	—	Key is the field's name.
`data.pipelines[].filter.items[].key.type`	body	string	—	Type is where the field lives: tag or resource.
`data.pipelines[].filter.items[].op`	body	string	—	Op is the comparison, e.g.
`data.pipelines[].filter.items[].value`	body	any	—	Value is what it tests against, in the value's own JSON type.
`data.pipelines[].filter.op`	body	string	—	Op combines the items: AND or OR.
`data.pipelines[].id`	body	string	—	ID is the pipeline's id.
`data.pipelines[].name`	body	string	—	Name is the pipeline's display name.
`data.pipelines[].orderId`	body	integer	—	OrderID is the pipeline's 1-based position in the set.
`data.pipelines[].updatedAt`	body	string (date-time)	—	UpdatedAt is when the pipeline last changed.
`data.pipelines[].updatedBy`	body	string	—	UpdatedBy is the id of who last changed it.
`data.updatedAt`	body	string (date-time)	—	UpdatedAt is when the version last changed.
`data.updatedBy`	body	string	—	UpdatedBy is the id of who last changed it.
`data.version`	body	integer	—	Version is the config version number.
`status`	body	string	—	Status is "success".

Failure carries the platform error shape — see Errors.

Examples

hanzo o11y logs pipelines create

import { Configuration, O11yApi } from 'hanzoai';

const api = new O11yApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.postO11yLogsPipelines({ pipelines: [{"alias":"<alias>","config":[{"default":null,"enable_flattening":null,"enable_paths":null,"enabled":null}],"description":"<description>","enabled":false}] });

from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import O11yApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = O11yApi(client).post_o11y_logs_pipelines(pipelines=[{"alias":"<alias>","config":[{"default":null,"enable_flattening":null,"enable_paths":null,"enabled":null}],"description":"<description>","enabled":false}])

cfg := cloud.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := cloud.NewAPIClient(cfg)

resp, _, err := client.O11yAPI.PostO11yLogsPipelines(context.Background()).Execute()
if err != nil {
	return err
}

use hanzo_cloud::apis::{configuration::Configuration, o11y_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = o11y_api::post_o11y_logs_pipelines(&cfg, Default::default()).await?;

import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.O11yApi;

ApiClient client = new ApiClient();
client.setRequestInterceptor(b -> b.header("Authorization", "Bearer " + System.getenv("HANZO_API_KEY")));

var result = new O11yApi(client).postO11yLogsPipelines();

curl -X POST https://api.hanzo.ai/v1/o11y/logs/pipelines \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "pipelines": [
         {
           "alias": "<alias>",
           "config": [
             {
               "default": null,
               "enable_flattening": null,
               "enable_paths": null,
               "enabled": null
             }
           ],
           "description": "<description>",
           "enabled": false
         }
       ]
     }'

MCP reaches o11y through the o11y tool, which names its 340 operations with its own verbs — this one among them, under a name only MCP declares. describe explains any of them:

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "get_o11y_alert_last"
         }
       }
     }'

O11y API · All Hanzo APIs · Interactive reference

Request

Response

Examples

On this page