Runs the given log parsing pipelines over the given sample records without…

Runs the given log parsing pipelines over the given sample records without saving anything, and returns the transformed records plus whatever the…

POST /v1/o11y/logs/pipelines/preview

O11y → · All API references → · Six flows, four surfaces →


Address	`https://api.hanzo.ai/v1/o11y/logs/pipelines/preview`
Method	`POST`
Operation	`post_o11y_logs_pipelines_preview`
Auth	`Authorization: Bearer $HANZO_API_KEY`

Runs the given log parsing pipelines over the given sample records without saving anything, and returns the transformed records plus whatever the collector logged while simulating them.

Callers need the viewer role; the runtime's own gate enforces it.

Request

78 fields, body application/json (required).

Field	In	Type	Required	Description
`logs`	body	o11y.O11yLogRecord[]	—	Logs are the sample records to transform.
`logs[].attributes_bool`	body	object	—	AttributesBool are the record's boolean attributes.
`logs[].attributes_bool.*`	body	boolean	—
`logs[].attributes_float`	body	object	—	AttributesFloat are the record's float attributes.
`logs[].attributes_float.*`	body	number	—
`logs[].attributes_int`	body	object	—	AttributesInt are the record's integer attributes.
`logs[].attributes_int.*`	body	integer	—
`logs[].attributes_string`	body	object	—	AttributesString are the record's string attributes.
`logs[].attributes_string.*`	body	string	—
`logs[].body`	body	string	—	Body is the record's body.
`logs[].id`	body	string	—	ID is the record's id.
`logs[].resources_string`	body	object	—	ResourcesString are the record's string resource attributes.
`logs[].resources_string.*`	body	string	—
`logs[].severity_number`	body	integer	—	SeverityNumber is the record's severity as a number.
`logs[].severity_text`	body	string	—	SeverityText is the record's severity as text, e.g.
`logs[].span_id`	body	string	—	SpanID is the span the record belongs to.
`logs[].timestamp`	body	integer	—	Timestamp is the record's time as a nanosecond epoch.
`logs[].trace_flags`	body	integer	—	TraceFlags are the record's trace flags.
`logs[].trace_id`	body	string	—	TraceID is the trace the record belongs to.
`pipelines`	body	o11y.O11yLogPipeline[]	—	Pipelines are the pipelines to simulate, in order.
`pipelines[].alias`	body	string	—	Alias is the pipeline's short name.
`pipelines[].config`	body	o11y.O11yLogPipelineOperator[]	—	Config is the pipeline's processors, in order.
`pipelines[].config[].default`	body	string	—	Default is the id of the processor a router falls through to.
`pipelines[].config[].enable_flattening`	body	boolean	—	EnableFlattening flattens parsed JSON one level when true.
`pipelines[].config[].enable_paths`	body	boolean	—	EnablePaths keeps the JSON path in flattened keys when true.
`pipelines[].config[].enabled`	body	boolean	—	Enabled turns the processor on.
`pipelines[].config[].expr`	body	string	—	Expr is a router route's expression.
`pipelines[].config[].field`	body	string	—	Field is the field an add/remove processor works on.
`pipelines[].config[].fields`	body	string[]	—	Fields are the fields a retain processor keeps.
`pipelines[].config[].from`	body	string	—	From is the source field of a move or copy.
`pipelines[].config[].id`	body	string	—	ID is the processor's id, unique within the pipeline.
`pipelines[].config[].if`	body	string	—	If gates the processor on an expression.
`pipelines[].config[].layout`	body	string	—	Layout is a time parser's layout.
`pipelines[].config[].layout_type`	body	string	—	LayoutType is the layout's kind, e.g.
`pipelines[].config[].mapping`	body	object	—	Mapping maps severity levels (or flattened keys) to the values that mean them.
`pipelines[].config[].mapping.*`	body	string[]	—
`pipelines[].config[].name`	body	string	—	Name is the processor's display name.
`pipelines[].config[].on_error`	body	string	—	OnError says what to do when the processor fails, e.g.
`pipelines[].config[].orderId`	body	integer	—	OrderID is the processor's 1-based position in the pipeline.
`pipelines[].config[].output`	body	string	—	Output is the id of the processor that runs next.
`pipelines[].config[].overwrite_text`	body	boolean	—	OverwriteSeverityText rewrites the severity text alongside the number when true.
`pipelines[].config[].parse_from`	body	string	—	ParseFrom is where a parser reads from.
`pipelines[].config[].parse_to`	body	string	—	ParseTo is where a parser writes its result.
`pipelines[].config[].path_prefix`	body	string	—	PathPrefix prefixes flattened keys.
`pipelines[].config[].pattern`	body	string	—	Pattern is a grok parser's pattern.
`pipelines[].config[].regex`	body	string	—	Regex is a regex parser's expression.
`pipelines[].config[].routes`	body	o11y.O11yLogPipelineRoute[]	—	Routes are a router processor's routes.
`pipelines[].config[].routes[].expr`	body	string	—	Expr is the expression that selects the route.
`pipelines[].config[].routes[].output`	body	string	—	Output is the id of the processor the route sends to.
`pipelines[].config[].span_id`	body	o11y.O11yLogParseFrom	—
`pipelines[].config[].span_id.parse_from`	body	string	—	ParseFrom is the field to read.
`pipelines[].config[].to`	body	string	—	To is the destination field of a move or copy.
`pipelines[].config[].trace_flags`	body	o11y.O11yLogParseFrom	—
`pipelines[].config[].trace_flags.parse_from`	body	string	—	ParseFrom is the field to read.
`pipelines[].config[].trace_id`	body	o11y.O11yLogParseFrom	—
`pipelines[].config[].trace_id.parse_from`	body	string	—	ParseFrom is the field to read.
`pipelines[].config[].type`	body	string	—	Type is the processor type, e.g.
`pipelines[].config[].value`	body	string	—	Value is the value an add processor writes.
`pipelines[].createdAt`	body	string (date-time)	—	CreatedAt is when the pipeline was created.
`pipelines[].createdBy`	body	string	—	CreatedBy is the id of who created the pipeline.
`pipelines[].description`	body	string	—	Description says what the pipeline is for.
`pipelines[].enabled`	body	boolean	—	Enabled says whether the pipeline is on.
`pipelines[].filter`	body	o11y.O11yLogFilter	—
`pipelines[].filter.items`	body	o11y.O11yLogFilterItem[]	—	Items are the predicates.
`pipelines[].filter.items[].key`	body	o11y.O11yLogFilterKey	—
`pipelines[].filter.items[].key.dataType`	body	string	—	DataType is the field's data type, e.g.
`pipelines[].filter.items[].key.isColumn`	body	boolean	—	IsColumn marks a field materialized as its own column.
`pipelines[].filter.items[].key.isJSON`	body	boolean	—	IsJSON marks a path into the record's JSON body.
`pipelines[].filter.items[].key.key`	body	string	—	Key is the field's name.
`pipelines[].filter.items[].key.type`	body	string	—	Type is where the field lives: tag or resource.
`pipelines[].filter.items[].op`	body	string	—	Op is the comparison, e.g.
`pipelines[].filter.items[].value`	body	any	—	Value is what it tests against, in the value's own JSON type.
`pipelines[].filter.op`	body	string	—	Op combines the items: AND or OR.
`pipelines[].id`	body	string	—	ID is the pipeline's id.
`pipelines[].name`	body	string	—	Name is the pipeline's display name.
`pipelines[].orderId`	body	integer	—	OrderID is the pipeline's 1-based position in the set.
`pipelines[].updatedAt`	body	string (date-time)	—	UpdatedAt is when the pipeline last changed.
`pipelines[].updatedBy`	body	string	—	UpdatedBy is the id of who last changed it.

Response

Status	Body	Meaning
`200`	o11y.O11yLogPipelinePreviewOut	ok

200 body — 22 fields.

Field	In	Type	Always	Description
`data`	body	o11y.O11yLogPipelinePreview	—
`data.collectorLogs`	body	string[]	—	CollectorLogs is what the collector logged while simulating.
`data.logs`	body	o11y.O11yLogRecord[]	—	Logs are the sample records after the pipelines ran over them.
`data.logs[].attributes_bool`	body	object	—	AttributesBool are the record's boolean attributes.
`data.logs[].attributes_bool.*`	body	boolean	—
`data.logs[].attributes_float`	body	object	—	AttributesFloat are the record's float attributes.
`data.logs[].attributes_float.*`	body	number	—
`data.logs[].attributes_int`	body	object	—	AttributesInt are the record's integer attributes.
`data.logs[].attributes_int.*`	body	integer	—
`data.logs[].attributes_string`	body	object	—	AttributesString are the record's string attributes.
`data.logs[].attributes_string.*`	body	string	—
`data.logs[].body`	body	string	—	Body is the record's body.
`data.logs[].id`	body	string	—	ID is the record's id.
`data.logs[].resources_string`	body	object	—	ResourcesString are the record's string resource attributes.
`data.logs[].resources_string.*`	body	string	—
`data.logs[].severity_number`	body	integer	—	SeverityNumber is the record's severity as a number.
`data.logs[].severity_text`	body	string	—	SeverityText is the record's severity as text, e.g.
`data.logs[].span_id`	body	string	—	SpanID is the span the record belongs to.
`data.logs[].timestamp`	body	integer	—	Timestamp is the record's time as a nanosecond epoch.
`data.logs[].trace_flags`	body	integer	—	TraceFlags are the record's trace flags.
`data.logs[].trace_id`	body	string	—	TraceID is the trace the record belongs to.
`status`	body	string	—	Status is "success".

Failure carries the platform error shape — see Errors.

Examples

hanzo o11y logs pipelines preview

import { Configuration, O11yApi } from 'hanzoai';

const api = new O11yApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.postO11yLogsPipelinesPreview({ logs: [{"attributes_bool":{},"attributes_float":{},"attributes_int":{},"attributes_string":{}}], pipelines: [{"alias":"<alias>","config":[{"default":null,"enable_flattening":null,"enable_paths":null,"enabled":null}],"createdAt":"2026-01-01T00:00:00Z","createdBy":"<createdBy>"}] });

from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import O11yApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = O11yApi(client).post_o11y_logs_pipelines_preview(logs=[{"attributes_bool":{},"attributes_float":{},"attributes_int":{},"attributes_string":{}}], pipelines=[{"alias":"<alias>","config":[{"default":null,"enable_flattening":null,"enable_paths":null,"enabled":null}],"createdAt":"2026-01-01T00:00:00Z","createdBy":"<createdBy>"}])

cfg := cloud.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := cloud.NewAPIClient(cfg)

resp, _, err := client.O11yAPI.PostO11yLogsPipelinesPreview(context.Background()).Execute()
if err != nil {
	return err
}

use hanzo_cloud::apis::{configuration::Configuration, o11y_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = o11y_api::post_o11y_logs_pipelines_preview(&cfg, Default::default()).await?;

import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.O11yApi;

ApiClient client = new ApiClient();
client.setRequestInterceptor(b -> b.header("Authorization", "Bearer " + System.getenv("HANZO_API_KEY")));

var result = new O11yApi(client).postO11yLogsPipelinesPreview();

curl -X POST https://api.hanzo.ai/v1/o11y/logs/pipelines/preview \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "logs": [
         {
           "attributes_bool": {},
           "attributes_float": {},
           "attributes_int": {},
           "attributes_string": {}
         }
       ],
       "pipelines": [
         {
           "alias": "<alias>",
           "config": [
             {
               "default": null,
               "enable_flattening": null,
               "enable_paths": null,
               "enabled": null
             }
           ],
           "createdAt": "2026-01-01T00:00:00Z",
           "createdBy": "<createdBy>"
         }
       ]
     }'

The door reaches o11y through the o11y tool, which names its 340 operations with its own verbs — this one among them, under a name only the door declares. describe explains any of them:

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "get_o11y_alert_last"
         }
       }
     }'

O11y API · All Hanzo APIs · Interactive reference

Runs the given log parsing pipelines over the given sample records without…

Request

Response

Examples

On this page