# Create pipelines URL: https://docs.hanzo.ai/docs/openapi/o11y/post-o11y-logs-pipelines > Saves the given log parsing pipelines as the new config version for the caller's org and starts deploying it. `POST /v1/o11y/logs/pipelines` > [O11y →](https://docs.hanzo.ai/docs/openapi/o11y) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides) | | | | ------------- | --------------------------------------------- | | **Address** | `https://api.hanzo.ai/v1/o11y/logs/pipelines` | | **Method** | `POST` | | **Operation** | `post_o11y_logs_pipelines` | | **Auth** | `Authorization: Bearer $HANZO_API_KEY` | Saves the given log parsing pipelines as the new config version for the caller's org and starts deploying it. The set REPLACES the current one: a pipeline left out of the request is dropped from the new version, and an empty set drops them all. Callers need the editor role; the runtime's own gate enforces it. ## Request 55 fields, body `application/json` (required). | Field | In | Type | Required | Description | | --------------------------------------------- | ---- | ------------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | | `pipelines` | body | o11y.O11yLogPostablePipeline\[] | — | Pipelines are the pipelines the new version holds, in order. | | `pipelines[].alias` | body | string | — | Alias is the pipeline's short name. | | `pipelines[].config` | body | o11y.O11yLogPipelineOperator\[] | — | Config is the pipeline's processors, in order. | | `pipelines[].config[].default` | body | string | — | Default is the id of the processor a router falls through to. | | `pipelines[].config[].enable_flattening` | body | boolean | — | EnableFlattening flattens parsed JSON one level when true. | | `pipelines[].config[].enable_paths` | body | boolean | — | EnablePaths keeps the JSON path in flattened keys when true. | | `pipelines[].config[].enabled` | body | boolean | — | Enabled turns the processor on. | | `pipelines[].config[].expr` | body | string | — | Expr is a router route's expression. | | `pipelines[].config[].field` | body | string | — | Field is the field an add/remove processor works on. | | `pipelines[].config[].fields` | body | string\[] | — | Fields are the fields a retain processor keeps. | | `pipelines[].config[].from` | body | string | — | From is the source field of a move or copy. | | `pipelines[].config[].id` | body | string | — | ID is the processor's id, unique within the pipeline. | | `pipelines[].config[].if` | body | string | — | If gates the processor on an expression. | | `pipelines[].config[].layout` | body | string | — | Layout is a time parser's layout. | | `pipelines[].config[].layout_type` | body | string | — | LayoutType is the layout's kind, e.g. strptime, gotime, epoch. | | `pipelines[].config[].mapping` | body | object | — | Mapping maps severity levels (or flattened keys) to the values that mean them. | | `pipelines[].config[].mapping.*` | body | string\[] | — | | | `pipelines[].config[].name` | body | string | — | Name is the processor's display name. | | `pipelines[].config[].on_error` | body | string | — | OnError says what to do when the processor fails, e.g. send, drop. | | `pipelines[].config[].orderId` | body | integer (int64) | — | OrderID is the processor's 1-based position in the pipeline. | | `pipelines[].config[].output` | body | string | — | Output is the id of the processor that runs next. | | `pipelines[].config[].overwrite_text` | body | boolean | — | OverwriteSeverityText rewrites the severity text alongside the number when true. | | `pipelines[].config[].parse_from` | body | string | — | ParseFrom is where a parser reads from. | | `pipelines[].config[].parse_to` | body | string | — | ParseTo is where a parser writes its result. | | `pipelines[].config[].path_prefix` | body | string | — | PathPrefix prefixes flattened keys. | | `pipelines[].config[].pattern` | body | string | — | Pattern is a grok parser's pattern. | | `pipelines[].config[].regex` | body | string | — | Regex is a regex parser's expression. | | `pipelines[].config[].routes` | body | o11y.O11yLogPipelineRoute\[] | — | Routes are a router processor's routes. | | `pipelines[].config[].routes[].expr` | body | string | — | Expr is the expression that selects the route. | | `pipelines[].config[].routes[].output` | body | string | — | Output is the id of the processor the route sends to. | | `pipelines[].config[].span_id` | body | o11y.O11yLogParseFrom | — | | | `pipelines[].config[].span_id.parse_from` | body | string | — | ParseFrom is the field to read. | | `pipelines[].config[].to` | body | string | — | To is the destination field of a move or copy. | | `pipelines[].config[].trace_flags` | body | o11y.O11yLogParseFrom | — | | | `pipelines[].config[].trace_flags.parse_from` | body | string | — | ParseFrom is the field to read. | | `pipelines[].config[].trace_id` | body | o11y.O11yLogParseFrom | — | | | `pipelines[].config[].trace_id.parse_from` | body | string | — | ParseFrom is the field to read. | | `pipelines[].config[].type` | body | string | — | Type is the processor type, e.g. grok\_parser, regex\_parser, json\_parser, trace\_parser, time\_parser, severity\_parser, add, remove, move, copy. | | `pipelines[].config[].value` | body | string | — | Value is the value an add processor writes. | | `pipelines[].description` | body | string | — | Description says what the pipeline is for. | | `pipelines[].enabled` | body | boolean | — | Enabled turns the pipeline on. | | `pipelines[].filter` | body | o11y.O11yLogFilter | — | | | `pipelines[].filter.items` | body | o11y.O11yLogFilterItem\[] | — | Items are the predicates. | | `pipelines[].filter.items[].key` | body | o11y.O11yLogFilterKey | — | | | `pipelines[].filter.items[].key.dataType` | body | string | — | DataType is the field's data type, e.g. string, int64, float64, bool. | | `pipelines[].filter.items[].key.isColumn` | body | boolean | — | IsColumn marks a field materialized as its own column. | | `pipelines[].filter.items[].key.isJSON` | body | boolean | — | IsJSON marks a path into the record's JSON body. | | `pipelines[].filter.items[].key.key` | body | string | — | Key is the field's name. | | `pipelines[].filter.items[].key.type` | body | string | — | Type is where the field lives: tag or resource. | | `pipelines[].filter.items[].op` | body | string | — | Op is the comparison, e.g. =, !=, in, contains. | | `pipelines[].filter.items[].value` | body | any | — | Value is what it tests against, in the value's own JSON type. | | `pipelines[].filter.op` | body | string | — | Op combines the items: AND or OR. | | `pipelines[].id` | body | string | — | ID is the pipeline's id. | | `pipelines[].name` | body | string | — | Name is the pipeline's display name. | | `pipelines[].orderId` | body | integer (int64) | — | OrderID is the pipeline's 1-based position in the set. | ## Response | Status | Body | Meaning | | --------- | ------------------------ | ----------------- | | `200` | o11y.O11yLogPipelinesOut | ok | | `202` | Approval | held for approval | | `default` | problem-details | refused | `200` body — 90 fields. | Field | In | Type | Always | Description | | -------------------------------------------------- | ---- | ------------------------------- | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------- | | `data` | body | o11y.O11yLogPipelines | — | | | `data.config` | body | string | — | Config is the rendered collector config the version deployed. | | `data.createdAt` | body | string (date-time) | — | CreatedAt is when the version was created. | | `data.createdBy` | body | string | — | CreatedBy is the id of who created the version. | | `data.createdByName` | body | string | — | CreatedByName is the display name of who created the version. | | `data.deployResult` | body | string | — | DeployResult is the deployment's outcome message. | | `data.deploySequence` | body | integer (int64) | — | DeploySequence orders this deployment among the version's deployments. | | `data.deployStatus` | body | string | — | DeployStatus is where the deployment stands, e.g. dirty, deploying, deployed, in\_progress, failed, unknown. | | `data.elementType` | body | string | — | ElementType is the config element this version carries — log\_pipelines. | | `data.history` | body | o11y.O11yLogConfigVersion\[] | — | History is the recent version history, newest first. | | `data.history[].config` | body | string | — | Config is the rendered collector config the version deployed. | | `data.history[].createdAt` | body | string (date-time) | — | CreatedAt is when the version was created. | | `data.history[].createdBy` | body | string | — | CreatedBy is the id of who created the version. | | `data.history[].createdByName` | body | string | — | CreatedByName is the display name of who created the version. | | `data.history[].deployResult` | body | string | — | DeployResult is the deployment's outcome message. | | `data.history[].deploySequence` | body | integer (int64) | — | DeploySequence orders this deployment among the version's deployments. | | `data.history[].deployStatus` | body | string | — | DeployStatus is where the deployment stands, e.g. dirty, deploying, deployed, in\_progress, failed, unknown. | | `data.history[].elementType` | body | string | — | ElementType is the config element the version carries — log\_pipelines. | | `data.history[].id` | body | string | — | ID is the version record's id. | | `data.history[].lastHash` | body | string | — | LastHash is the deployed config's hash. | | `data.history[].orgId` | body | string | — | OrgID is the org the version belongs to. | | `data.history[].updatedAt` | body | string (date-time) | — | UpdatedAt is when the version last changed. | | `data.history[].updatedBy` | body | string | — | UpdatedBy is the id of who last changed it. | | `data.history[].version` | body | integer (int64) | — | Version is the config version number. | | `data.id` | body | string | — | ID is the version record's id. | | `data.lastHash` | body | string | — | LastHash is the deployed config's hash. | | `data.orgId` | body | string | — | OrgID is the org the version belongs to. | | `data.pipelines` | body | o11y.O11yLogPipeline\[] | — | Pipelines are the version's pipelines, in order. | | `data.pipelines[].alias` | body | string | — | Alias is the pipeline's short name. | | `data.pipelines[].config` | body | o11y.O11yLogPipelineOperator\[] | — | Config is the pipeline's processors, in order. | | `data.pipelines[].config[].default` | body | string | — | Default is the id of the processor a router falls through to. | | `data.pipelines[].config[].enable_flattening` | body | boolean | — | EnableFlattening flattens parsed JSON one level when true. | | `data.pipelines[].config[].enable_paths` | body | boolean | — | EnablePaths keeps the JSON path in flattened keys when true. | | `data.pipelines[].config[].enabled` | body | boolean | — | Enabled turns the processor on. | | `data.pipelines[].config[].expr` | body | string | — | Expr is a router route's expression. | | `data.pipelines[].config[].field` | body | string | — | Field is the field an add/remove processor works on. | | `data.pipelines[].config[].fields` | body | string\[] | — | Fields are the fields a retain processor keeps. | | `data.pipelines[].config[].from` | body | string | — | From is the source field of a move or copy. | | `data.pipelines[].config[].id` | body | string | — | ID is the processor's id, unique within the pipeline. | | `data.pipelines[].config[].if` | body | string | — | If gates the processor on an expression. | | `data.pipelines[].config[].layout` | body | string | — | Layout is a time parser's layout. | | `data.pipelines[].config[].layout_type` | body | string | — | LayoutType is the layout's kind, e.g. strptime, gotime, epoch. | | `data.pipelines[].config[].mapping` | body | object | — | Mapping maps severity levels (or flattened keys) to the values that mean them. | | `data.pipelines[].config[].mapping.*` | body | string\[] | — | | | `data.pipelines[].config[].name` | body | string | — | Name is the processor's display name. | | `data.pipelines[].config[].on_error` | body | string | — | OnError says what to do when the processor fails, e.g. send, drop. | | `data.pipelines[].config[].orderId` | body | integer (int64) | — | OrderID is the processor's 1-based position in the pipeline. | | `data.pipelines[].config[].output` | body | string | — | Output is the id of the processor that runs next. | | `data.pipelines[].config[].overwrite_text` | body | boolean | — | OverwriteSeverityText rewrites the severity text alongside the number when true. | | `data.pipelines[].config[].parse_from` | body | string | — | ParseFrom is where a parser reads from. | | `data.pipelines[].config[].parse_to` | body | string | — | ParseTo is where a parser writes its result. | | `data.pipelines[].config[].path_prefix` | body | string | — | PathPrefix prefixes flattened keys. | | `data.pipelines[].config[].pattern` | body | string | — | Pattern is a grok parser's pattern. | | `data.pipelines[].config[].regex` | body | string | — | Regex is a regex parser's expression. | | `data.pipelines[].config[].routes` | body | o11y.O11yLogPipelineRoute\[] | — | Routes are a router processor's routes. | | `data.pipelines[].config[].routes[].expr` | body | string | — | Expr is the expression that selects the route. | | `data.pipelines[].config[].routes[].output` | body | string | — | Output is the id of the processor the route sends to. | | `data.pipelines[].config[].span_id` | body | o11y.O11yLogParseFrom | — | | | `data.pipelines[].config[].span_id.parse_from` | body | string | — | ParseFrom is the field to read. | | `data.pipelines[].config[].to` | body | string | — | To is the destination field of a move or copy. | | `data.pipelines[].config[].trace_flags` | body | o11y.O11yLogParseFrom | — | | | `data.pipelines[].config[].trace_flags.parse_from` | body | string | — | ParseFrom is the field to read. | | `data.pipelines[].config[].trace_id` | body | o11y.O11yLogParseFrom | — | | | `data.pipelines[].config[].trace_id.parse_from` | body | string | — | ParseFrom is the field to read. | | `data.pipelines[].config[].type` | body | string | — | Type is the processor type, e.g. grok\_parser, regex\_parser, json\_parser, trace\_parser, time\_parser, severity\_parser, add, remove, move, copy. | | `data.pipelines[].config[].value` | body | string | — | Value is the value an add processor writes. | | `data.pipelines[].createdAt` | body | string (date-time) | — | CreatedAt is when the pipeline was created. | | `data.pipelines[].createdBy` | body | string | — | CreatedBy is the id of who created the pipeline. | | `data.pipelines[].description` | body | string | — | Description says what the pipeline is for. | | `data.pipelines[].enabled` | body | boolean | — | Enabled says whether the pipeline is on. | | `data.pipelines[].filter` | body | o11y.O11yLogFilter | — | | | `data.pipelines[].filter.items` | body | o11y.O11yLogFilterItem\[] | — | Items are the predicates. | | `data.pipelines[].filter.items[].key` | body | o11y.O11yLogFilterKey | — | | | `data.pipelines[].filter.items[].key.dataType` | body | string | — | DataType is the field's data type, e.g. string, int64, float64, bool. | | `data.pipelines[].filter.items[].key.isColumn` | body | boolean | — | IsColumn marks a field materialized as its own column. | | `data.pipelines[].filter.items[].key.isJSON` | body | boolean | — | IsJSON marks a path into the record's JSON body. | | `data.pipelines[].filter.items[].key.key` | body | string | — | Key is the field's name. | | `data.pipelines[].filter.items[].key.type` | body | string | — | Type is where the field lives: tag or resource. | | `data.pipelines[].filter.items[].op` | body | string | — | Op is the comparison, e.g. =, !=, in, contains. | | `data.pipelines[].filter.items[].value` | body | any | — | Value is what it tests against, in the value's own JSON type. | | `data.pipelines[].filter.op` | body | string | — | Op combines the items: AND or OR. | | `data.pipelines[].id` | body | string | — | ID is the pipeline's id. | | `data.pipelines[].name` | body | string | — | Name is the pipeline's display name. | | `data.pipelines[].orderId` | body | integer (int64) | — | OrderID is the pipeline's 1-based position in the set. | | `data.pipelines[].updatedAt` | body | string (date-time) | — | UpdatedAt is when the pipeline last changed. | | `data.pipelines[].updatedBy` | body | string | — | UpdatedBy is the id of who last changed it. | | `data.updatedAt` | body | string (date-time) | — | UpdatedAt is when the version last changed. | | `data.updatedBy` | body | string | — | UpdatedBy is the id of who last changed it. | | `data.version` | body | integer (int64) | — | Version is the config version number. | | `status` | body | string | — | Status is "success". | Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors). ## Examples **CLI** ```bash hanzo o11y logs pipelines create ``` **SDK** **.ts** ```ts import { Configuration, O11yApi } from 'hanzoai'; const api = new O11yApi(new Configuration({ accessToken: process.env.HANZO_API_KEY })); const { data } = await api.postO11yLogsPipelines({ pipelines: [{"alias":"","config":[{"default":null,"enable_flattening":null,"enable_paths":null,"enabled":null}],"description":"","enabled":false}] }); ``` **.py** ```python from hanzoai.cloud import ApiClient, Configuration from hanzoai.cloud.api import O11yApi client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"])) result = O11yApi(client).post_o11y_logs_pipelines(pipelines=[{"alias":"","config":[{"default":null,"enable_flattening":null,"enable_paths":null,"enabled":null}],"description":"","enabled":false}]) ``` **.go** ```go cfg := hanzoai.NewConfiguration() cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY")) client := hanzoai.NewAPIClient(cfg) resp, _, err := client.O11yAPI.PostO11yLogsPipelines(context.Background()).Execute() if err != nil { return err } ``` **.rs** ```rust use hanzo_client::apis::{configuration::Configuration, o11y_api}; let mut cfg = Configuration::new(); cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok(); let result = o11y_api::post_o11y_logs_pipelines(&cfg, Default::default()).await?; ``` **.java** ```java import ai.hanzo.cloud.ApiClient; import ai.hanzo.cloud.api.O11yApi; ApiClient client = new ApiClient(); client.setBearerToken(System.getenv("HANZO_API_KEY")); var result = new O11yApi(client).postO11yLogsPipelines(); ``` **HTTP** ```bash curl -X POST https://api.hanzo.ai/v1/o11y/logs/pipelines \ -H "Authorization: Bearer $HANZO_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "pipelines": [ { "alias": "", "config": [ { "default": null, "enable_flattening": null, "enable_paths": null, "enabled": null } ], "description": "", "enabled": false } ] }' ``` **MCP** MCP reaches **o11y** through the `o11y` tool, which names its 307 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them: ```bash curl -X POST https://api.hanzo.ai/v1/mcp \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "describe", "arguments": { "op": "list_o11y_autocomplete_aggregate_attributes" } } }' ``` --- [O11y API](https://docs.hanzo.ai/docs/openapi/o11y) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)