An optional character encoding to aid in detecting the character encoding of the contents of the objects while processing. It is recommended to set this value as ISO_8859_1 when configuring content of the objects having more numeric characters, and very few alphabets. For e.g. this applies when configuring VCN Flow Logs.
The type of log collection.
The OCID of the compartment to which this rule belongs.
Defined tags for this resource. Each key is predefined and scoped to a namespace. Example: {@code {"foo-namespace": {"bar-key": "value"}}}
A string that describes the details of the rule. It does not have to be unique, and can be changed. Avoid entering confidential information.
Logging Analytics entity OCID to associate the processed logs with.
Simple key-value pair that is applied without any predefined name, type or scope. Exists for cross-compatibility only. Example: {@code {"bar-key": "value"}}
The OCID of this rule.
Whether or not this rule is currently enabled.
Flag to allow historic collection if poll period overlaps with existing ACTIVE collection rule
Last Collected Object for the rule
A detailed status of the life cycle state.
The current state of the rule.
Logging Analytics Log group OCID to associate the processed logs with.
The logSet to be associated with the processed logs. The logSet feature can be used by customers with high volume of data and this feature has to be enabled for a given tenancy prior to its usage. When logSetExtRegex value is provided, it will take precedence over this logSet value and logSet will be computed dynamically using logSetKey and logSetExtRegex.
The regex to be applied against given logSetKey. Regex has to be in string escaped format.
An optional parameter to indicate from where the logSet to be extracted using logSetExtRegex. Default value is OBJECT_PATH (e.g. /n/
Name of the Logging Analytics Source to use for the processing.
Type of files/objects in this object collection rule.
A unique name to the rule. The name must be unique, within the tenancy, and cannot be changed.
When the filters are provided, only the objects matching the filters are picked up for processing. The matchType supported is exact match and accommodates wildcard "*". For more information on filters, see Event Filters.
Name of the Object Storage bucket.
Object Storage namespace.
Use this to override some property values which are defined at bucket level to the scope of object. Supported propeties for override are: logSourceName, charEncoding, entityId. Supported matchType for override are "contains".
The oldest time of the file in the bucket to consider for collection. Accepted values are: BEGINNING or CURRENT_TIME or RFC3339 formatted datetime string. Use this for HISTORIC or HISTORIC_LIVE collection types. When collectionType is LIVE, specifying pollSince value other than CURRENT_TIME will result in error.
The newest time of the file in the bucket to consider for collection. Accepted values are: CURRENT_TIME or RFC3339 formatted datetime string. Use this for HISTORIC collection type. When collectionType is LIVE or HISTORIC_LIVE, specifying pollTill will result in error.
The time from which to consume the objects, if streamCursorType is AT_TIME.
Cursor type used to fetch messages from stream. When the streamCursorType is set to DEFAULT, the existing cursor position will be used if already set by any previous objection collection rule(s) using the same stream. Otherwise, the behaviour is to consume from the oldest available message in the stream. When the streamCursorType is set to TRIM_HORIZON, the behaviour is to start consuming from the oldest available message in the stream. When the streamCursorType is set to LATEST, the behavior is to start consuming messages that were published after the creation of this rule. When the streamCursorType is set to AT_TIME, the behavior is to start consuming from a given time. For more information on cursor types, see Stream Consumer Groups.
A Stream OCID is required for Object Collection rules of type LIVE or HISTORIC_LIVE, which will be used by Logging Analytics while creating Event Rule and consume the event notifications created by the Object Storage.
The time when this rule was created. An RFC3339 formatted datetime string.
The time when this rule was last updated. An RFC3339 formatted datetime string.
Timezone to be used when processing log entries whose timestamps do not include an explicit timezone. When this property is not specified, the timezone of the entity specified is used. If the entity is also not specified or do not have a valid timezone then UTC is used.
The configuration details of an Object Storage based collection rule.