Referência do conector Cribl

info

Beta

Esse recurso está em Beta. Para usá-lo, um administrador de workspace deve ativar o Lakeflow Connect para Cribl na página Pré-visualizações . Consulte Gerenciar prévias do Databricks.

Esta página contém informações de referência sobre o conector gerenciado do Cribl, incluindo tabelas de origem suportadas e esquemas de tabela de destino.

Tabelas de origem compatíveis

O conector Cribl oferece compatibilidade com as seguintes tabelas de origem, todas sob o esquema de origem default. As tabelas com escopo de Grupo Worker são ingeridas de cada Grupo de Worker de Transmissão, Borda e Pesquisa no Workspace, a menos que você defina group_allowlist.

Tabela de origem	Chave primária	Descrição	Modo de sincronização	Campo do cursor
worker_groups	product, id	Grupos e flotas de worker para os produtos de Transmissão, Edge, Pesquisa e Outpost.	Somente refresh completo
workers	product, id	Workers e nós de borda para produtos de transmissão e borda.	Somente refresh completo
health	host	Status de saúde do Líder do Workspace.	Somente refresh completo
pipelines	group, id	Pipelines em cada Worker Group.	Somente refresh completo
routes	group, id	Tabela de rotas em cada grupo de Worker.	Somente refresh completo
sources	group, id	Configurações de origem (entrada) em cada Grupo Worker.	Somente refresh completo
destinations	group, id	Configurações de destino (saída) em cada grupo de worker.	Somente refresh completo
parsers	group, id	Entradas da biblioteca de analisadores em cada Grupo de Worker.	Somente refresh completo
breakers	group, id	Conjuntos de regras do Event Breaker em cada grupo de worker.	Somente refresh completo
grok_patterns	group, id	Arquivos de padrão Grok em cada Grupo de Worker.	Somente refresh completo
schemas	group, id	Entradas da biblioteca de esquemas em cada Grupo de Workers.	Somente refresh completo
collectors	group, id	Jobs de coletor em cada grupo de worker.	Somente refresh completo
database_connections	group, id	Conexões de banco de dados em cada Worker Group.	Somente refresh completo
packs	group, id	Pacotes instalados em cada Worker Group.	Somente refresh completo
inputs_status	group, id	Status de saúde e métricas para cada origem em cada grupo de worker.	Somente refresh completo
outputs_status	group, id	Status de saúde e métricas para cada Destino em cada Grupo de worker.	Somente refresh completo
functions	worker_group, id	Funções disponíveis em cada Worker Group.	Somente refresh completo
workspaces	workspaceId	Workspace na Organização.	Somente refresh completo
api_credentials	clientId	Credenciais de API na Organização. Os segredos do cliente não são ingeridos.	Somente refresh completo
audit_log	time, event_id	Eventos de log de auditoria do líder.	Incremental	time
access_log	time, event_id	Eventos de Logs de acesso da API do Leader.	Incremental	time

Tabela de origem	Chave primária	Descrição	Modo de sincronização	Campo do cursor
worker_groups	product, id	Grupos e flotas de worker para os produtos de Transmissão, Edge, Pesquisa e Outpost.	Somente refresh completo
workers	product, id	Workers e nós de borda para produtos de transmissão e borda.	Somente refresh completo
health	host	Status de saúde do Líder do Workspace.	Somente refresh completo
pipelines	group, id	Pipelines em cada Worker Group.	Somente refresh completo
routes	group, id	Tabela de rotas em cada grupo de Worker.	Somente refresh completo
sources	group, id	Configurações de origem (entrada) em cada Grupo Worker.	Somente refresh completo
destinations	group, id	Configurações de destino (saída) em cada grupo de worker.	Somente refresh completo
parsers	group, id	Entradas da biblioteca de analisadores em cada Grupo de Worker.	Somente refresh completo
breakers	group, id	Conjuntos de regras do Event Breaker em cada grupo de worker.	Somente refresh completo
grok_patterns	group, id	Arquivos de padrão Grok em cada Grupo de Worker.	Somente refresh completo
schemas	group, id	Entradas da biblioteca de esquemas em cada Grupo de Workers.	Somente refresh completo
collectors	group, id	Jobs de coletor em cada grupo de worker.	Somente refresh completo
database_connections	group, id	Conexões de banco de dados em cada Worker Group.	Somente refresh completo
packs	group, id	Pacotes instalados em cada Worker Group.	Somente refresh completo
inputs_status	group, id	Status de saúde e métricas para cada origem em cada grupo de worker.	Somente refresh completo
outputs_status	group, id	Status de saúde e métricas para cada Destino em cada Grupo de worker.	Somente refresh completo
functions	worker_group, id	Funções disponíveis em cada Worker Group.	Somente refresh completo
workspaces	workspaceId	Workspace na Organização.	Somente refresh completo
api_credentials	clientId	Credenciais de API na Organização. Os segredos do cliente não são ingeridos.	Somente refresh completo
audit_log	time, event_id	Eventos de log de auditoria do líder.	Incremental	time
access_log	time, event_id	Eventos de Logs de acesso da API do Leader.	Incremental	time

Opções do conector

O conector Cribl é compatível com as seguintes opções no nível de pipeline. Para obter informações sobre o uso, consulte Exemplos.

Opção	Tipo	Escopo	Obrigatório	Aplica-se a	Descrição
control_plane_host	String	Pipeline	Não	Todas as tabelas, exceto workspaces e api_credentials	Hostname da API do Cribl.Cloud Workspace, sem o esquema https://. É default <workspace-id>-<organization-id>.cribl.cloud.
management_plane_host	String	Pipeline	Não	workspaces, api_credentials	Hostname da API de gerenciamento Cribl.Cloud, sem o esquema https://. É default gateway.cribl.cloud.
group_allowlist	String	Pipeline	Não	Todas as tabelas com escopo de Worker Group	Lista separada por vírgula de IDs de Grupo de Worker a ingerir. default é todos os Grupos de Worker.
start_datetime	String	Pipeline	Não	audit_log, access_log	Hora do log mais antiga para ingestão na primeira sincronização, no formato yyyy-MM-dd'T'HH:mm:ss.SSS'Z'. default é 365 dias antes da sincronização.

Opção	Tipo	Escopo	Obrigatório	Aplica-se a	Descrição
control_plane_host	String	Pipeline	Não	Todas as tabelas, exceto workspaces e api_credentials	Hostname da API do Cribl.Cloud Workspace, sem o esquema https://. É default <workspace-id>-<organization-id>.cribl.cloud.
management_plane_host	String	Pipeline	Não	workspaces, api_credentials	Hostname da API de gerenciamento Cribl.Cloud, sem o esquema https://. É default gateway.cribl.cloud.
group_allowlist	String	Pipeline	Não	Todas as tabelas com escopo de Worker Group	Lista separada por vírgula de IDs de Grupo de Worker a ingerir. default é todos os Grupos de Worker.
start_datetime	String	Pipeline	Não	audit_log, access_log	Hora do log mais antiga para ingestão na primeira sincronização, no formato yyyy-MM-dd'T'HH:mm:ss.SSS'Z'. default é 365 dias antes da sincronização.

Esquemas de tabela de destino

worker_groups

key primária: product, id

Modo de sincronização: Apenas refresh completo

campo	Tipo de dados
id	STRING
name	STRING
description	STRING
type	STRING
tags	STRING
streamtags	ARRAY<STRING>
onPrem	BOOLEAN
provisioned	BOOLEAN
estimatedIngestRate	BIGINT
cloud	STRUCT<provider: STRING, region: STRING>
workerRemoteAccess	BOOLEAN
product	STRING
isFleet	BOOLEAN
isSearch	BOOLEAN
collectorsHaEnabled	BOOLEAN
configVersion	STRING
workerCount	BIGINT
deployingWorkerCount	BIGINT
incompatibleWorkerCount	BIGINT
maxWorkerAge	STRING
upgradeVersion	STRING
inherits	STRING
git	STRUCT<commit: STRING, localChanges: BIGINT, log: ARRAY<STRUCT<author_email: STRING, author_name: STRING, date: STRING, hash: STRING, message: STRING, short: STRING>>>
lookupDeployments	ARRAY<STRUCT<context: STRING, lookups: ARRAY<STRUCT<deployedVersion: STRING, file: STRING, version: STRING>>>>

campo	Tipo de dados
id	STRING
name	STRING
description	STRING
type	STRING
tags	STRING
streamtags	ARRAY<STRING>
onPrem	BOOLEAN
provisioned	BOOLEAN
estimatedIngestRate	BIGINT
cloud	STRUCT<provider: STRING, region: STRING>
workerRemoteAccess	BOOLEAN
product	STRING
isFleet	BOOLEAN
isSearch	BOOLEAN
collectorsHaEnabled	BOOLEAN
configVersion	STRING
workerCount	BIGINT
deployingWorkerCount	BIGINT
incompatibleWorkerCount	BIGINT
maxWorkerAge	STRING
upgradeVersion	STRING
inherits	STRING
git	STRUCT<commit: STRING, localChanges: BIGINT, log: ARRAY<STRUCT<author_email: STRING, author_name: STRING, date: STRING, hash: STRING, message: STRING, short: STRING>>>
lookupDeployments	ARRAY<STRUCT<context: STRING, lookups: ARRAY<STRUCT<deployedVersion: STRING, file: STRING, version: STRING>>>>

workers

key primária: product, id

Modo de sincronização: Apenas refresh completo

campo	Tipo de dados
id	STRING
status	STRING
group	STRING
info	STRUCT<apiPort: BIGINT, apiScheme: STRING, architecture: STRING, aws: STRUCT<enabled: BOOLEAN, instanceId: STRING, region: STRING, tags: MAP<STRING, STRING>, type: STRING, zone: STRING>, azure: STRUCT<enabled: BOOLEAN, hostname: STRING, instanceId: STRING, name: STRING, region: STRING, resourceGroup: STRING, subscriptionId: STRING, tags: MAP<STRING, STRING>, type: STRING, vmId: STRING, zone: STRING>, conn_ip: STRING, cpus: BIGINT, cribl: STRUCT<config: STRUCT<apiCredentialsRev: STRING, featuresRev: STRING, hbPeriodSeconds: BIGINT, logStreamEnv: STRING, policyRev: STRING, teamsRev: STRING, usersRev: STRING, version: STRING>, deploymentId: STRING, disableSNIRouting: BOOLEAN, distMode: STRING, edgeNodes: BIGINT, group: STRING, guid: STRING, installType: STRING, lookupVersions: MAP<STRING, MAP<STRING, STRING>>, master: STRUCT<host: STRING, port: BIGINT, servername: STRING, tls: BOOLEAN>, overlayId: STRING, pid: BIGINT, socksEnabled: BOOLEAN, startTime: BIGINT, tags: ARRAY<STRING>, version: STRING>, env: MAP<STRING, STRING>, freeDiskSpace: BIGINT, hostOs: STRUCT<addresses: ARRAY<STRING>, enabled: BOOLEAN, id: STRING, version: STRING>, hostname: STRING, isCaptain: BOOLEAN, isSaasWorker: BOOLEAN, kube: STRUCT<enabled: BOOLEAN, namespace: STRING, node: STRING, owner: STRUCT<kind: STRING, name: STRING>, pod: STRING, source: STRING>, localTime: BIGINT, metadata: STRUCT<aws: STRUCT<enabled: BOOLEAN, instanceId: STRING, region: STRING, tags: MAP<STRING, STRING>, type: STRING, zone: STRING>, azure: STRUCT<enabled: BOOLEAN, hostname: STRING, instanceId: STRING, name: STRING, region: STRING, resourceGroup: STRING, subscriptionId: STRING, tags: MAP<STRING, STRING>, type: STRING, vmId: STRING, zone: STRING>, hostOs: STRUCT<addresses: ARRAY<STRING>, enabled: BOOLEAN, id: STRING, version: STRING>, kube: STRUCT<enabled: BOOLEAN, namespace: STRING, node: STRING, owner: STRUCT<kind: STRING, name: STRING>, pod: STRING, source: STRING>, os: STRUCT<addresses: ARRAY<STRING>, enabled: BOOLEAN, id: STRING, version: STRING>>, node: STRING, os: STRUCT<addresses: ARRAY<STRING>, enabled: BOOLEAN, id: STRING, version: STRING>, outpost: STRUCT<groupname: STRING, guid: STRING, host: STRING>, platform: STRING, release: STRING, totalDiskSpace: BIGINT, totalmem: BIGINT>
workerProcesses	BIGINT
lastMsgTime	BIGINT
firstMsgTime	BIGINT
deployable	BOOLEAN
disconnected	BOOLEAN
connectionProtocol	STRING
product	STRING
type	STRING
offlineDurationMs	BIGINT
provisioningTokenId	STRING
metadata	STRUCT<aws: STRUCT<enabled: BOOLEAN, instanceId: STRING, region: STRING, tags: MAP<STRING, STRING>, type: STRING, zone: STRING>, azure: STRUCT<enabled: BOOLEAN, hostname: STRING, instanceId: STRING, name: STRING, region: STRING, resourceGroup: STRING, subscriptionId: STRING, tags: MAP<STRING, STRING>, type: STRING, vmId: STRING, zone: STRING>, hostOs: STRUCT<addresses: ARRAY<STRING>, enabled: BOOLEAN, id: STRING, version: STRING>, kube: STRUCT<enabled: BOOLEAN, namespace: STRING, node: STRING, owner: STRUCT<kind: STRING, name: STRING>, pod: STRING, source: STRING>, os: STRUCT<addresses: ARRAY<STRING>, enabled: BOOLEAN, id: STRING, version: STRING>>
lastMetrics	MAP<STRING, VARIANT>
nodeUpgradeStatus	STRUCT<active: BIGINT, failed: BIGINT, skipped: BIGINT, state: BIGINT, timestamp: BIGINT>
workers	STRUCT<count: BIGINT>

campo	Tipo de dados
id	STRING
status	STRING
group	STRING
info	STRUCT<apiPort: BIGINT, apiScheme: STRING, architecture: STRING, aws: STRUCT<enabled: BOOLEAN, instanceId: STRING, region: STRING, tags: MAP<STRING, STRING>, type: STRING, zone: STRING>, azure: STRUCT<enabled: BOOLEAN, hostname: STRING, instanceId: STRING, name: STRING, region: STRING, resourceGroup: STRING, subscriptionId: STRING, tags: MAP<STRING, STRING>, type: STRING, vmId: STRING, zone: STRING>, conn_ip: STRING, cpus: BIGINT, cribl: STRUCT<config: STRUCT<apiCredentialsRev: STRING, featuresRev: STRING, hbPeriodSeconds: BIGINT, logStreamEnv: STRING, policyRev: STRING, teamsRev: STRING, usersRev: STRING, version: STRING>, deploymentId: STRING, disableSNIRouting: BOOLEAN, distMode: STRING, edgeNodes: BIGINT, group: STRING, guid: STRING, installType: STRING, lookupVersions: MAP<STRING, MAP<STRING, STRING>>, master: STRUCT<host: STRING, port: BIGINT, servername: STRING, tls: BOOLEAN>, overlayId: STRING, pid: BIGINT, socksEnabled: BOOLEAN, startTime: BIGINT, tags: ARRAY<STRING>, version: STRING>, env: MAP<STRING, STRING>, freeDiskSpace: BIGINT, hostOs: STRUCT<addresses: ARRAY<STRING>, enabled: BOOLEAN, id: STRING, version: STRING>, hostname: STRING, isCaptain: BOOLEAN, isSaasWorker: BOOLEAN, kube: STRUCT<enabled: BOOLEAN, namespace: STRING, node: STRING, owner: STRUCT<kind: STRING, name: STRING>, pod: STRING, source: STRING>, localTime: BIGINT, metadata: STRUCT<aws: STRUCT<enabled: BOOLEAN, instanceId: STRING, region: STRING, tags: MAP<STRING, STRING>, type: STRING, zone: STRING>, azure: STRUCT<enabled: BOOLEAN, hostname: STRING, instanceId: STRING, name: STRING, region: STRING, resourceGroup: STRING, subscriptionId: STRING, tags: MAP<STRING, STRING>, type: STRING, vmId: STRING, zone: STRING>, hostOs: STRUCT<addresses: ARRAY<STRING>, enabled: BOOLEAN, id: STRING, version: STRING>, kube: STRUCT<enabled: BOOLEAN, namespace: STRING, node: STRING, owner: STRUCT<kind: STRING, name: STRING>, pod: STRING, source: STRING>, os: STRUCT<addresses: ARRAY<STRING>, enabled: BOOLEAN, id: STRING, version: STRING>>, node: STRING, os: STRUCT<addresses: ARRAY<STRING>, enabled: BOOLEAN, id: STRING, version: STRING>, outpost: STRUCT<groupname: STRING, guid: STRING, host: STRING>, platform: STRING, release: STRING, totalDiskSpace: BIGINT, totalmem: BIGINT>
workerProcesses	BIGINT
lastMsgTime	BIGINT
firstMsgTime	BIGINT
deployable	BOOLEAN
disconnected	BOOLEAN
connectionProtocol	STRING
product	STRING
type	STRING
offlineDurationMs	BIGINT
provisioningTokenId	STRING
metadata	STRUCT<aws: STRUCT<enabled: BOOLEAN, instanceId: STRING, region: STRING, tags: MAP<STRING, STRING>, type: STRING, zone: STRING>, azure: STRUCT<enabled: BOOLEAN, hostname: STRING, instanceId: STRING, name: STRING, region: STRING, resourceGroup: STRING, subscriptionId: STRING, tags: MAP<STRING, STRING>, type: STRING, vmId: STRING, zone: STRING>, hostOs: STRUCT<addresses: ARRAY<STRING>, enabled: BOOLEAN, id: STRING, version: STRING>, kube: STRUCT<enabled: BOOLEAN, namespace: STRING, node: STRING, owner: STRUCT<kind: STRING, name: STRING>, pod: STRING, source: STRING>, os: STRUCT<addresses: ARRAY<STRING>, enabled: BOOLEAN, id: STRING, version: STRING>>
lastMetrics	MAP<STRING, VARIANT>
nodeUpgradeStatus	STRUCT<active: BIGINT, failed: BIGINT, skipped: BIGINT, state: BIGINT, timestamp: BIGINT>
workers	STRUCT<count: BIGINT>

nota

Esta tabela não suporta SCD tipo 2 porque possui colunas VARIANT.

health

Primary key: host

Modo de sincronização: Apenas refresh completo

campo	Tipo de dados
status	STRING
startTime	BIGINT
overlay	STRUCT<state: STRING>
role	STRING
isCaptain	BOOLEAN
host	STRING

campo	Tipo de dados
status	STRING
startTime	BIGINT
overlay	STRUCT<state: STRING>
role	STRING
isCaptain	BOOLEAN
host	STRING

pipelines

key primária: group, id

Modo de sincronização: Apenas refresh completo

campo	Tipo de dados
group	STRING
id	STRING
conf	STRUCT<__template_streamtags: STRING, asyncFuncTimeout: BIGINT, description: STRING, functions: ARRAY<STRUCT<conf: MAP<STRING, VARIANT>, description: STRING, disabled: BOOLEAN, filter: STRING, final: BOOLEAN, groupId: STRING, id: STRING>>, groups: MAP<STRING, STRUCT<description: STRING, disabled: BOOLEAN, name: STRING>>, output: STRING, pack: BOOLEAN, streamtags: ARRAY<STRING>>
conf_description	STRING
conf_output	STRING

campo	Tipo de dados
group	STRING
id	STRING
conf	STRUCT<__template_streamtags: STRING, asyncFuncTimeout: BIGINT, description: STRING, functions: ARRAY<STRUCT<conf: MAP<STRING, VARIANT>, description: STRING, disabled: BOOLEAN, filter: STRING, final: BOOLEAN, groupId: STRING, id: STRING>>, groups: MAP<STRING, STRUCT<description: STRING, disabled: BOOLEAN, name: STRING>>, output: STRING, pack: BOOLEAN, streamtags: ARRAY<STRING>>
conf_description	STRING
conf_output	STRING

nota

Esta tabela não suporta SCD tipo 2 porque possui colunas VARIANT.

routes

key primária: group, id

Modo de sincronização: Apenas refresh completo

campo	Tipo de dados
group	STRING
id	STRING
routes	ARRAY<STRUCT<autoParse: BOOLEAN, clones: ARRAY<MAP<STRING, STRING>>, context: STRING, description: STRING, disabled: BOOLEAN, enableOutputExpression: BOOLEAN, filter: STRING, final: BOOLEAN, groupId: STRING, id: STRING, name: STRING, output: STRING, outputExpression: STRING, pipeline: STRING, targetContext: STRING>>
comments	ARRAY<STRUCT<comment: STRING, groupId: STRING, id: STRING, index: BIGINT>>
groups	MAP<STRING, STRUCT<description: STRING, index: BIGINT, name: STRING>>

campo	Tipo de dados
group	STRING
id	STRING
routes	ARRAY<STRUCT<autoParse: BOOLEAN, clones: ARRAY<MAP<STRING, STRING>>, context: STRING, description: STRING, disabled: BOOLEAN, enableOutputExpression: BOOLEAN, filter: STRING, final: BOOLEAN, groupId: STRING, id: STRING, name: STRING, output: STRING, outputExpression: STRING, pipeline: STRING, targetContext: STRING>>
comments	ARRAY<STRUCT<comment: STRING, groupId: STRING, id: STRING, index: BIGINT>>
groups	MAP<STRING, STRUCT<description: STRING, index: BIGINT, name: STRING>>

sources

key primária: group, id

Modo de sincronização: Apenas refresh completo

campo	Tipo de dados
group	STRING
id	STRING
type	STRING
pipeline	STRING
disabled	BOOLEAN
fullFidelity	BOOLEAN
sendToRoutes	BOOLEAN
pqEnabled	BOOLEAN
streamtags	ARRAY<STRING>
status	STRUCT<error: STRUCT<details: MAP<STRING, VARIANT>, message: STRING>, health: STRING, metrics: MAP<STRING, VARIANT>, pq: STRUCT<error: STRUCT<details: MAP<STRING, VARIANT>, message: STRING>, health: BIGINT, metrics: MAP<STRING, VARIANT>, timestamp: BIGINT>, timestamp: BIGINT, useStatusFromLB: BOOLEAN>
notifications	ARRAY<STRUCT<mode: STRING, templateTargetPairs: ARRAY<STRUCT<targetId: STRING, templateId: STRING>>>>
raw	VARIANT

campo	Tipo de dados
group	STRING
id	STRING
type	STRING
pipeline	STRING
disabled	BOOLEAN
fullFidelity	BOOLEAN
sendToRoutes	BOOLEAN
pqEnabled	BOOLEAN
streamtags	ARRAY<STRING>
status	STRUCT<error: STRUCT<details: MAP<STRING, VARIANT>, message: STRING>, health: STRING, metrics: MAP<STRING, VARIANT>, pq: STRUCT<error: STRUCT<details: MAP<STRING, VARIANT>, message: STRING>, health: BIGINT, metrics: MAP<STRING, VARIANT>, timestamp: BIGINT>, timestamp: BIGINT, useStatusFromLB: BOOLEAN>
notifications	ARRAY<STRUCT<mode: STRING, templateTargetPairs: ARRAY<STRUCT<targetId: STRING, templateId: STRING>>>>
raw	VARIANT

nota

Esta tabela não suporta SCD tipo 2 porque possui colunas VARIANT.

destinations

key primária: group, id

Modo de sincronização: Apenas refresh completo

campo	Tipo de dados
group	STRING
id	STRING
type	STRING
pipeline	STRING
environment	STRING
description	STRING
defaultId	STRING
systemFields	ARRAY<STRING>
streamtags	ARRAY<STRING>
status	STRUCT<error: STRUCT<details: MAP<STRING, VARIANT>, message: STRING>, health: STRING, metrics: MAP<STRING, VARIANT>, pq: STRUCT<error: STRUCT<details: MAP<STRING, VARIANT>, message: STRING>, health: BIGINT, metrics: MAP<STRING, VARIANT>, timestamp: BIGINT>, timestamp: BIGINT, useStatusFromLB: BOOLEAN>
notifications	ARRAY<STRUCT<mode: STRING, templateTargetPairs: ARRAY<STRUCT<targetId: STRING, templateId: STRING>>>>
raw	VARIANT

campo	Tipo de dados
group	STRING
id	STRING
type	STRING
pipeline	STRING
environment	STRING
description	STRING
defaultId	STRING
systemFields	ARRAY<STRING>
streamtags	ARRAY<STRING>
status	STRUCT<error: STRUCT<details: MAP<STRING, VARIANT>, message: STRING>, health: STRING, metrics: MAP<STRING, VARIANT>, pq: STRUCT<error: STRUCT<details: MAP<STRING, VARIANT>, message: STRING>, health: BIGINT, metrics: MAP<STRING, VARIANT>, timestamp: BIGINT>, timestamp: BIGINT, useStatusFromLB: BOOLEAN>
notifications	ARRAY<STRUCT<mode: STRING, templateTargetPairs: ARRAY<STRUCT<targetId: STRING, templateId: STRING>>>>
raw	VARIANT

nota

Esta tabela não suporta SCD tipo 2 porque possui colunas VARIANT.

parsers

key primária: group, id

Modo de sincronização: Apenas refresh completo

campo	Tipo de dados
group	STRING
id	STRING
type	STRING
lib	STRING
description	STRING
tags	STRING
fields	ARRAY<STRING>
delimChar	STRING
escapeChar	STRING
nullValue	STRING
quoteChar	STRING
regex	STRING
raw	VARIANT

campo	Tipo de dados
group	STRING
id	STRING
type	STRING
lib	STRING
description	STRING
tags	STRING
fields	ARRAY<STRING>
delimChar	STRING
escapeChar	STRING
nullValue	STRING
quoteChar	STRING
regex	STRING
raw	VARIANT

nota

Esta tabela não suporta SCD tipo 2 porque possui colunas VARIANT.

breakers

key primária: group, id

Modo de sincronização: Apenas refresh completo

campo	Tipo de dados
group	STRING
id	STRING
lib	STRING
description	STRING
tags	STRING
rules	ARRAY<STRUCT<__template_timestampTimezone: STRING, cleanFields: BOOLEAN, condition: STRING, delimiter: STRING, delimiterRegex: STRING, disabled: BOOLEAN, escapeChar: STRING, eventBreakerRegex: STRING, fields: ARRAY<STRUCT<name: STRING, value: STRING>>, fieldsLineRegex: STRING, fieldsToRemove: ARRAY<STRING>, hasHeaderRow: BOOLEAN, headerLineRegex: STRING, index: BIGINT, jsonArrayField: STRING, jsonExtractAll: BOOLEAN, jsonTimeField: STRING, maxEventBytes: BIGINT, name: STRING, nullFieldVal: STRING, parentFieldsToCopy: ARRAY<STRING>, parser: VARIANT, parserEnabled: BOOLEAN, quoteChar: STRING, shouldUseDataRaw: BOOLEAN, timeField: STRING, timestamp: STRUCT<format: STRING, length: BIGINT, type: STRING>, timestampAnchorRegex: STRING, timestampEarliest: STRING, timestampLatest: STRING, timestampSourceField: STRING, timestampTimezone: STRING, type: STRING>>
minRawLength	BIGINT
raw	VARIANT

campo	Tipo de dados
group	STRING
id	STRING
lib	STRING
description	STRING
tags	STRING
rules	ARRAY<STRUCT<__template_timestampTimezone: STRING, cleanFields: BOOLEAN, condition: STRING, delimiter: STRING, delimiterRegex: STRING, disabled: BOOLEAN, escapeChar: STRING, eventBreakerRegex: STRING, fields: ARRAY<STRUCT<name: STRING, value: STRING>>, fieldsLineRegex: STRING, fieldsToRemove: ARRAY<STRING>, hasHeaderRow: BOOLEAN, headerLineRegex: STRING, index: BIGINT, jsonArrayField: STRING, jsonExtractAll: BOOLEAN, jsonTimeField: STRING, maxEventBytes: BIGINT, name: STRING, nullFieldVal: STRING, parentFieldsToCopy: ARRAY<STRING>, parser: VARIANT, parserEnabled: BOOLEAN, quoteChar: STRING, shouldUseDataRaw: BOOLEAN, timeField: STRING, timestamp: STRUCT<format: STRING, length: BIGINT, type: STRING>, timestampAnchorRegex: STRING, timestampEarliest: STRING, timestampLatest: STRING, timestampSourceField: STRING, timestampTimezone: STRING, type: STRING>>
minRawLength	BIGINT
raw	VARIANT

nota

Esta tabela não suporta SCD tipo 2 porque possui colunas VARIANT.

grok_patterns

key primária: group, id

Modo de sincronização: Apenas refresh completo

campo	Tipo de dados
group	STRING
id	STRING
content	STRING
size	BIGINT
tags	STRING

campo	Tipo de dados
group	STRING
id	STRING
content	STRING
size	BIGINT
tags	STRING

schemas

key primária: group, id

Modo de sincronização: Apenas refresh completo

campo	Tipo de dados
group	STRING
id	STRING
description	STRING
schema	STRING
tags	STRING

campo	Tipo de dados
group	STRING
id	STRING
description	STRING
schema	STRING
tags	STRING

collectors

key primária: group, id

Modo de sincronização: Apenas refresh completo

campo	Tipo de dados
group	STRING
id	STRING
type	STRING
description	STRING
environment	STRING
ttl	STRING
savedQueryId	STRING
__template_streamtags	STRING
resumeOnBoot	BOOLEAN
workerAffinity	BOOLEAN
ignoreGroupJobsLimit	BOOLEAN
removeFields	ARRAY<STRING>
streamtags	ARRAY<STRING>
collector	STRUCT<conf: VARIANT, destructive: BOOLEAN, encoding: STRING, type: STRING>
executor	STRUCT<conf: VARIANT, storeTaskResults: BOOLEAN, type: STRING>
input	STRUCT<breakerRulesets: ARRAY<STRING>, metadata: ARRAY<STRUCT<name: STRING, value: STRING>>, output: STRING, pipeline: STRING, preprocess: STRUCT<args: ARRAY<STRING>, command: STRING, disabled: BOOLEAN>, sendToRoutes: BOOLEAN, staleChannelFlushMs: DOUBLE, throttleRatePerSec: STRING, type: STRING>
schedule	STRUCT<cronSchedule: STRING, enabled: BOOLEAN, maxConcurrentRuns: BIGINT, resumeMissed: BOOLEAN, run: MAP<STRING, VARIANT>, skippable: BOOLEAN>
history	VARIANT
savedState	MAP<STRING, STRUCT<data: MAP<STRING, VARIANT>>>
notifications	ARRAY<STRUCT<condition: STRING, conf: VARIANT, disabled: BOOLEAN,Grupo: STRING, id: STRING, metadata: ARRAY<STRUCT<name: STRING, value: STRING>>, mode: STRING, pack: STRING, targetConfigs: ARRAY<STRUCT<conf: VARIANT, id: STRING>>, targets: ARRAY<STRING>, templateTargetPairs: ARRAY<STRUCT<targetId: STRING, templateId: STRING>>>>

campo	Tipo de dados
group	STRING
id	STRING
type	STRING
description	STRING
environment	STRING
ttl	STRING
savedQueryId	STRING
__template_streamtags	STRING
resumeOnBoot	BOOLEAN
workerAffinity	BOOLEAN
ignoreGroupJobsLimit	BOOLEAN
removeFields	ARRAY<STRING>
streamtags	ARRAY<STRING>
collector	STRUCT<conf: VARIANT, destructive: BOOLEAN, encoding: STRING, type: STRING>
executor	STRUCT<conf: VARIANT, storeTaskResults: BOOLEAN, type: STRING>
input	STRUCT<breakerRulesets: ARRAY<STRING>, metadata: ARRAY<STRUCT<name: STRING, value: STRING>>, output: STRING, pipeline: STRING, preprocess: STRUCT<args: ARRAY<STRING>, command: STRING, disabled: BOOLEAN>, sendToRoutes: BOOLEAN, staleChannelFlushMs: DOUBLE, throttleRatePerSec: STRING, type: STRING>
schedule	STRUCT<cronSchedule: STRING, enabled: BOOLEAN, maxConcurrentRuns: BIGINT, resumeMissed: BOOLEAN, run: MAP<STRING, VARIANT>, skippable: BOOLEAN>
history	VARIANT
savedState	MAP<STRING, STRUCT<data: MAP<STRING, VARIANT>>>
notifications	ARRAY<STRUCT<condition: STRING, conf: VARIANT, disabled: BOOLEAN,Grupo: STRING, id: STRING, metadata: ARRAY<STRUCT<name: STRING, value: STRING>>, mode: STRING, pack: STRING, targetConfigs: ARRAY<STRUCT<conf: VARIANT, id: STRING>>, targets: ARRAY<STRING>, templateTargetPairs: ARRAY<STRUCT<targetId: STRING, templateId: STRING>>>>

nota

Esta tabela não suporta SCD tipo 2 porque possui colunas VARIANT.

database_connections

key primária: group, id

Modo de sincronização: Apenas refresh completo

campo	Tipo de dados
group	STRING
id	STRING
databaseType	STRING
authType	STRING
description	STRING
tags	STRING
connectionTimeout	BIGINT
requestTimeout	BIGINT
tls	STRUCT<caPath: STRING, certPath: STRING, certificateName: STRING, disabled: BOOLEAN, maxVersion: STRING, minVersion: STRING, privKeyPath: STRING, rejectUnauthorized: BOOLEAN, servername: STRING>

campo	Tipo de dados
group	STRING
id	STRING
databaseType	STRING
authType	STRING
description	STRING
tags	STRING
connectionTimeout	BIGINT
requestTimeout	BIGINT
tls	STRUCT<caPath: STRING, certPath: STRING, certificateName: STRING, disabled: BOOLEAN, maxVersion: STRING, minVersion: STRING, privKeyPath: STRING, rejectUnauthorized: BOOLEAN, servername: STRING>

packs

key primária: group, id

Modo de sincronização: Apenas refresh completo

campo	Tipo de dados
group	STRING
id	STRING
source	STRING
version	STRING
description	STRING
displayName	STRING
author	STRING
tags	VARIANT
raw	VARIANT

campo	Tipo de dados
group	STRING
id	STRING
source	STRING
version	STRING
description	STRING
displayName	STRING
author	STRING
tags	VARIANT
raw	VARIANT

nota

Esta tabela não suporta SCD tipo 2 porque possui colunas VARIANT.

inputs_status

key primária: group, id

Modo de sincronização: Apenas refresh completo

campo	Tipo de dados
group	STRING
id	STRING
type	STRING
status	STRUCT<error: STRUCT<details: MAP<STRING, VARIANT>, message: STRING>, health: STRING, healthCounts: STRUCT<Green: BIGINT, Red: BIGINT, Unknown: BIGINT, Yellow: BIGINT>, metrics: MAP<STRING, VARIANT>, pq: STRUCT<error: STRUCT<details: MAP<STRING, VARIANT>, message: STRING>, health: STRING, healthCounts: STRUCT<Green: BIGINT, Red: BIGINT, Unknown: BIGINT, Yellow: BIGINT>, metrics: MAP<STRING, VARIANT>, timestamp: BIGINT>, timestamp: BIGINT, useStatusFromLB: BOOLEAN>
health	STRING
status_timestamp	BIGINT

campo	Tipo de dados
group	STRING
id	STRING
type	STRING
status	STRUCT<error: STRUCT<details: MAP<STRING, VARIANT>, message: STRING>, health: STRING, healthCounts: STRUCT<Green: BIGINT, Red: BIGINT, Unknown: BIGINT, Yellow: BIGINT>, metrics: MAP<STRING, VARIANT>, pq: STRUCT<error: STRUCT<details: MAP<STRING, VARIANT>, message: STRING>, health: STRING, healthCounts: STRUCT<Green: BIGINT, Red: BIGINT, Unknown: BIGINT, Yellow: BIGINT>, metrics: MAP<STRING, VARIANT>, timestamp: BIGINT>, timestamp: BIGINT, useStatusFromLB: BOOLEAN>
health	STRING
status_timestamp	BIGINT

nota

Esta tabela não suporta SCD tipo 2 porque possui colunas VARIANT.

outputs_status

key primária: group, id

Modo de sincronização: Apenas refresh completo

campo	Tipo de dados
group	STRING
id	STRING
type	STRING
status	STRUCT<error: STRUCT<details: MAP<STRING, VARIANT>, message: STRING>, health: STRING, healthCounts: STRUCT<Green: BIGINT, Red: BIGINT, Unknown: BIGINT, Yellow: BIGINT>, metrics: MAP<STRING, VARIANT>, pq: STRUCT<error: STRUCT<details: MAP<STRING, VARIANT>, message: STRING>, health: STRING, healthCounts: STRUCT<Green: BIGINT, Red: BIGINT, Unknown: BIGINT, Yellow: BIGINT>, metrics: MAP<STRING, VARIANT>, timestamp: BIGINT>, timestamp: BIGINT, useStatusFromLB: BOOLEAN>
health	STRING
status_timestamp	BIGINT

campo	Tipo de dados
group	STRING
id	STRING
type	STRING
status	STRUCT<error: STRUCT<details: MAP<STRING, VARIANT>, message: STRING>, health: STRING, healthCounts: STRUCT<Green: BIGINT, Red: BIGINT, Unknown: BIGINT, Yellow: BIGINT>, metrics: MAP<STRING, VARIANT>, pq: STRUCT<error: STRUCT<details: MAP<STRING, VARIANT>, message: STRING>, health: STRING, healthCounts: STRUCT<Green: BIGINT, Red: BIGINT, Unknown: BIGINT, Yellow: BIGINT>, metrics: MAP<STRING, VARIANT>, timestamp: BIGINT>, timestamp: BIGINT, useStatusFromLB: BOOLEAN>
health	STRING
status_timestamp	BIGINT

nota

Esta tabela não suporta SCD tipo 2 porque possui colunas VARIANT.

functions

key primária: worker_group, id

Modo de sincronização: Apenas refresh completo

campo	Tipo de dados
worker_group	STRING
id	STRING
name	STRING
version	STRING
group	STRING
disabled	BOOLEAN
handleSignals	BOOLEAN
sync	BOOLEAN
__filename	STRING
loadTime	DOUBLE
modTime	DOUBLE
asyncTimeout	DOUBLE
cribl_version	STRING
schema	MAP<STRING, VARIANT>
uischema	MAP<STRING, VARIANT>

campo	Tipo de dados
worker_group	STRING
id	STRING
name	STRING
version	STRING
group	STRING
disabled	BOOLEAN
handleSignals	BOOLEAN
sync	BOOLEAN
__filename	STRING
loadTime	DOUBLE
modTime	DOUBLE
asyncTimeout	DOUBLE
cribl_version	STRING
schema	MAP<STRING, VARIANT>
uischema	MAP<STRING, VARIANT>

nota

Esta tabela não suporta SCD tipo 2 porque possui colunas VARIANT.

workspaces

Primary key: workspaceId

Modo de sincronização: Apenas refresh completo

campo	Tipo de dados
workspaceId	STRING
region	STRING
leaderFQDN	STRING
state	STRING
alias	STRING
description	STRING
tags	ARRAY<STRING>

campo	Tipo de dados
workspaceId	STRING
region	STRING
leaderFQDN	STRING
state	STRING
alias	STRING
description	STRING
tags	ARRAY<STRING>

api_credentials

Primary key: clientId

Modo de sincronização: Apenas refresh completo

campo	Tipo de dados
name	STRING
description	STRING
enabled	BOOLEAN
organizationId	STRING
clientId	STRING
roles	VARIANT
organizationRole	STRING
createdBy	STRING
createdDate	TIMESTAMP
lastUpdatedBy	STRING
lastUpdatedDate	TIMESTAMP
ipAllowlist	ARRAY<STRING>

campo	Tipo de dados
name	STRING
description	STRING
enabled	BOOLEAN
organizationId	STRING
clientId	STRING
roles	VARIANT
organizationRole	STRING
createdBy	STRING
createdDate	TIMESTAMP
lastUpdatedBy	STRING
lastUpdatedDate	TIMESTAMP
ipAllowlist	ARRAY<STRING>

nota

Esta tabela não suporta SCD tipo 2 porque possui colunas VARIANT.

audit_log

key primária: time, event_id

Campo do cursor: time

campo	Tipo de dados
time	TIMESTAMP
action	STRING
type	STRING
user	STRING
principal	STRING
id	STRING
requestId	STRING
group	STRING
event_id	BIGINT
raw	VARIANT

campo	Tipo de dados
time	TIMESTAMP
action	STRING
type	STRING
user	STRING
principal	STRING
id	STRING
requestId	STRING
group	STRING
event_id	BIGINT
raw	VARIANT

nota

Esta tabela não suporta SCD tipo 2 porque possui colunas VARIANT.

access_log

key primária: time, event_id

Campo do cursor: time

campo	Tipo de dados
time	TIMESTAMP
src	STRING
user	STRING
method	STRING
url	STRING
status	BIGINT
message	STRING
response_time	BIGINT
requestId	STRING
cid	STRING
stats	VARIANT
event_id	BIGINT
raw	VARIANT

campo	Tipo de dados
time	TIMESTAMP
src	STRING
user	STRING
method	STRING
url	STRING
status	BIGINT
message	STRING
response_time	BIGINT
requestId	STRING
cid	STRING
stats	VARIANT
event_id	BIGINT
raw	VARIANT

nota

Esta tabela não suporta SCD tipo 2 porque possui colunas VARIANT.