Skip to content

Create a new pipeline

POST
/pipeline/create

Creates a new pipeline. If autostart.created is true, the response is only sent after the pipeline was successfully started. If this fails, then the pipeline is immediately discarded, and the response contains the observed diagnostics. The error field then contains a rendered representation of the diagnostics. Otherwise, the diagnostics field is not present.

Authorizations

Section titled “Authorizations ”

Request Body required

Section titled “Request Body required ”
object
id

The id of the pipeline to be updated. If not provided, a random id will be generated.

string
Example
08446737-da9b-4787-8599-97d85c48c3bb
definition
required

The pipeline definition.

string
Example
export | where foo | publish /bar
name

The human-readable name of the pipeline.

string
default: [an auto-generated id]
Example
zeek-monitoring-pipeline
hidden

A flag specifying whether this pipeline is hidden. Hidden pipelines start automatically, are not persisted, and will not show up in the /pipeline/list endpoint response.

boolean
ttl

A duration string specifying the maximum time for this pipeline to exist. No value means the pipeline is allowed to exist forever. This parameter must be defined if the hidden parameter is true.

string
Example
5min
autostart

Flags that specify on which state to restart the pipeline.

object
created

Autostart the pipeline upon creation.

boolean
Example
true
completed

Autostart the pipeline upon completion.

boolean
failed

Autostart the pipeline upon failure.

boolean
autodelete

Flags that specify on which state to delete the pipeline.

object
completed

Autodelete the pipeline upon completion.

boolean
failed

Autodelete the pipeline upon failure.

boolean
Example
true
stopped

Autodelete the pipeline when it stops before completing.

boolean
retry_delay

A duration string specifying the minimum time between automatic restarts of a pipeline when an error occurs. Takes no effect if restarting on failure is disabled.

string
default: 1min
Example
500ms
unstoppable

A flag specifying whether this pipeline is unstoppable. Unstoppable pipelines start automatically, fail when they complete, and can not be paused or stopped manually.

boolean
Example
true

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Success.

object
id

The id of the successfully created pipeline.

string

400

Section titled “400 ”

Invalid arguments or invalid pipeline.

object
error
required

The error message.

string
Example
Invalid arguments
diagnostics
Array<object>
object
severity
string
Allowed values: error warning note
message
string
Example
unknown option `--frobnify`
annotation
Array<object>
object
primary
boolean
text

A potentially empty label.

string
Example
this option does not exist
source

A region in the source code, defined by byte offsets.

object
begin
number
Example
42
end
number
Example
48
notes
Array<object>
object
kind
string
Allowed values: note usage hint docs
Example
usage
message
string
Example
file <path> [-f|--follow] [-m|--mmap] [-t|--timeout <duration>]
rendered
string
Example
error: unknown option `--frobnify`