ezgh obs datasets transforms set

ezgh obs datasets transforms set <dataset> -f <rules.json> [--force] [flags]

Replace a dataset’s transform rules with a JSON document (-f - reads stdin):

{ "enabled": true,
  "logs": { "statements": [ "delete_key(log.attributes, \"user.email\")" ],
            "drop": [ "log.severity_number < SEVERITY_NUMBER_INFO" ] },
  "traces": { "drop": [ "span.name == \"GET /healthz\"" ] } }

Each signal’s statements run in order on every record before it’s stored, then a record is dropped when any of its drop conditions holds. A signal can have at most 50 statements and 50 conditions, each at most 4 KiB, and the document at most 64 KiB. obs-api compiles every rule and refuses a document that doesn’t, saying where (logs.statements.3) and why. The file can be the output of ezgh obs datasets transforms get -o json: its document is taken.

It’s sent with the ETag ezgh reads just before: if someone changed the rules in between, nothing changes, and ezgh says so. A file from get -o json carries the version it was read at: when the rules have changed since (someone saved another version while you edited), ezgh refuses and changes nothing. --force sends no ETag, overwriting whatever is there.

Part of ezgh obs datasets transforms.

Examples

ezgh obs datasets transforms set production -f rules.json
ezgh obs datasets transforms set staging -f - --force < rules.json

Flags

This command also takes the global flags.