Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. Google Cloud (GCP) Classic
  4. API Docs
  5. chronicle
  6. ParserExtension
Viewing docs for Google Cloud v9.29.0
published on Wednesday, Jun 24, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-gcp

gcp.chronicle.ParserExtension

gcp logo
Viewing docs for Google Cloud v9.29.0
published on Wednesday, Jun 24, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-gcp

    A parser extension allows customers to extend or customize the behavior of an existing prebuilt or custom parser. It enables extracting additional fields from raw logs without modifying the base parser.

    To get more information about ParserExtension, see:

    Example Usage

    Chronicle Parserextension Basic

    import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const example = new gcp.chronicle.ParserExtension("example", {
    location: "us",
    instance: "00000000-0000-0000-0000-000000000000",
    logType: "CISCO_DHCP",
    validationSkipped: true,
    cbnSnippet: "ZHVtbXkgZXh0ZW5zaW9uIHNuaXBwZXQ=",
});

    import pulumi
import pulumi_gcp as gcp

example = gcp.chronicle.ParserExtension("example",
    location="us",
    instance="00000000-0000-0000-0000-000000000000",
    log_type="CISCO_DHCP",
    validation_skipped=True,
    cbn_snippet="ZHVtbXkgZXh0ZW5zaW9uIHNuaXBwZXQ=")

    package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/chronicle"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := chronicle.NewParserExtension(ctx, "example", &chronicle.ParserExtensionArgs{
			Location:          pulumi.String("us"),
			Instance:          pulumi.String("00000000-0000-0000-0000-000000000000"),
			LogType:           pulumi.String("CISCO_DHCP"),
			ValidationSkipped: pulumi.Bool(true),
			CbnSnippet:        pulumi.String("ZHVtbXkgZXh0ZW5zaW9uIHNuaXBwZXQ="),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var example = new Gcp.Chronicle.ParserExtension("example", new()
    {
        Location = "us",
        Instance = "00000000-0000-0000-0000-000000000000",
        LogType = "CISCO_DHCP",
        ValidationSkipped = true,
        CbnSnippet = "ZHVtbXkgZXh0ZW5zaW9uIHNuaXBwZXQ=",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.chronicle.ParserExtension;
import com.pulumi.gcp.chronicle.ParserExtensionArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new ParserExtension("example", ParserExtensionArgs.builder()
            .location("us")
            .instance("00000000-0000-0000-0000-000000000000")
            .logType("CISCO_DHCP")
            .validationSkipped(true)
            .cbnSnippet("ZHVtbXkgZXh0ZW5zaW9uIHNuaXBwZXQ=")
            .build());

    }
}

    resources:
  example:
    type: gcp:chronicle:ParserExtension
    properties:
      location: us
      instance: 00000000-0000-0000-0000-000000000000
      logType: CISCO_DHCP
      validationSkipped: true
      cbnSnippet: ZHVtbXkgZXh0ZW5zaW9uIHNuaXBwZXQ=

    pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

resource "gcp_chronicle_parserextension" "example" {
  location           = "us"
  instance           = "00000000-0000-0000-0000-000000000000"
  log_type           = "CISCO_DHCP"
  validation_skipped = true
  cbn_snippet        = "ZHVtbXkgZXh0ZW5zaW9uIHNuaXBwZXQ="
}

    Chronicle Parserextension Full

    import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const example = new gcp.chronicle.ParserExtension("example", {
    location: "us",
    instance: "00000000-0000-0000-0000-000000000000",
    logType: "AKAMAI_DHCP",
    validationSkipped: true,
    log: "ZHVtbXkgbG9n",
    fieldExtractors: {
        logFormat: "JSON",
        appendRepeatedFields: true,
        preprocessConfig: {
            grokRegex: "(?P<message>.*)",
            target: "message",
        },
        extractors: [
            {
                fieldPath: "$.user",
                destinationPath: "udm.principal.user.userid",
                value: "static-override",
            },
            {
                fieldPath: "$.event",
                destinationPath: "udm.metadata.event_type",
                preconditionOp: "EQUALS",
                preconditionPath: "$.event",
                preconditionValue: "login",
            },
        ],
    },
});

    import pulumi
import pulumi_gcp as gcp

example = gcp.chronicle.ParserExtension("example",
    location="us",
    instance="00000000-0000-0000-0000-000000000000",
    log_type="AKAMAI_DHCP",
    validation_skipped=True,
    log="ZHVtbXkgbG9n",
    field_extractors={
        "log_format": "JSON",
        "append_repeated_fields": True,
        "preprocess_config": {
            "grok_regex": "(?P<message>.*)",
            "target": "message",
        },
        "extractors": [
            {
                "field_path": "$.user",
                "destination_path": "udm.principal.user.userid",
                "value": "static-override",
            },
            {
                "field_path": "$.event",
                "destination_path": "udm.metadata.event_type",
                "precondition_op": "EQUALS",
                "precondition_path": "$.event",
                "precondition_value": "login",
            },
        ],
    })

    package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/chronicle"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := chronicle.NewParserExtension(ctx, "example", &chronicle.ParserExtensionArgs{
			Location:          pulumi.String("us"),
			Instance:          pulumi.String("00000000-0000-0000-0000-000000000000"),
			LogType:           pulumi.String("AKAMAI_DHCP"),
			ValidationSkipped: pulumi.Bool(true),
			Log:               pulumi.String("ZHVtbXkgbG9n"),
			FieldExtractors: &chronicle.ParserExtensionFieldExtractorsArgs{
				LogFormat:            pulumi.String("JSON"),
				AppendRepeatedFields: pulumi.Bool(true),
				PreprocessConfig: &chronicle.ParserExtensionFieldExtractorsPreprocessConfigArgs{
					GrokRegex: pulumi.String("(?P<message>.*)"),
					Target:    pulumi.String("message"),
				},
				Extractors: chronicle.ParserExtensionFieldExtractorsExtractorArray{
					&chronicle.ParserExtensionFieldExtractorsExtractorArgs{
						FieldPath:       pulumi.String("$.user"),
						DestinationPath: pulumi.String("udm.principal.user.userid"),
						Value:           pulumi.String("static-override"),
					},
					&chronicle.ParserExtensionFieldExtractorsExtractorArgs{
						FieldPath:         pulumi.String("$.event"),
						DestinationPath:   pulumi.String("udm.metadata.event_type"),
						PreconditionOp:    pulumi.String("EQUALS"),
						PreconditionPath:  pulumi.String("$.event"),
						PreconditionValue: pulumi.String("login"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var example = new Gcp.Chronicle.ParserExtension("example", new()
    {
        Location = "us",
        Instance = "00000000-0000-0000-0000-000000000000",
        LogType = "AKAMAI_DHCP",
        ValidationSkipped = true,
        Log = "ZHVtbXkgbG9n",
        FieldExtractors = new Gcp.Chronicle.Inputs.ParserExtensionFieldExtractorsArgs
        {
            LogFormat = "JSON",
            AppendRepeatedFields = true,
            PreprocessConfig = new Gcp.Chronicle.Inputs.ParserExtensionFieldExtractorsPreprocessConfigArgs
            {
                GrokRegex = "(?P<message>.*)",
                Target = "message",
            },
            Extractors = new[]
            {
                new Gcp.Chronicle.Inputs.ParserExtensionFieldExtractorsExtractorArgs
                {
                    FieldPath = "$.user",
                    DestinationPath = "udm.principal.user.userid",
                    Value = "static-override",
                },
                new Gcp.Chronicle.Inputs.ParserExtensionFieldExtractorsExtractorArgs
                {
                    FieldPath = "$.event",
                    DestinationPath = "udm.metadata.event_type",
                    PreconditionOp = "EQUALS",
                    PreconditionPath = "$.event",
                    PreconditionValue = "login",
                },
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.chronicle.ParserExtension;
import com.pulumi.gcp.chronicle.ParserExtensionArgs;
import com.pulumi.gcp.chronicle.inputs.ParserExtensionFieldExtractorsArgs;
import com.pulumi.gcp.chronicle.inputs.ParserExtensionFieldExtractorsPreprocessConfigArgs;
import com.pulumi.gcp.chronicle.inputs.ParserExtensionFieldExtractorsExtractorArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new ParserExtension("example", ParserExtensionArgs.builder()
            .location("us")
            .instance("00000000-0000-0000-0000-000000000000")
            .logType("AKAMAI_DHCP")
            .validationSkipped(true)
            .log("ZHVtbXkgbG9n")
            .fieldExtractors(ParserExtensionFieldExtractorsArgs.builder()
                .logFormat("JSON")
                .appendRepeatedFields(true)
                .preprocessConfig(ParserExtensionFieldExtractorsPreprocessConfigArgs.builder()
                    .grokRegex("(?P<message>.*)")
                    .target("message")
                    .build())
                .extractors(                
                    ParserExtensionFieldExtractorsExtractorArgs.builder()
                        .fieldPath("$.user")
                        .destinationPath("udm.principal.user.userid")
                        .value("static-override")
                        .build(),
                    ParserExtensionFieldExtractorsExtractorArgs.builder()
                        .fieldPath("$.event")
                        .destinationPath("udm.metadata.event_type")
                        .preconditionOp("EQUALS")
                        .preconditionPath("$.event")
                        .preconditionValue("login")
                        .build())
                .build())
            .build());

    }
}

    resources:
  example:
    type: gcp:chronicle:ParserExtension
    properties:
      location: us
      instance: 00000000-0000-0000-0000-000000000000
      logType: AKAMAI_DHCP
      validationSkipped: true
      log: ZHVtbXkgbG9n
      fieldExtractors:
        logFormat: JSON
        appendRepeatedFields: true
        preprocessConfig:
          grokRegex: (?P<message>.*)
          target: message
        extractors:
          - fieldPath: $.user
            destinationPath: udm.principal.user.userid
            value: static-override
          - fieldPath: $.event
            destinationPath: udm.metadata.event_type
            preconditionOp: EQUALS
            preconditionPath: $.event
            preconditionValue: login

    pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

resource "gcp_chronicle_parserextension" "example" {
  location           = "us"
  instance           = "00000000-0000-0000-0000-000000000000"
  log_type           = "AKAMAI_DHCP"
  validation_skipped = true
  log                = "ZHVtbXkgbG9n"
  field_extractors = {
    log_format             = "JSON"
    append_repeated_fields = true
    preprocess_config = {
      grok_regex = "(?P<message>.*)"
      target     = "message"
    }
    extractors = [{
      "fieldPath"       = "$.user"
      "destinationPath" = "udm.principal.user.userid"
      "value"           = "static-override"
      }, {
      "fieldPath"         = "$.event"
      "destinationPath"   = "udm.metadata.event_type"
      "preconditionOp"    = "EQUALS"
      "preconditionPath"  = "$.event"
      "preconditionValue" = "login"
    }]
  }
}

    Chronicle Parserextension Dynamic

    import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const example = new gcp.chronicle.ParserExtension("example", {
    location: "us",
    instance: "00000000-0000-0000-0000-000000000000",
    logType: "AKAMAI_DHCP",
    validationSkipped: true,
    log: "ZHVtbXkgbG9n",
    dynamicParsing: {
        optedFields: [{
            path: "$.ip",
            sampleValue: "1.1.1.1",
        }],
    },
});

    import pulumi
import pulumi_gcp as gcp

example = gcp.chronicle.ParserExtension("example",
    location="us",
    instance="00000000-0000-0000-0000-000000000000",
    log_type="AKAMAI_DHCP",
    validation_skipped=True,
    log="ZHVtbXkgbG9n",
    dynamic_parsing={
        "opted_fields": [{
            "path": "$.ip",
            "sample_value": "1.1.1.1",
        }],
    })

    package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/chronicle"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := chronicle.NewParserExtension(ctx, "example", &chronicle.ParserExtensionArgs{
			Location:          pulumi.String("us"),
			Instance:          pulumi.String("00000000-0000-0000-0000-000000000000"),
			LogType:           pulumi.String("AKAMAI_DHCP"),
			ValidationSkipped: pulumi.Bool(true),
			Log:               pulumi.String("ZHVtbXkgbG9n"),
			DynamicParsing: &chronicle.ParserExtensionDynamicParsingArgs{
				OptedFields: chronicle.ParserExtensionDynamicParsingOptedFieldArray{
					&chronicle.ParserExtensionDynamicParsingOptedFieldArgs{
						Path:        pulumi.String("$.ip"),
						SampleValue: pulumi.String("1.1.1.1"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var example = new Gcp.Chronicle.ParserExtension("example", new()
    {
        Location = "us",
        Instance = "00000000-0000-0000-0000-000000000000",
        LogType = "AKAMAI_DHCP",
        ValidationSkipped = true,
        Log = "ZHVtbXkgbG9n",
        DynamicParsing = new Gcp.Chronicle.Inputs.ParserExtensionDynamicParsingArgs
        {
            OptedFields = new[]
            {
                new Gcp.Chronicle.Inputs.ParserExtensionDynamicParsingOptedFieldArgs
                {
                    Path = "$.ip",
                    SampleValue = "1.1.1.1",
                },
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.chronicle.ParserExtension;
import com.pulumi.gcp.chronicle.ParserExtensionArgs;
import com.pulumi.gcp.chronicle.inputs.ParserExtensionDynamicParsingArgs;
import com.pulumi.gcp.chronicle.inputs.ParserExtensionDynamicParsingOptedFieldArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new ParserExtension("example", ParserExtensionArgs.builder()
            .location("us")
            .instance("00000000-0000-0000-0000-000000000000")
            .logType("AKAMAI_DHCP")
            .validationSkipped(true)
            .log("ZHVtbXkgbG9n")
            .dynamicParsing(ParserExtensionDynamicParsingArgs.builder()
                .optedFields(ParserExtensionDynamicParsingOptedFieldArgs.builder()
                    .path("$.ip")
                    .sampleValue("1.1.1.1")
                    .build())
                .build())
            .build());

    }
}

    resources:
  example:
    type: gcp:chronicle:ParserExtension
    properties:
      location: us
      instance: 00000000-0000-0000-0000-000000000000
      logType: AKAMAI_DHCP
      validationSkipped: true
      log: ZHVtbXkgbG9n
      dynamicParsing:
        optedFields:
          - path: $.ip
            sampleValue: 1.1.1.1

    pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

resource "gcp_chronicle_parserextension" "example" {
  location           = "us"
  instance           = "00000000-0000-0000-0000-000000000000"
  log_type           = "AKAMAI_DHCP"
  validation_skipped = true
  log                = "ZHVtbXkgbG9n"
  dynamic_parsing = {
    opted_fields = [{
      "path"        = "$.ip"
      "sampleValue" = "1.1.1.1"
    }]
  }
}

    Create ParserExtension Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new ParserExtension(name: string, args: ParserExtensionArgs, opts?: CustomResourceOptions);
    @overload
def ParserExtension(resource_name: str,
                    args: ParserExtensionArgs,
                    opts: Optional[ResourceOptions] = None)

@overload
def ParserExtension(resource_name: str,
                    opts: Optional[ResourceOptions] = None,
                    instance: Optional[str] = None,
                    location: Optional[str] = None,
                    log_type: Optional[str] = None,
                    cbn_snippet: Optional[str] = None,
                    deletion_policy: Optional[str] = None,
                    dynamic_parsing: Optional[ParserExtensionDynamicParsingArgs] = None,
                    field_extractors: Optional[ParserExtensionFieldExtractorsArgs] = None,
                    log: Optional[str] = None,
                    project: Optional[str] = None,
                    validation_skipped: Optional[bool] = None)
    func NewParserExtension(ctx *Context, name string, args ParserExtensionArgs, opts ...ResourceOption) (*ParserExtension, error)
    public ParserExtension(string name, ParserExtensionArgs args, CustomResourceOptions? opts = null)
    public ParserExtension(String name, ParserExtensionArgs args)
public ParserExtension(String name, ParserExtensionArgs args, CustomResourceOptions options)

    type: gcp:chronicle:ParserExtension
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "gcp_chronicle_parserextension" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args ParserExtensionArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args ParserExtensionArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args ParserExtensionArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ParserExtensionArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args ParserExtensionArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var parserExtensionResource = new Gcp.Chronicle.ParserExtension("parserExtensionResource", new()
{
    Instance = "string",
    Location = "string",
    LogType = "string",
    CbnSnippet = "string",
    DeletionPolicy = "string",
    DynamicParsing = new Gcp.Chronicle.Inputs.ParserExtensionDynamicParsingArgs
    {
        OptedFields = new[]
        {
            new Gcp.Chronicle.Inputs.ParserExtensionDynamicParsingOptedFieldArgs
            {
                Path = "string",
                SampleValue = "string",
            },
        },
    },
    FieldExtractors = new Gcp.Chronicle.Inputs.ParserExtensionFieldExtractorsArgs
    {
        AppendRepeatedFields = false,
        Extractors = new[]
        {
            new Gcp.Chronicle.Inputs.ParserExtensionFieldExtractorsExtractorArgs
            {
                DestinationPath = "string",
                FieldPath = "string",
                PreconditionOp = "string",
                PreconditionPath = "string",
                PreconditionValue = "string",
                Value = "string",
            },
        },
        LogFormat = "string",
        PreprocessConfig = new Gcp.Chronicle.Inputs.ParserExtensionFieldExtractorsPreprocessConfigArgs
        {
            GrokRegex = "string",
            Target = "string",
        },
        TransformedCbnSnippet = "string",
    },
    Log = "string",
    Project = "string",
    ValidationSkipped = false,
});

    example, err := chronicle.NewParserExtension(ctx, "parserExtensionResource", &chronicle.ParserExtensionArgs{
	Instance:       pulumi.String("string"),
	Location:       pulumi.String("string"),
	LogType:        pulumi.String("string"),
	CbnSnippet:     pulumi.String("string"),
	DeletionPolicy: pulumi.String("string"),
	DynamicParsing: &chronicle.ParserExtensionDynamicParsingArgs{
		OptedFields: chronicle.ParserExtensionDynamicParsingOptedFieldArray{
			&chronicle.ParserExtensionDynamicParsingOptedFieldArgs{
				Path:        pulumi.String("string"),
				SampleValue: pulumi.String("string"),
			},
		},
	},
	FieldExtractors: &chronicle.ParserExtensionFieldExtractorsArgs{
		AppendRepeatedFields: pulumi.Bool(false),
		Extractors: chronicle.ParserExtensionFieldExtractorsExtractorArray{
			&chronicle.ParserExtensionFieldExtractorsExtractorArgs{
				DestinationPath:   pulumi.String("string"),
				FieldPath:         pulumi.String("string"),
				PreconditionOp:    pulumi.String("string"),
				PreconditionPath:  pulumi.String("string"),
				PreconditionValue: pulumi.String("string"),
				Value:             pulumi.String("string"),
			},
		},
		LogFormat: pulumi.String("string"),
		PreprocessConfig: &chronicle.ParserExtensionFieldExtractorsPreprocessConfigArgs{
			GrokRegex: pulumi.String("string"),
			Target:    pulumi.String("string"),
		},
		TransformedCbnSnippet: pulumi.String("string"),
	},
	Log:               pulumi.String("string"),
	Project:           pulumi.String("string"),
	ValidationSkipped: pulumi.Bool(false),
})

    resource "gcp_chronicle_parserextension" "parserExtensionResource" {
  instance        = "string"
  location        = "string"
  log_type        = "string"
  cbn_snippet     = "string"
  deletion_policy = "string"
  dynamic_parsing = {
    opted_fields = [{
      "path"        = "string"
      "sampleValue" = "string"
    }]
  }
  field_extractors = {
    append_repeated_fields = false
    extractors = [{
      "destinationPath"   = "string"
      "fieldPath"         = "string"
      "preconditionOp"    = "string"
      "preconditionPath"  = "string"
      "preconditionValue" = "string"
      "value"             = "string"
    }]
    log_format = "string"
    preprocess_config = {
      grok_regex = "string"
      target     = "string"
    }
    transformed_cbn_snippet = "string"
  }
  log                = "string"
  project            = "string"
  validation_skipped = false
}

    var parserExtensionResource = new ParserExtension("parserExtensionResource", ParserExtensionArgs.builder()
    .instance("string")
    .location("string")
    .logType("string")
    .cbnSnippet("string")
    .deletionPolicy("string")
    .dynamicParsing(ParserExtensionDynamicParsingArgs.builder()
        .optedFields(ParserExtensionDynamicParsingOptedFieldArgs.builder()
            .path("string")
            .sampleValue("string")
            .build())
        .build())
    .fieldExtractors(ParserExtensionFieldExtractorsArgs.builder()
        .appendRepeatedFields(false)
        .extractors(ParserExtensionFieldExtractorsExtractorArgs.builder()
            .destinationPath("string")
            .fieldPath("string")
            .preconditionOp("string")
            .preconditionPath("string")
            .preconditionValue("string")
            .value("string")
            .build())
        .logFormat("string")
        .preprocessConfig(ParserExtensionFieldExtractorsPreprocessConfigArgs.builder()
            .grokRegex("string")
            .target("string")
            .build())
        .transformedCbnSnippet("string")
        .build())
    .log("string")
    .project("string")
    .validationSkipped(false)
    .build());

    parser_extension_resource = gcp.chronicle.ParserExtension("parserExtensionResource",
    instance="string",
    location="string",
    log_type="string",
    cbn_snippet="string",
    deletion_policy="string",
    dynamic_parsing={
        "opted_fields": [{
            "path": "string",
            "sample_value": "string",
        }],
    },
    field_extractors={
        "append_repeated_fields": False,
        "extractors": [{
            "destination_path": "string",
            "field_path": "string",
            "precondition_op": "string",
            "precondition_path": "string",
            "precondition_value": "string",
            "value": "string",
        }],
        "log_format": "string",
        "preprocess_config": {
            "grok_regex": "string",
            "target": "string",
        },
        "transformed_cbn_snippet": "string",
    },
    log="string",
    project="string",
    validation_skipped=False)

    const parserExtensionResource = new gcp.chronicle.ParserExtension("parserExtensionResource", {
    instance: "string",
    location: "string",
    logType: "string",
    cbnSnippet: "string",
    deletionPolicy: "string",
    dynamicParsing: {
        optedFields: [{
            path: "string",
            sampleValue: "string",
        }],
    },
    fieldExtractors: {
        appendRepeatedFields: false,
        extractors: [{
            destinationPath: "string",
            fieldPath: "string",
            preconditionOp: "string",
            preconditionPath: "string",
            preconditionValue: "string",
            value: "string",
        }],
        logFormat: "string",
        preprocessConfig: {
            grokRegex: "string",
            target: "string",
        },
        transformedCbnSnippet: "string",
    },
    log: "string",
    project: "string",
    validationSkipped: false,
});

    type: gcp:chronicle:ParserExtension
properties:
    cbnSnippet: string
    deletionPolicy: string
    dynamicParsing:
        optedFields:
            - path: string
              sampleValue: string
    fieldExtractors:
        appendRepeatedFields: false
        extractors:
            - destinationPath: string
              fieldPath: string
              preconditionOp: string
              preconditionPath: string
              preconditionValue: string
              value: string
        logFormat: string
        preprocessConfig:
            grokRegex: string
            target: string
        transformedCbnSnippet: string
    instance: string
    location: string
    log: string
    logType: string
    project: string
    validationSkipped: false

    ParserExtension Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The ParserExtension resource accepts the following input properties:

    Instance string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    Location string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    LogType string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    CbnSnippet string
    Parser config could be a cbn snippet.
    DeletionPolicy string
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    DynamicParsing ParserExtensionDynamicParsing
    A representation of a parser extension as dynamic parsing config. Structure is documented below.
    FieldExtractors ParserExtensionFieldExtractors
    A representation of a parser extension as a set of field extractors. Structure is documented below.
    Log string
    Raw log used to assist the user in creation of augmentation.
    Project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    ValidationSkipped bool
    Flag to bypass parser extension validation. If enabled, the parser extension won't be rejected during the validation phase and validation will be skipped.
    Instance string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    Location string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    LogType string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    CbnSnippet string
    Parser config could be a cbn snippet.
    DeletionPolicy string
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    DynamicParsing ParserExtensionDynamicParsingArgs
    A representation of a parser extension as dynamic parsing config. Structure is documented below.
    FieldExtractors ParserExtensionFieldExtractorsArgs
    A representation of a parser extension as a set of field extractors. Structure is documented below.
    Log string
    Raw log used to assist the user in creation of augmentation.
    Project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    ValidationSkipped bool
    Flag to bypass parser extension validation. If enabled, the parser extension won't be rejected during the validation phase and validation will be skipped.
    instance string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    location string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    log_type string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    cbn_snippet string
    Parser config could be a cbn snippet.
    deletion_policy string
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    dynamic_parsing object
    A representation of a parser extension as dynamic parsing config. Structure is documented below.
    field_extractors object
    A representation of a parser extension as a set of field extractors. Structure is documented below.
    log string
    Raw log used to assist the user in creation of augmentation.
    project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    validation_skipped bool
    Flag to bypass parser extension validation. If enabled, the parser extension won't be rejected during the validation phase and validation will be skipped.
    instance String
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    location String
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    logType String
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    cbnSnippet String
    Parser config could be a cbn snippet.
    deletionPolicy String
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    dynamicParsing ParserExtensionDynamicParsing
    A representation of a parser extension as dynamic parsing config. Structure is documented below.
    fieldExtractors ParserExtensionFieldExtractors
    A representation of a parser extension as a set of field extractors. Structure is documented below.
    log String
    Raw log used to assist the user in creation of augmentation.
    project String
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    validationSkipped Boolean
    Flag to bypass parser extension validation. If enabled, the parser extension won't be rejected during the validation phase and validation will be skipped.
    instance string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    location string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    logType string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    cbnSnippet string
    Parser config could be a cbn snippet.
    deletionPolicy string
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    dynamicParsing ParserExtensionDynamicParsing
    A representation of a parser extension as dynamic parsing config. Structure is documented below.
    fieldExtractors ParserExtensionFieldExtractors
    A representation of a parser extension as a set of field extractors. Structure is documented below.
    log string
    Raw log used to assist the user in creation of augmentation.
    project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    validationSkipped boolean
    Flag to bypass parser extension validation. If enabled, the parser extension won't be rejected during the validation phase and validation will be skipped.
    instance str
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    location str
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    log_type str
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    cbn_snippet str
    Parser config could be a cbn snippet.
    deletion_policy str
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    dynamic_parsing ParserExtensionDynamicParsingArgs
    A representation of a parser extension as dynamic parsing config. Structure is documented below.
    field_extractors ParserExtensionFieldExtractorsArgs
    A representation of a parser extension as a set of field extractors. Structure is documented below.
    log str
    Raw log used to assist the user in creation of augmentation.
    project str
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    validation_skipped bool
    Flag to bypass parser extension validation. If enabled, the parser extension won't be rejected during the validation phase and validation will be skipped.
    instance String
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    location String
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    logType String
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    cbnSnippet String
    Parser config could be a cbn snippet.
    deletionPolicy String
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    dynamicParsing Property Map
    A representation of a parser extension as dynamic parsing config. Structure is documented below.
    fieldExtractors Property Map
    A representation of a parser extension as a set of field extractors. Structure is documented below.
    log String
    Raw log used to assist the user in creation of augmentation.
    project String
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    validationSkipped Boolean
    Flag to bypass parser extension validation. If enabled, the parser extension won't be rejected during the validation phase and validation will be skipped.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the ParserExtension resource produces the following output properties:

    CreateTime string
    The time the parser extension was created.
    ExtensionValidationReport string
    The latest extension validation report for this extension.
    Id string
    The provider-assigned unique ID for this managed resource.
    LastLiveTime string
    The time the config was last serving live traffic.
    Name string
    Format: projects/{project}/locations/{location}/instances/{instance}/logTypes/{logtype}/parserExtensions/{parserExtension}
    Parserextension string
    Output only. The server-generated ID of the parser extension.
    State string
    The state of the parser extension Possible values: NEW VALIDATING LIVE REJECTED INTERNAL_ERROR VALIDATED ARCHIVED VALIDATION_SKIPPED
    StateLastChangedTime string
    The time the config state was last changed.
    ValidationReport string
    The validation report generated during extension validation.
    CreateTime string
    The time the parser extension was created.
    ExtensionValidationReport string
    The latest extension validation report for this extension.
    Id string
    The provider-assigned unique ID for this managed resource.
    LastLiveTime string
    The time the config was last serving live traffic.
    Name string
    Format: projects/{project}/locations/{location}/instances/{instance}/logTypes/{logtype}/parserExtensions/{parserExtension}
    Parserextension string
    Output only. The server-generated ID of the parser extension.
    State string
    The state of the parser extension Possible values: NEW VALIDATING LIVE REJECTED INTERNAL_ERROR VALIDATED ARCHIVED VALIDATION_SKIPPED
    StateLastChangedTime string
    The time the config state was last changed.
    ValidationReport string
    The validation report generated during extension validation.
    create_time string
    The time the parser extension was created.
    extension_validation_report string
    The latest extension validation report for this extension.
    id string
    The provider-assigned unique ID for this managed resource.
    last_live_time string
    The time the config was last serving live traffic.
    name string
    Format: projects/{project}/locations/{location}/instances/{instance}/logTypes/{logtype}/parserExtensions/{parserExtension}
    parserextension string
    Output only. The server-generated ID of the parser extension.
    state string
    The state of the parser extension Possible values: NEW VALIDATING LIVE REJECTED INTERNAL_ERROR VALIDATED ARCHIVED VALIDATION_SKIPPED
    state_last_changed_time string
    The time the config state was last changed.
    validation_report string
    The validation report generated during extension validation.
    createTime String
    The time the parser extension was created.
    extensionValidationReport String
    The latest extension validation report for this extension.
    id String
    The provider-assigned unique ID for this managed resource.
    lastLiveTime String
    The time the config was last serving live traffic.
    name String
    Format: projects/{project}/locations/{location}/instances/{instance}/logTypes/{logtype}/parserExtensions/{parserExtension}
    parserextension String
    Output only. The server-generated ID of the parser extension.
    state String
    The state of the parser extension Possible values: NEW VALIDATING LIVE REJECTED INTERNAL_ERROR VALIDATED ARCHIVED VALIDATION_SKIPPED
    stateLastChangedTime String
    The time the config state was last changed.
    validationReport String
    The validation report generated during extension validation.
    createTime string
    The time the parser extension was created.
    extensionValidationReport string
    The latest extension validation report for this extension.
    id string
    The provider-assigned unique ID for this managed resource.
    lastLiveTime string
    The time the config was last serving live traffic.
    name string
    Format: projects/{project}/locations/{location}/instances/{instance}/logTypes/{logtype}/parserExtensions/{parserExtension}
    parserextension string
    Output only. The server-generated ID of the parser extension.
    state string
    The state of the parser extension Possible values: NEW VALIDATING LIVE REJECTED INTERNAL_ERROR VALIDATED ARCHIVED VALIDATION_SKIPPED
    stateLastChangedTime string
    The time the config state was last changed.
    validationReport string
    The validation report generated during extension validation.
    create_time str
    The time the parser extension was created.
    extension_validation_report str
    The latest extension validation report for this extension.
    id str
    The provider-assigned unique ID for this managed resource.
    last_live_time str
    The time the config was last serving live traffic.
    name str
    Format: projects/{project}/locations/{location}/instances/{instance}/logTypes/{logtype}/parserExtensions/{parserExtension}
    parserextension str
    Output only. The server-generated ID of the parser extension.
    state str
    The state of the parser extension Possible values: NEW VALIDATING LIVE REJECTED INTERNAL_ERROR VALIDATED ARCHIVED VALIDATION_SKIPPED
    state_last_changed_time str
    The time the config state was last changed.
    validation_report str
    The validation report generated during extension validation.
    createTime String
    The time the parser extension was created.
    extensionValidationReport String
    The latest extension validation report for this extension.
    id String
    The provider-assigned unique ID for this managed resource.
    lastLiveTime String
    The time the config was last serving live traffic.
    name String
    Format: projects/{project}/locations/{location}/instances/{instance}/logTypes/{logtype}/parserExtensions/{parserExtension}
    parserextension String
    Output only. The server-generated ID of the parser extension.
    state String
    The state of the parser extension Possible values: NEW VALIDATING LIVE REJECTED INTERNAL_ERROR VALIDATED ARCHIVED VALIDATION_SKIPPED
    stateLastChangedTime String
    The time the config state was last changed.
    validationReport String
    The validation report generated during extension validation.

    Look up Existing ParserExtension Resource

    Get an existing ParserExtension resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: ParserExtensionState, opts?: CustomResourceOptions): ParserExtension
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        cbn_snippet: Optional[str] = None,
        create_time: Optional[str] = None,
        deletion_policy: Optional[str] = None,
        dynamic_parsing: Optional[ParserExtensionDynamicParsingArgs] = None,
        extension_validation_report: Optional[str] = None,
        field_extractors: Optional[ParserExtensionFieldExtractorsArgs] = None,
        instance: Optional[str] = None,
        last_live_time: Optional[str] = None,
        location: Optional[str] = None,
        log: Optional[str] = None,
        log_type: Optional[str] = None,
        name: Optional[str] = None,
        parserextension: Optional[str] = None,
        project: Optional[str] = None,
        state: Optional[str] = None,
        state_last_changed_time: Optional[str] = None,
        validation_report: Optional[str] = None,
        validation_skipped: Optional[bool] = None) -> ParserExtension
    func GetParserExtension(ctx *Context, name string, id IDInput, state *ParserExtensionState, opts ...ResourceOption) (*ParserExtension, error)
    public static ParserExtension Get(string name, Input<string> id, ParserExtensionState? state, CustomResourceOptions? opts = null)
    public static ParserExtension get(String name, Output<String> id, ParserExtensionState state, CustomResourceOptions options)
    resources:  _:    type: gcp:chronicle:ParserExtension    get:      id: ${id}
    import {
  to = gcp_chronicle_parserextension.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    CbnSnippet string
    Parser config could be a cbn snippet.
    CreateTime string
    The time the parser extension was created.
    DeletionPolicy string
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    DynamicParsing ParserExtensionDynamicParsing
    A representation of a parser extension as dynamic parsing config. Structure is documented below.
    ExtensionValidationReport string
    The latest extension validation report for this extension.
    FieldExtractors ParserExtensionFieldExtractors
    A representation of a parser extension as a set of field extractors. Structure is documented below.
    Instance string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    LastLiveTime string
    The time the config was last serving live traffic.
    Location string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    Log string
    Raw log used to assist the user in creation of augmentation.
    LogType string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    Name string
    Format: projects/{project}/locations/{location}/instances/{instance}/logTypes/{logtype}/parserExtensions/{parserExtension}
    Parserextension string
    Output only. The server-generated ID of the parser extension.
    Project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    State string
    The state of the parser extension Possible values: NEW VALIDATING LIVE REJECTED INTERNAL_ERROR VALIDATED ARCHIVED VALIDATION_SKIPPED
    StateLastChangedTime string
    The time the config state was last changed.
    ValidationReport string
    The validation report generated during extension validation.
    ValidationSkipped bool
    Flag to bypass parser extension validation. If enabled, the parser extension won't be rejected during the validation phase and validation will be skipped.
    CbnSnippet string
    Parser config could be a cbn snippet.
    CreateTime string
    The time the parser extension was created.
    DeletionPolicy string
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    DynamicParsing ParserExtensionDynamicParsingArgs
    A representation of a parser extension as dynamic parsing config. Structure is documented below.
    ExtensionValidationReport string
    The latest extension validation report for this extension.
    FieldExtractors ParserExtensionFieldExtractorsArgs
    A representation of a parser extension as a set of field extractors. Structure is documented below.
    Instance string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    LastLiveTime string
    The time the config was last serving live traffic.
    Location string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    Log string
    Raw log used to assist the user in creation of augmentation.
    LogType string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    Name string
    Format: projects/{project}/locations/{location}/instances/{instance}/logTypes/{logtype}/parserExtensions/{parserExtension}
    Parserextension string
    Output only. The server-generated ID of the parser extension.
    Project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    State string
    The state of the parser extension Possible values: NEW VALIDATING LIVE REJECTED INTERNAL_ERROR VALIDATED ARCHIVED VALIDATION_SKIPPED
    StateLastChangedTime string
    The time the config state was last changed.
    ValidationReport string
    The validation report generated during extension validation.
    ValidationSkipped bool
    Flag to bypass parser extension validation. If enabled, the parser extension won't be rejected during the validation phase and validation will be skipped.
    cbn_snippet string
    Parser config could be a cbn snippet.
    create_time string
    The time the parser extension was created.
    deletion_policy string
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    dynamic_parsing object
    A representation of a parser extension as dynamic parsing config. Structure is documented below.
    extension_validation_report string
    The latest extension validation report for this extension.
    field_extractors object
    A representation of a parser extension as a set of field extractors. Structure is documented below.
    instance string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    last_live_time string
    The time the config was last serving live traffic.
    location string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    log string
    Raw log used to assist the user in creation of augmentation.
    log_type string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    name string
    Format: projects/{project}/locations/{location}/instances/{instance}/logTypes/{logtype}/parserExtensions/{parserExtension}
    parserextension string
    Output only. The server-generated ID of the parser extension.
    project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    state string
    The state of the parser extension Possible values: NEW VALIDATING LIVE REJECTED INTERNAL_ERROR VALIDATED ARCHIVED VALIDATION_SKIPPED
    state_last_changed_time string
    The time the config state was last changed.
    validation_report string
    The validation report generated during extension validation.
    validation_skipped bool
    Flag to bypass parser extension validation. If enabled, the parser extension won't be rejected during the validation phase and validation will be skipped.
    cbnSnippet String
    Parser config could be a cbn snippet.
    createTime String
    The time the parser extension was created.
    deletionPolicy String
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    dynamicParsing ParserExtensionDynamicParsing
    A representation of a parser extension as dynamic parsing config. Structure is documented below.
    extensionValidationReport String
    The latest extension validation report for this extension.
    fieldExtractors ParserExtensionFieldExtractors
    A representation of a parser extension as a set of field extractors. Structure is documented below.
    instance String
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    lastLiveTime String
    The time the config was last serving live traffic.
    location String
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    log String
    Raw log used to assist the user in creation of augmentation.
    logType String
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    name String
    Format: projects/{project}/locations/{location}/instances/{instance}/logTypes/{logtype}/parserExtensions/{parserExtension}
    parserextension String
    Output only. The server-generated ID of the parser extension.
    project String
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    state String
    The state of the parser extension Possible values: NEW VALIDATING LIVE REJECTED INTERNAL_ERROR VALIDATED ARCHIVED VALIDATION_SKIPPED
    stateLastChangedTime String
    The time the config state was last changed.
    validationReport String
    The validation report generated during extension validation.
    validationSkipped Boolean
    Flag to bypass parser extension validation. If enabled, the parser extension won't be rejected during the validation phase and validation will be skipped.
    cbnSnippet string
    Parser config could be a cbn snippet.
    createTime string
    The time the parser extension was created.
    deletionPolicy string
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    dynamicParsing ParserExtensionDynamicParsing
    A representation of a parser extension as dynamic parsing config. Structure is documented below.
    extensionValidationReport string
    The latest extension validation report for this extension.
    fieldExtractors ParserExtensionFieldExtractors
    A representation of a parser extension as a set of field extractors. Structure is documented below.
    instance string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    lastLiveTime string
    The time the config was last serving live traffic.
    location string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    log string
    Raw log used to assist the user in creation of augmentation.
    logType string
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    name string
    Format: projects/{project}/locations/{location}/instances/{instance}/logTypes/{logtype}/parserExtensions/{parserExtension}
    parserextension string
    Output only. The server-generated ID of the parser extension.
    project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    state string
    The state of the parser extension Possible values: NEW VALIDATING LIVE REJECTED INTERNAL_ERROR VALIDATED ARCHIVED VALIDATION_SKIPPED
    stateLastChangedTime string
    The time the config state was last changed.
    validationReport string
    The validation report generated during extension validation.
    validationSkipped boolean
    Flag to bypass parser extension validation. If enabled, the parser extension won't be rejected during the validation phase and validation will be skipped.
    cbn_snippet str
    Parser config could be a cbn snippet.
    create_time str
    The time the parser extension was created.
    deletion_policy str
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    dynamic_parsing ParserExtensionDynamicParsingArgs
    A representation of a parser extension as dynamic parsing config. Structure is documented below.
    extension_validation_report str
    The latest extension validation report for this extension.
    field_extractors ParserExtensionFieldExtractorsArgs
    A representation of a parser extension as a set of field extractors. Structure is documented below.
    instance str
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    last_live_time str
    The time the config was last serving live traffic.
    location str
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    log str
    Raw log used to assist the user in creation of augmentation.
    log_type str
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    name str
    Format: projects/{project}/locations/{location}/instances/{instance}/logTypes/{logtype}/parserExtensions/{parserExtension}
    parserextension str
    Output only. The server-generated ID of the parser extension.
    project str
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    state str
    The state of the parser extension Possible values: NEW VALIDATING LIVE REJECTED INTERNAL_ERROR VALIDATED ARCHIVED VALIDATION_SKIPPED
    state_last_changed_time str
    The time the config state was last changed.
    validation_report str
    The validation report generated during extension validation.
    validation_skipped bool
    Flag to bypass parser extension validation. If enabled, the parser extension won't be rejected during the validation phase and validation will be skipped.
    cbnSnippet String
    Parser config could be a cbn snippet.
    createTime String
    The time the parser extension was created.
    deletionPolicy String
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    dynamicParsing Property Map
    A representation of a parser extension as dynamic parsing config. Structure is documented below.
    extensionValidationReport String
    The latest extension validation report for this extension.
    fieldExtractors Property Map
    A representation of a parser extension as a set of field extractors. Structure is documented below.
    instance String
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    lastLiveTime String
    The time the config was last serving live traffic.
    location String
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    log String
    Raw log used to assist the user in creation of augmentation.
    logType String
    Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
    name String
    Format: projects/{project}/locations/{location}/instances/{instance}/logTypes/{logtype}/parserExtensions/{parserExtension}
    parserextension String
    Output only. The server-generated ID of the parser extension.
    project String
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    state String
    The state of the parser extension Possible values: NEW VALIDATING LIVE REJECTED INTERNAL_ERROR VALIDATED ARCHIVED VALIDATION_SKIPPED
    stateLastChangedTime String
    The time the config state was last changed.
    validationReport String
    The validation report generated during extension validation.
    validationSkipped Boolean
    Flag to bypass parser extension validation. If enabled, the parser extension won't be rejected during the validation phase and validation will be skipped.

    Supporting Types

    ParserExtensionDynamicParsing, ParserExtensionDynamicParsingArgs

    OptedFields List<ParserExtensionDynamicParsingOptedField>
    List of fields to be parsed. Structure is documented below.
    OptedFields []ParserExtensionDynamicParsingOptedField
    List of fields to be parsed. Structure is documented below.
    opted_fields list(object)
    List of fields to be parsed. Structure is documented below.
    optedFields List<ParserExtensionDynamicParsingOptedField>
    List of fields to be parsed. Structure is documented below.
    optedFields ParserExtensionDynamicParsingOptedField[]
    List of fields to be parsed. Structure is documented below.
    opted_fields Sequence[ParserExtensionDynamicParsingOptedField]
    List of fields to be parsed. Structure is documented below.
    optedFields List<Property Map>
    List of fields to be parsed. Structure is documented below.

    ParserExtensionDynamicParsingOptedField, ParserExtensionDynamicParsingOptedFieldArgs

    Path string
    Path of the log field.
    SampleValue string
    Sample value of the log field.
    Path string
    Path of the log field.
    SampleValue string
    Sample value of the log field.
    path string
    Path of the log field.
    sample_value string
    Sample value of the log field.
    path String
    Path of the log field.
    sampleValue String
    Sample value of the log field.
    path string
    Path of the log field.
    sampleValue string
    Sample value of the log field.
    path str
    Path of the log field.
    sample_value str
    Sample value of the log field.
    path String
    Path of the log field.
    sampleValue String
    Sample value of the log field.

    ParserExtensionFieldExtractors, ParserExtensionFieldExtractorsArgs

    AppendRepeatedFields bool
    Whether to append repeated fields or not. When false, repeated fields will be replaced.
    Extractors List<ParserExtensionFieldExtractorsExtractor>
    List of FieldExtractors. Structure is documented below.
    LogFormat string
    Possible values: JSON CSV XML
    PreprocessConfig ParserExtensionFieldExtractorsPreprocessConfig
    PreProcessConfig holds the GROK expression to extract the syslog header. Structure is documented below.
    TransformedCbnSnippet string
    (Output) CBN snippet generated from field extractors.
    AppendRepeatedFields bool
    Whether to append repeated fields or not. When false, repeated fields will be replaced.
    Extractors []ParserExtensionFieldExtractorsExtractor
    List of FieldExtractors. Structure is documented below.
    LogFormat string
    Possible values: JSON CSV XML
    PreprocessConfig ParserExtensionFieldExtractorsPreprocessConfig
    PreProcessConfig holds the GROK expression to extract the syslog header. Structure is documented below.
    TransformedCbnSnippet string
    (Output) CBN snippet generated from field extractors.
    append_repeated_fields bool
    Whether to append repeated fields or not. When false, repeated fields will be replaced.
    extractors list(object)
    List of FieldExtractors. Structure is documented below.
    log_format string
    Possible values: JSON CSV XML
    preprocess_config object
    PreProcessConfig holds the GROK expression to extract the syslog header. Structure is documented below.
    transformed_cbn_snippet string
    (Output) CBN snippet generated from field extractors.
    appendRepeatedFields Boolean
    Whether to append repeated fields or not. When false, repeated fields will be replaced.
    extractors List<ParserExtensionFieldExtractorsExtractor>
    List of FieldExtractors. Structure is documented below.
    logFormat String
    Possible values: JSON CSV XML
    preprocessConfig ParserExtensionFieldExtractorsPreprocessConfig
    PreProcessConfig holds the GROK expression to extract the syslog header. Structure is documented below.
    transformedCbnSnippet String
    (Output) CBN snippet generated from field extractors.
    appendRepeatedFields boolean
    Whether to append repeated fields or not. When false, repeated fields will be replaced.
    extractors ParserExtensionFieldExtractorsExtractor[]
    List of FieldExtractors. Structure is documented below.
    logFormat string
    Possible values: JSON CSV XML
    preprocessConfig ParserExtensionFieldExtractorsPreprocessConfig
    PreProcessConfig holds the GROK expression to extract the syslog header. Structure is documented below.
    transformedCbnSnippet string
    (Output) CBN snippet generated from field extractors.
    append_repeated_fields bool
    Whether to append repeated fields or not. When false, repeated fields will be replaced.
    extractors Sequence[ParserExtensionFieldExtractorsExtractor]
    List of FieldExtractors. Structure is documented below.
    log_format str
    Possible values: JSON CSV XML
    preprocess_config ParserExtensionFieldExtractorsPreprocessConfig
    PreProcessConfig holds the GROK expression to extract the syslog header. Structure is documented below.
    transformed_cbn_snippet str
    (Output) CBN snippet generated from field extractors.
    appendRepeatedFields Boolean
    Whether to append repeated fields or not. When false, repeated fields will be replaced.
    extractors List<Property Map>
    List of FieldExtractors. Structure is documented below.
    logFormat String
    Possible values: JSON CSV XML
    preprocessConfig Property Map
    PreProcessConfig holds the GROK expression to extract the syslog header. Structure is documented below.
    transformedCbnSnippet String
    (Output) CBN snippet generated from field extractors.

    ParserExtensionFieldExtractorsExtractor, ParserExtensionFieldExtractorsExtractorArgs

    DestinationPath string
    Path in generated event which is to be populated. This is required if the FieldExtractor is used to specify the parser extension.
    FieldPath string
    Field path could be a json path, xml path or csv column name depending on log format. It refers to a section or substring in raw log. This is required if the FieldExtractor is used to specify the parser extension.
    PreconditionOp string
    Operator used for precondition. Possible values: EQUALS NOT_EQUALS
    PreconditionPath string
    Precondition path could be a json path, xml path or csv column name depending on log format. It refers to a section or substring in raw log.
    PreconditionValue string
    Precondition value.
    Value string
    Value to be mapped to the destination path directly.
    DestinationPath string
    Path in generated event which is to be populated. This is required if the FieldExtractor is used to specify the parser extension.
    FieldPath string
    Field path could be a json path, xml path or csv column name depending on log format. It refers to a section or substring in raw log. This is required if the FieldExtractor is used to specify the parser extension.
    PreconditionOp string
    Operator used for precondition. Possible values: EQUALS NOT_EQUALS
    PreconditionPath string
    Precondition path could be a json path, xml path or csv column name depending on log format. It refers to a section or substring in raw log.
    PreconditionValue string
    Precondition value.
    Value string
    Value to be mapped to the destination path directly.
    destination_path string
    Path in generated event which is to be populated. This is required if the FieldExtractor is used to specify the parser extension.
    field_path string
    Field path could be a json path, xml path or csv column name depending on log format. It refers to a section or substring in raw log. This is required if the FieldExtractor is used to specify the parser extension.
    precondition_op string
    Operator used for precondition. Possible values: EQUALS NOT_EQUALS
    precondition_path string
    Precondition path could be a json path, xml path or csv column name depending on log format. It refers to a section or substring in raw log.
    precondition_value string
    Precondition value.
    value string
    Value to be mapped to the destination path directly.
    destinationPath String
    Path in generated event which is to be populated. This is required if the FieldExtractor is used to specify the parser extension.
    fieldPath String
    Field path could be a json path, xml path or csv column name depending on log format. It refers to a section or substring in raw log. This is required if the FieldExtractor is used to specify the parser extension.
    preconditionOp String
    Operator used for precondition. Possible values: EQUALS NOT_EQUALS
    preconditionPath String
    Precondition path could be a json path, xml path or csv column name depending on log format. It refers to a section or substring in raw log.
    preconditionValue String
    Precondition value.
    value String
    Value to be mapped to the destination path directly.
    destinationPath string
    Path in generated event which is to be populated. This is required if the FieldExtractor is used to specify the parser extension.
    fieldPath string
    Field path could be a json path, xml path or csv column name depending on log format. It refers to a section or substring in raw log. This is required if the FieldExtractor is used to specify the parser extension.
    preconditionOp string
    Operator used for precondition. Possible values: EQUALS NOT_EQUALS
    preconditionPath string
    Precondition path could be a json path, xml path or csv column name depending on log format. It refers to a section or substring in raw log.
    preconditionValue string
    Precondition value.
    value string
    Value to be mapped to the destination path directly.
    destination_path str
    Path in generated event which is to be populated. This is required if the FieldExtractor is used to specify the parser extension.
    field_path str
    Field path could be a json path, xml path or csv column name depending on log format. It refers to a section or substring in raw log. This is required if the FieldExtractor is used to specify the parser extension.
    precondition_op str
    Operator used for precondition. Possible values: EQUALS NOT_EQUALS
    precondition_path str
    Precondition path could be a json path, xml path or csv column name depending on log format. It refers to a section or substring in raw log.
    precondition_value str
    Precondition value.
    value str
    Value to be mapped to the destination path directly.
    destinationPath String
    Path in generated event which is to be populated. This is required if the FieldExtractor is used to specify the parser extension.
    fieldPath String
    Field path could be a json path, xml path or csv column name depending on log format. It refers to a section or substring in raw log. This is required if the FieldExtractor is used to specify the parser extension.
    preconditionOp String
    Operator used for precondition. Possible values: EQUALS NOT_EQUALS
    preconditionPath String
    Precondition path could be a json path, xml path or csv column name depending on log format. It refers to a section or substring in raw log.
    preconditionValue String
    Precondition value.
    value String
    Value to be mapped to the destination path directly.

    ParserExtensionFieldExtractorsPreprocessConfig, ParserExtensionFieldExtractorsPreprocessConfigArgs

    GrokRegex string
    GROK Regex to extract the structured part of the log. syntax documentation: www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html
    Target string
    Target field name for the structured part of the log. This should match a SEMANTIC identifier from the grok expression.
    GrokRegex string
    GROK Regex to extract the structured part of the log. syntax documentation: www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html
    Target string
    Target field name for the structured part of the log. This should match a SEMANTIC identifier from the grok expression.
    grok_regex string
    GROK Regex to extract the structured part of the log. syntax documentation: www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html
    target string
    Target field name for the structured part of the log. This should match a SEMANTIC identifier from the grok expression.
    grokRegex String
    GROK Regex to extract the structured part of the log. syntax documentation: www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html
    target String
    Target field name for the structured part of the log. This should match a SEMANTIC identifier from the grok expression.
    grokRegex string
    GROK Regex to extract the structured part of the log. syntax documentation: www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html
    target string
    Target field name for the structured part of the log. This should match a SEMANTIC identifier from the grok expression.
    grok_regex str
    GROK Regex to extract the structured part of the log. syntax documentation: www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html
    target str
    Target field name for the structured part of the log. This should match a SEMANTIC identifier from the grok expression.
    grokRegex String
    GROK Regex to extract the structured part of the log. syntax documentation: www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html
    target String
    Target field name for the structured part of the log. This should match a SEMANTIC identifier from the grok expression.

    Import

    ParserExtension can be imported using any of these accepted formats:

    • projects/{{project}}/locations/{{location}}/instances/{{instance}}/logTypes/{{log_type}}/parserExtensions/{{parserextension}}
    • {{project}}/{{location}}/{{instance}}/{{log_type}}/{{parserextension}}
    • {{location}}/{{instance}}/{{log_type}}/{{parserextension}}

    When using the pulumi import command, ParserExtension can be imported using one of the formats above. For example:

    $ pulumi import gcp:chronicle/parserExtension:ParserExtension default projects/{{project}}/locations/{{location}}/instances/{{instance}}/logTypes/{{log_type}}/parserExtensions/{{parserextension}}
$ pulumi import gcp:chronicle/parserExtension:ParserExtension default {{project}}/{{location}}/{{instance}}/{{log_type}}/{{parserextension}}
$ pulumi import gcp:chronicle/parserExtension:ParserExtension default {{location}}/{{instance}}/{{log_type}}/{{parserextension}}

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Google Cloud (GCP) Classic pulumi/pulumi-gcp
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the google-beta Terraform Provider.
    gcp logo
    Viewing docs for Google Cloud v9.29.0
    published on Wednesday, Jun 24, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-gcp

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial