Optional actionHow to handle logs that are missing one of the partition_fields. Options:
ignore: Forward the event without applying spike protection.default_bucket: Assign the event to a default partition.Optional additionalA container for additional, undeclared properties. This is a holder for any undeclared properties as specified with the 'additionalProperties' keyword in the OAS document.
Optional displayThe display name for a component.
Indicates whether the processor is enabled.
The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the input to downstream components).
A Datadog search query used to determine which logs this processor targets.
Optional minimalThe minimum volume, in bytes, that must be observed within 24 hours before spike protection can activate. Defaults to 100 GiB.
Optional minimalA list of per-partition overrides for the minimal threshold, identified by matching field values. Requires partition_fields to be set.
Name of the spike protection rule.
Optional partitionA list of fields used to segment log traffic. Volume is learned and evaluated independently for each unique combination of these field values. A maximum of five fields is supported.
The action to take with matching logs while spike protection is active. Options:
drop: Drop the event.no_action: Let the event pass through.overflow_routing: Route to an overflow destination.When overflow_routing is used, there must be a destination whose inputs reference this processor with the <processor-id>.overflow_events suffix to route the overflowing events.
Optional spikeThe number of standard deviations above the learned mean volume that must be exceeded before a spike is detected. Defaults to 5.
The processor type. The value should always be spike_protection.
Generated using TypeDoc
The
spike_protectionprocessor learns the normal ingestion volume for the logs that match a specified filter and takes action when the volume spikes unexpectedly.Supported pipeline types: logs