> ## Documentation Index > Fetch the complete documentation index at: https://docs.chronosphere.io/llms.txt > Use this file to discover all available pages before exploring further. # UpdateLogControlConfig ## OpenAPI ````yaml openapi/api_v1_config_openapi3_DOCUMENTATION_ONLY.json PUT /api/v1/config/log-control-config openapi: 3.0.3 info: description: > The Config API provides standard HTTP/JSON REST endpoints for creating, reading, updating, deleting, and listing configurable Chronosphere resources. Use this link to download the raw Swagger specification: /api/v1/config/swagger.json title: Config V1 API version: v1 servers: - url: https://{tenant}.chronosphere.io variables: tenant: default: tenant description: tenant ID assigned by the service provider security: - ApiKeyAuth: [] tags: - name: ConfigV1 paths: /api/v1/config/log-control-config: put: tags: - LogControlConfig operationId: UpdateLogControlConfig requestBody: content: application/json: schema: $ref: '#/components/schemas/configv1UpdateLogControlConfigRequest' required: true x-originalParamName: body responses: '200': content: application/json: schema: $ref: '#/components/schemas/configv1UpdateLogControlConfigResponse' description: A successful response containing the updated LogControlConfig. '400': content: application/json: schema: $ref: '#/components/schemas/apiError' description: Cannot update the LogControlConfig because the request is invalid. '404': content: application/json: schema: $ref: '#/components/schemas/apiError' description: >- Cannot update the LogControlConfig because LogControlConfig has not been created. '500': content: application/json: schema: $ref: '#/components/schemas/apiError' description: An unexpected error response. default: content: application/json: schema: $ref: '#/components/schemas/genericError' description: An undefined error response. components: schemas: configv1UpdateLogControlConfigRequest: properties: create_if_missing: description: >- If `true`, the LogControlConfig will be created if it does not already exist. If `false`, an error will be returned if the LogControlConfig does not already exist. type: boolean dry_run: description: >- If `true`, validates the specified configuration without creating or updating the LogControlConfig. If the specified configuration is valid, the endpoint returns a partial response without the LogControlConfig. If the specified configuration is invalid, the endpoint returns an error. type: boolean log_control_config: allOf: - $ref: '#/components/schemas/configv1LogControlConfig' description: The LogControlConfig to update. type: object configv1UpdateLogControlConfigResponse: properties: log_control_config: $ref: '#/components/schemas/configv1LogControlConfig' type: object apiError: properties: message: description: An error message describing what went wrong. type: string type: object genericError: additionalProperties: true type: object configv1LogControlConfig: description: |- LogControlConfig is a singleton configuration object that specifies the configuration for log control. properties: created_at: description: >- Timestamp of when the LogControlConfig was created. Cannot be set by clients. format: date-time readOnly: true type: string rules: description: Control Rules are the ordered list of control rules. items: $ref: '#/components/schemas/configv1LogControlRule' type: array updated_at: description: >- Timestamp of when the LogControlConfig was last updated. Cannot be set by clients. format: date-time readOnly: true type: string type: object configv1LogControlRule: description: LogControlRule is the configuration for a log control rule. properties: drop_field: allOf: - $ref: '#/components/schemas/LogControlRuleDropField' description: >- Defines the action to drop fields from logs that match specified conditions, which helps reduce the size of individual logs. If a log contains no data after fields are dropped, you can choose to drop the entire log. emit_metrics: allOf: - $ref: '#/components/schemas/LogControlRuleEmitMetrics' description: >- Defines the action to convert log data to metric data. Use this control rule when you want to reduce the volume of logs, retain data for a longer period, and increase the speed of querying and filtering for metrics instead of logs filter: description: >- Log query filter to return log data for the control rule. The control action applies to only matching logs. type: string mode: allOf: - $ref: '#/components/schemas/configv1LogControlRuleMode' description: >- Specifies whether the control rule is enabled or disabled. Default: `ENABLED`. name: description: User-defined name of the control rule. type: string parse_field: allOf: - $ref: '#/components/schemas/LogControlRuleParseField' description: >- Defines the action to parse a field in your structured log data. Use this control rule when you want to parse a field in your log data and store the parsed data in a field or multiple new fields. replace_field: allOf: - $ref: '#/components/schemas/LogControlRuleReplaceField' description: >- Defines the action to identify a specified field in your log data and uses a regular expression to replace any matches based on the selected replacement mode. Use this control rule to truncate long fields and preserve your log structure. sample: allOf: - $ref: '#/components/schemas/LogControlRuleSample' description: >- Defines the action to retain a certain percentage of matching logs and drop the remainder, which can significantly reduce volume and maintain visibility. type: allOf: - $ref: '#/components/schemas/configv1LogControlRuleType' description: >- The type of action to take on matching logs. Must be one of the following values. type: object LogControlRuleDropField: description: DropField is the configuration for a drop field action. properties: field_regex: description: >- Defines the the regular expression that determines which fields to drop. type: string parent_path: allOf: - $ref: '#/components/schemas/configv1LogFieldPath' description: >- Optional. Specifies the level of depth in the log to apply the regular expression to. For example, if you want to apply the regular expression to fields under `httpRequest`, such as `httpRequest.status`, enter `httpRequest` in the `parent_path` field. If empty, the fields to drop are at the root level of the log. required: - field_regex type: object LogControlRuleEmitMetrics: description: EmitMetrics is the configuration for emit metrics action. properties: counter: allOf: - $ref: '#/components/schemas/EmitMetricsCounter' description: >- Generates a metric that counts the number of times a certain event has occurred. drop_log: description: >- Optional. If `true`, drops the entire log after emitting the defined metric. type: boolean gauge: allOf: - $ref: '#/components/schemas/EmitMetricsGauge' description: >- Generates a metric that tracks a value, which changes over time. Choose `LAST` (most recent), `MIN` (minimum value), or `MAX` (maximum value) to define which value to use. histogram: allOf: - $ref: '#/components/schemas/EmitMetricsHistogram' description: >- Generates a metric that tracks the distribution of values across data groupings with exponentially increasing size. labels: description: >- The labels to emit with the metric, specified as key/value pairs. The generated label is a valid Prometheus label name, mapped to a log key. items: $ref: '#/components/schemas/LogControlRuleEmitMetricsLabel' type: array mode: allOf: - $ref: '#/components/schemas/EmitMetricsMetricMode' description: >- Indicates the mode of the generated metric. Must be one of the following values: name: description: >- A unique name for the generated metric. This name must conform to Prometheus naming conventions. type: string required: - mode - name type: object configv1LogControlRuleMode: enum: - ENABLED - DISABLED type: string LogControlRuleParseField: description: ParseField is the configuration for a parse field action. properties: destination: allOf: - $ref: '#/components/schemas/configv1LogFieldPath' description: >- The destination field where parsed structured data will be written. If the key already exists, the value will be overwritten. If unset, the log will be updated at the root level and any conflicting keys will be overwritten. parser: allOf: - $ref: '#/components/schemas/LogIngestConfigLogParser' description: The parser to apply to the source field. source: allOf: - $ref: '#/components/schemas/configv1LogFieldPath' description: The source field to parse. type: object LogControlRuleReplaceField: description: ReplaceField is the configuration for a replace field action. properties: field: allOf: - $ref: '#/components/schemas/configv1LogFieldPath' description: Specifies the field inside the log data to apply the rule to. mapped_value: allOf: - $ref: '#/components/schemas/ReplaceFieldMappedValue' description: Defines the configuration for the mapped value replacement mode. replace_all: description: Determines whether to replace all matches or just the first match. type: boolean replace_mode: allOf: - $ref: '#/components/schemas/ReplaceFieldReplaceMode' description: >- Defines the replacement mode to use in the replace rule. Must be one of the following values: replace_regex: description: >- Defines the the regular expression that determines which part of the field to replace. type: string static_value: allOf: - $ref: '#/components/schemas/ReplaceFieldStaticValue' description: Defines the configuration for the fixed value replacement mode. required: - field - replace_mode - replace_regex type: object LogControlRuleSample: description: Sample is the configuration for the sample logs action. properties: rate: description: >- Percentage of matching logs to keep. Must be in the range `[0, 1]`, where `1` is equal to 100% of logs. For example, to keep 25% of logs, enter `0.25` as the `rate`. format: double type: number required: - rate type: object configv1LogControlRuleType: enum: - DROP - SAMPLE - DROP_FIELD - REPLACE_FIELD - EMIT_METRICS - PARSE_FIELD type: string configv1LogFieldPath: properties: selector: description: >- The log filter used to indicate the field path. Use `parent[child]` syntax to indicate nesting. type: string type: object EmitMetricsCounter: properties: value: allOf: - $ref: '#/components/schemas/configv1LogFieldPath' description: >- Optional. Specifies the name of the log field whose value you want to use as the metric value. If unset, the counter increments by one. type: object EmitMetricsGauge: properties: aggregation_type: allOf: - $ref: '#/components/schemas/GaugeAggregationType' description: >- The aggregation type to use for the gauge. Must be one of the following values: value: allOf: - $ref: '#/components/schemas/configv1LogFieldPath' description: >- The name of the log field whose value you want to use as the metric value. required: - value type: object EmitMetricsHistogram: properties: value: allOf: - $ref: '#/components/schemas/configv1LogFieldPath' description: >- The name of the log field whose value you want to use as the metric value. required: - value type: object LogControlRuleEmitMetricsLabel: properties: key: type: string value: $ref: '#/components/schemas/configv1LogFieldPath' type: object EmitMetricsMetricMode: enum: - COUNTER - GAUGE - HISTOGRAM type: string LogIngestConfigLogParser: properties: grok_parser: $ref: '#/components/schemas/LogParserGrokParser' key_value_parser: $ref: '#/components/schemas/LogParserKeyValueParser' parser_type: allOf: - $ref: '#/components/schemas/LogParserParserType' description: The type of parser to use. regex_parser: allOf: - $ref: '#/components/schemas/LogParserRegexParser' description: This object contains settings relevant to `REGEX` parsers. type: object ReplaceFieldMappedValue: description: MappedValue is the configuration for mapped value replace mode. properties: default_value: description: The value to use if no matching value is found. type: string pairs: description: A list of key/value pairs to replace matched content with. items: $ref: '#/components/schemas/MappedValueReplacePair' type: array use_default: description: |- If `true`, specifies a default value if no matching key is found. If `false`, the value will be unchanged if no matching key is found. type: boolean type: object ReplaceFieldReplaceMode: description: >2- - HASH: Replace the matched content with a hashed string, which can help reduce the size of large strings. After replacing the original content with a string, there’s no way to recover that information. - STATIC_VALUE: Replace the matched content with a static string. For example, replace punctuation in a field with an empty string, or truncate the ends of long stack traces. - MAPPED_VALUE: Replace the matched content with specified key/value pairs. For example, reduce log volume by replacing a string error with a specific error code. If none of the key/value pairs match, the provided default value is used. @REQUIRED enum: - HASH - STATIC_VALUE - MAPPED_VALUE type: string ReplaceFieldStaticValue: description: >- StaticValue is the configuration for the replace field control rule in static value mode. Used to replace the selected content with a static value. properties: value: description: >- The value to replace selected content with. If empty, the action removes the selected content. type: string type: object GaugeAggregationType: enum: - LAST - MIN - MAX type: string LogParserGrokParser: properties: pattern: description: >- The grok pattern to apply. Named capture groups become named fields in the extracted log. type: string type: object LogParserKeyValueParser: description: |- A parser to extract key/value pairs from a string. If duplicate keys are found, the first instance is used. properties: delimiter: description: The string for splitting the input into key/value pairs. type: string pair_separator: description: The string for splitting each pair into its key and value. type: string trim_set: description: |- Specifies the code points of any Unicode characters to trim from the beginning and end of keys and values. type: string required: - delimiter - pair_separator type: object LogParserParserType: enum: - JSON - REGEX - KEY_VALUE - GROK type: string LogParserRegexParser: properties: regex: description: |- The regular expression parser pattern to apply. Must use RE2 syntax. Named capturing groups become named fields in the extracted log. type: string type: object MappedValueReplacePair: properties: key: type: string value: type: string type: object securitySchemes: ApiKeyAuth: description: Chronosphere API token in: header name: API-Token type: apiKey ````