> ## Documentation Index > Fetch the complete documentation index at: https://docs.chronosphere.io/llms.txt > Use this file to discover all available pages before exploring further. # UpdateLogIngestConfig ## OpenAPI ````yaml openapi/api_v1_config_openapi3_DOCUMENTATION_ONLY.json PUT /api/v1/config/log-ingest-config openapi: 3.0.3 info: description: > The Config API provides standard HTTP/JSON REST endpoints for creating, reading, updating, deleting, and listing configurable Chronosphere resources. Use this link to download the raw Swagger specification: /api/v1/config/swagger.json title: Config V1 API version: v1 servers: - url: https://{tenant}.chronosphere.io variables: tenant: default: tenant description: tenant ID assigned by the service provider security: - ApiKeyAuth: [] tags: - name: ConfigV1 paths: /api/v1/config/log-ingest-config: put: tags: - LogIngestConfig operationId: UpdateLogIngestConfig requestBody: content: application/json: schema: $ref: '#/components/schemas/configv1UpdateLogIngestConfigRequest' required: true x-originalParamName: body responses: '200': content: application/json: schema: $ref: '#/components/schemas/configv1UpdateLogIngestConfigResponse' description: A successful response containing the updated LogIngestConfig. '400': content: application/json: schema: $ref: '#/components/schemas/apiError' description: Cannot update the LogIngestConfig because the request is invalid. '404': content: application/json: schema: $ref: '#/components/schemas/apiError' description: >- Cannot update the LogIngestConfig because LogIngestConfig has not been created. '500': content: application/json: schema: $ref: '#/components/schemas/apiError' description: An unexpected error response. default: content: application/json: schema: $ref: '#/components/schemas/genericError' description: An undefined error response. components: schemas: configv1UpdateLogIngestConfigRequest: properties: create_if_missing: description: >- If `true`, the LogIngestConfig will be created if it does not already exist. If `false`, an error will be returned if the LogIngestConfig does not already exist. type: boolean dry_run: description: >- If `true`, validates the specified configuration without creating or updating the LogIngestConfig. If the specified configuration is valid, the endpoint returns a partial response without the LogIngestConfig. If the specified configuration is invalid, the endpoint returns an error. type: boolean log_ingest_config: allOf: - $ref: '#/components/schemas/configv1LogIngestConfig' description: The LogIngestConfig to update. type: object configv1UpdateLogIngestConfigResponse: properties: log_ingest_config: $ref: '#/components/schemas/configv1LogIngestConfig' type: object apiError: properties: message: description: An error message describing what went wrong. type: string type: object genericError: additionalProperties: true type: object configv1LogIngestConfig: description: >- LogIngestConfig is a singleton configuration object that specifies the configuration for log ingest. properties: created_at: description: >- Timestamp of when the LogIngestConfig was created. Cannot be set by clients. format: date-time readOnly: true type: string field_normalization: allOf: - $ref: '#/components/schemas/LogIngestConfigFieldNormalization' description: Maps and normalizes well-known fields from parsed logs. field_parsers: description: >- The parsers to apply to specific fields within structured logs or plaintext logs after those logs are parsed. items: $ref: '#/components/schemas/LogIngestConfigLogFieldParser' type: array plaintext_parsers: description: >- The parsers to apply to plaintext logs. The first parser that matches the log is used. items: $ref: '#/components/schemas/LogIngestConfigPlaintextParser' type: array updated_at: description: >- Timestamp of when the LogIngestConfig was last updated. Cannot be set by clients. format: date-time readOnly: true type: string type: object LogIngestConfigFieldNormalization: description: >- FieldNormalization allows you to map and normalize well-known fields from your logs. These mappings run after parsing to standardize common fields like timestamp, severity level, and message across different log formats. properties: custom_field_normalization: description: >- Maps additional custom fields from your logs. These will not be indexed. Use these for any other fields you want to normalize, such as environment, region, or user ID. items: $ref: '#/components/schemas/LogIngestConfigNamedStringNormalization' type: array message: allOf: - $ref: '#/components/schemas/LogIngestConfigStringNormalization' description: |- Maps the main message field from your logs. This is typically the human-readable description of the log event. service: allOf: - $ref: '#/components/schemas/LogIngestConfigStringNormalization' description: >- Maps the service field from your logs. The mapped value will be indexed and can be used for filtering and grouping. severity: allOf: - $ref: '#/components/schemas/LogIngestConfigStringNormalization' description: >- Maps severity or log level fields (e.g., ERROR, WARN, INFO, DEBUG). Use value mapping to normalize different severity formats across your logs. timestamp: allOf: - $ref: '#/components/schemas/LogIngestConfigTimestampNormalization' description: >- Maps timestamp fields from your logs to ensure consistent time ordering. The system will try each specified field in order until a valid timestamp is found. type: object LogIngestConfigLogFieldParser: properties: destination: allOf: - $ref: '#/components/schemas/configv1LogFieldPath' description: |- The destination field for storing parsed structured data. If the specified key already exists, its value is overwritten. If this value is unset, the log is updated at the root level and any conflicting keys are overwritten. mode: allOf: - $ref: '#/components/schemas/LogIngestConfigLogFieldParserMode' description: Specifies whether the field parser is enabled or disabled. parser: allOf: - $ref: '#/components/schemas/LogIngestConfigLogParser' description: The parser to apply to the source field. source: allOf: - $ref: '#/components/schemas/configv1LogFieldPath' description: The source field to parse. type: object LogIngestConfigPlaintextParser: properties: keep_original: description: >- If `true`, the original log is retained after parsing and stored in the key `plaintext_log`. If `false`, the original log is dropped after parsing. Default value: `false`. type: boolean mode: allOf: - $ref: '#/components/schemas/LogIngestConfigPlaintextParserMode' description: Specifies whether the parser is enabled or disabled. name: description: The name of the parser. Must be unique within the configuration. type: string parser: allOf: - $ref: '#/components/schemas/LogIngestConfigLogParser' description: The parser configuration to apply to plaintext logs. type: object LogIngestConfigNamedStringNormalization: description: >- NamedStringNormalization maps a field to a named target with optional transformations. properties: normalization: allOf: - $ref: '#/components/schemas/LogIngestConfigStringNormalization' description: The normalization configuration for this field. target: description: >- The name of the target field where the normalized value will be stored. type: string type: object LogIngestConfigStringNormalization: description: >- StringNormalization defines how to extract and transform string values from log fields. properties: default_value: description: Default value to use when no source fields contain values. type: string sanitize_patterns: description: >- Optional regex patterns to extract and sanitize values. Each pattern must have exactly one capturing group that will be used as the result. For example: "^.*level=([A-Z]+).*$" to extract log level from a string. items: type: string type: array source: description: |- List of field paths to check for values, in priority order. The first non-empty value found will be used. items: $ref: '#/components/schemas/configv1LogFieldPath' type: array value_map: additionalProperties: type: string description: >- Optional mapping to normalize values. For example: {"warn": "WARNING", "err": "ERROR"} to standardize severity levels. type: object type: object LogIngestConfigTimestampNormalization: description: >- TimestampNormalization specifies which fields to check for timestamp values. properties: source: description: >- List of field paths to check for timestamp values, in priority order. Common fields include "timestamp", "@timestamp", "time", "datetime". items: $ref: '#/components/schemas/configv1LogFieldPath' type: array type: object configv1LogFieldPath: properties: selector: description: >- The log filter used to indicate the field path. Use `parent[child]` syntax to indicate nesting. type: string type: object LogIngestConfigLogFieldParserMode: enum: - ENABLED - DISABLED type: string LogIngestConfigLogParser: properties: grok_parser: $ref: '#/components/schemas/LogParserGrokParser' key_value_parser: $ref: '#/components/schemas/LogParserKeyValueParser' parser_type: allOf: - $ref: '#/components/schemas/LogParserParserType' description: The type of parser to use. regex_parser: allOf: - $ref: '#/components/schemas/LogParserRegexParser' description: This object contains settings relevant to `REGEX` parsers. type: object LogIngestConfigPlaintextParserMode: enum: - ENABLED - DISABLED type: string LogParserGrokParser: properties: pattern: description: >- The grok pattern to apply. Named capture groups become named fields in the extracted log. type: string type: object LogParserKeyValueParser: description: |- A parser to extract key/value pairs from a string. If duplicate keys are found, the first instance is used. properties: delimiter: description: The string for splitting the input into key/value pairs. type: string pair_separator: description: The string for splitting each pair into its key and value. type: string trim_set: description: |- Specifies the code points of any Unicode characters to trim from the beginning and end of keys and values. type: string required: - delimiter - pair_separator type: object LogParserParserType: enum: - JSON - REGEX - KEY_VALUE - GROK type: string LogParserRegexParser: properties: regex: description: |- The regular expression parser pattern to apply. Must use RE2 syntax. Named capturing groups become named fields in the extracted log. type: string type: object securitySchemes: ApiKeyAuth: description: Chronosphere API token in: header name: API-Token type: apiKey ````