import * as pulumi from "@pulumi/pulumi"; /** * Helper data source to which can be used to create a processor to compute the Community ID for network flow data as defined in the [Community ID Specification](https://github.com/corelight/community-id-spec). * You can use a community ID to correlate network events related to a single flow. * * The community ID processor reads network flow data from related [Elastic Common Schema (ECS)](https://www.elastic.co/guide/en/ecs/1.12) fields by default. If you use the ECS, no configuration is required. * * See: https://www.elastic.co/guide/en/elasticsearch/reference/current/community-id-processor.html * * ## Example Usage * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as elasticstack from "@pulumi/elasticstack"; * * const community = elasticstack.ElasticsearchIngestProcessorCommunityId({}); * const myIngestPipeline = new elasticstack.ElasticsearchIngestPipeline("myIngestPipeline", {processors: [community.then(community => community.json)]}); * ``` */ export declare function elasticsearchIngestProcessorCommunityId(args?: ElasticsearchIngestProcessorCommunityIdArgs, opts?: pulumi.InvokeOptions): Promise; /** * A collection of arguments for invoking ElasticsearchIngestProcessorCommunityId. */ export interface ElasticsearchIngestProcessorCommunityIdArgs { /** * Description of the processor. */ description?: string; /** * Field containing the destination IP address. */ destinationIp?: string; /** * Field containing the destination port. */ destinationPort?: number; /** * Field containing the IANA number. */ ianaNumber?: number; /** * Field containing the ICMP code. */ icmpCode?: number; /** * Field containing the ICMP type. */ icmpType?: number; /** * Conditionally execute the processor */ if?: string; /** * Ignore failures for the processor. */ ignoreFailure?: boolean; /** * If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document. */ ignoreMissing?: boolean; /** * Handle failures for the processor. */ onFailures?: string[]; /** * Seed for the community ID hash. Must be between 0 and 65535 (inclusive). The seed can prevent hash collisions between network domains, such as a staging and production network that use the same addressing scheme. */ seed?: number; /** * Field containing the source IP address. */ sourceIp?: string; /** * Field containing the source port. */ sourcePort?: number; /** * Identifier for the processor. */ tag?: string; /** * Output field for the community ID. */ targetField?: string; /** * Field containing the transport protocol. Used only when the `ianaNumber` field is not present. */ transport?: string; } /** * A collection of values returned by ElasticsearchIngestProcessorCommunityId. */ export interface ElasticsearchIngestProcessorCommunityIdResult { /** * Description of the processor. */ readonly description?: string; /** * Field containing the destination IP address. */ readonly destinationIp?: string; /** * Field containing the destination port. */ readonly destinationPort?: number; /** * Field containing the IANA number. */ readonly ianaNumber?: number; /** * Field containing the ICMP code. */ readonly icmpCode?: number; /** * Field containing the ICMP type. */ readonly icmpType?: number; /** * Internal identifier of the resource */ readonly id: string; /** * Conditionally execute the processor */ readonly if?: string; /** * Ignore failures for the processor. */ readonly ignoreFailure?: boolean; /** * If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document. */ readonly ignoreMissing?: boolean; /** * JSON representation of this data source. */ readonly json: string; /** * Handle failures for the processor. */ readonly onFailures?: string[]; /** * Seed for the community ID hash. Must be between 0 and 65535 (inclusive). The seed can prevent hash collisions between network domains, such as a staging and production network that use the same addressing scheme. */ readonly seed?: number; /** * Field containing the source IP address. */ readonly sourceIp?: string; /** * Field containing the source port. */ readonly sourcePort?: number; /** * Identifier for the processor. */ readonly tag?: string; /** * Output field for the community ID. */ readonly targetField?: string; /** * Field containing the transport protocol. Used only when the `ianaNumber` field is not present. */ readonly transport?: string; } export declare function elasticsearchIngestProcessorCommunityIdOutput(args?: ElasticsearchIngestProcessorCommunityIdOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output; /** * A collection of arguments for invoking ElasticsearchIngestProcessorCommunityId. */ export interface ElasticsearchIngestProcessorCommunityIdOutputArgs { /** * Description of the processor. */ description?: pulumi.Input; /** * Field containing the destination IP address. */ destinationIp?: pulumi.Input; /** * Field containing the destination port. */ destinationPort?: pulumi.Input; /** * Field containing the IANA number. */ ianaNumber?: pulumi.Input; /** * Field containing the ICMP code. */ icmpCode?: pulumi.Input; /** * Field containing the ICMP type. */ icmpType?: pulumi.Input; /** * Conditionally execute the processor */ if?: pulumi.Input; /** * Ignore failures for the processor. */ ignoreFailure?: pulumi.Input; /** * If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document. */ ignoreMissing?: pulumi.Input; /** * Handle failures for the processor. */ onFailures?: pulumi.Input[]>; /** * Seed for the community ID hash. Must be between 0 and 65535 (inclusive). The seed can prevent hash collisions between network domains, such as a staging and production network that use the same addressing scheme. */ seed?: pulumi.Input; /** * Field containing the source IP address. */ sourceIp?: pulumi.Input; /** * Field containing the source port. */ sourcePort?: pulumi.Input; /** * Identifier for the processor. */ tag?: pulumi.Input; /** * Output field for the community ID. */ targetField?: pulumi.Input; /** * Field containing the transport protocol. Used only when the `ianaNumber` field is not present. */ transport?: pulumi.Input; }