/** * The Datadog POC report's control arm: on the same pulled events, the index * filters a person writes without 10x against the per-pattern plan, counted in * Datadog's unit (events kept out of the Standard index). * * Native filters: one per service with * `-status:(emergency OR alert OR critical OR error OR warn)`, so none moves an * event of status warn or above; inside a service whose events carry a parsed * split attribute (`logger.name`), one per value instead; largest first until * they reach the events the plan moves, the overshoot kept. */ import { type PatternCell } from './pattern-extraction.js'; export interface ControlPattern { identity: string; template: string; sampleEvent: string; tenxHash?: string; service?: string; severity?: string; count: number; bytes: number; cells?: PatternCell[]; /** The plan's action. Anything but `keep` takes the pattern out of the Standard index. */ action: string; } export interface NativeFilter { service: string; attribute?: { name: string; value: string; }; events: number; bytes: number; } export interface ArmCounts { events: number; bytes: number; errorsAndWarnings: number; /** Events of patterns the plan keeps that this arm moves. */ keptPatternEventsMoved: number; /** Events this arm leaves in Standard that the other arm moves. */ leftThatOtherMoves: number; } export interface ServiceNote { service: string; /** The parsed split attribute's name, when the service's events carry one with two or more values. */ splitAttribute?: string; filters: NativeFilter[]; /** Events of the plan's patterns in this service that the native filters leave in Standard. */ planEventsLeft: number; } export interface NativeControl { movedPatterns: number; native: ArmCounts & { filters: NativeFilter[]; }; plan: ArmCounts & { tierDownEvents: number; tierDownBytes: number; offloadEvents: number; offloadBytes: number; }; services: ServiceNote[]; id: { isolable: string[]; group: string[]; notIsolable: Array<{ identity: string; events: number; sharedWithKept: string[]; }>; hashes: string[]; withoutHash: number; /** Moved patterns with no event tied to its envelope; left out of the three counts. */ unplaced: number; }; eventsCounted: number; eventsTotal: number; } /** A pattern as the POC renderers carry it, before it is set against the native filters. */ export interface ControlSource { identity: string; template: string; sampleEvent: string; tenxHash?: string; hash: string; service?: string; severity?: string; count: number; bytes: number; cells?: PatternCell[]; recommendedAction: string; } /** * The control arm's patterns: each pattern's action from the plan when one * was solved (anything it does not move is `keep`), else its recommended * action. A cell with no Datadog status (a forwarder's raw records carry * none) takes the pattern's severity as the engine reads it. */ export declare function controlPatterns(patterns: ControlSource[], plannedAction?: ReadonlyMap): ControlPattern[]; /** * The phrases of a template's constant words: each literal run between slots, * as tokens, without a token a slot touches (that token's text varies). The * escaping follows `templateEnds`: `/` escapes the next character, `$` opens a * slot, `$(...)` a timestamp slot and `$N` a back-reference. */ export declare function templatePhrases(template: string): string[][]; export declare function computeNativeControl(patterns: ControlPattern[]): NativeControl; export interface NativeControlRenderInput { patterns: ControlPattern[]; /** The sample's bytes, the base the report scales from. */ totalBytes: number; totalDailyGb?: number; windowHours: number; window: string; volumeLabel?: string; volumeRangeMultiplier?: { low: number; high: number; }; /** No rate to price with: render counts only. */ dollarsWithheld?: boolean; } export declare function filterQuery(f: { service: string; attribute?: { name: string; value: string; }; }): string; export declare function renderNativeControlSection(input: NativeControlRenderInput): string[];