VirtualMetric

Test Pipeline

Run a sample log through a pipeline config and return the normalized output as JSON. For a multi-file pack (an entry pipeline that calls others via `pipeline`/IngestPipeline), put every pipeline in `pipeline` as a YAML list or `---`-separated docs and set `name` to the entry.

Validate Pipeline

Run a sample log through a pipeline config and report true/false against an expected output. For a multi-file pack, put every pipeline in `pipeline` (YAML list or `---`-separated docs) and set `name` to the entry.

Diff Pipeline

Show expected vs actual output and a unified diff. For a multi-file pack, put every pipeline in `pipeline` (YAML list or `---`-separated docs) and set `name` to the entry.

Validate Schema

Normalize a sample log with a pipeline config, then check the output against a target schema (ASIM table, ocsf:<class>, udm:<...>, or custom) using the check_schema processor. Reports missing/extra/type-mismatch fields.

Convert Cribl Pipeline

Convert a Cribl Stream pipeline into an equivalent VirtualMetric DataStream pipeline (YAML). Input is a Cribl pipeline export (its on-disk shape: top-level `description`/`groups`/`functions`, each function an id/conf/filter). This is the FIRST step when migrating a Cribl pipeline — then run test_pipeline/validate_pipeline on the returned YAML to verify behavior. Disabled Cribl functions (and functions in disabled groups) are converted as disabled processors, not dropped, so the result is a faith

Convert Kql Query

Convert a KQL query (an ASIM parser function, or a raw KQL query) into an equivalent VirtualMetric DataStream pipeline (YAML). Input may be a raw KQL query or a full ASIM parser YAML export (ParserQuery/ParserName are extracted automatically). This is the FIRST step when migrating an ASIM parser — then run test_pipeline/validate_pipeline on the returned YAML to verify behavior.

Convert Logstash Pipeline

Convert a Logstash pipeline configuration (.conf with input/filter/output sections) into an equivalent VirtualMetric DataStream pipeline (YAML). Filter plugins become native processors, Logstash conditionals become native `if:` gates / groups, and input/output sections are summarized as comments (devices and targets are configured separately in DataStream). Unsupported plugins/options degrade to comment processors plus Warning lines in the pipeline description — review those before trusting the

List Processors

List available pipeline processors (188), optionally filtered by a search term. Returns each processor's key and one-line description.

Get Processor

Get a processor's full option schema (field, type, required) and a link to its documentation.

List Skills

List the embedded authoring guides (how to build a pack, build/edit a pipeline, taxonomy and tooling overview) with their descriptions.

Get Skill

Return the full guidance document for an authoring guide. Read the relevant guide before creating or editing a pack/pipeline to follow the conventions and avoid the known gotchas.