coralogix.RulesGroup

import * as pulumi from "@pulumi/pulumi";
import * as coralogix from "@pulumi/coralogix";

const rulesGroupExample = new coralogix.RulesGroup("rulesGroupExample", {
    applications: ["nginx"],
    description: "rule_group creates by coralogix terraform provider",
    order: 1,
    ruleSubgroups: [
        {
            rules: [
                {
                    extract: {
                        description: "Look for default severity text",
                        name: "Severity Rule",
                        regularExpression: "message\\s*:s*(?P<bytes>\\d+)\\s*.*?status\\sis\\s(?P<status>\\[^\"]+)",
                        sourceField: "text",
                    },
                },
                {
                    jsonExtract: {
                        description: "Extracts value from 'worker' and populates 'Category'",
                        destinationField: "Text",
                        destinationFieldText: "text.free_text",
                        jsonKey: "worker",
                        name: "Worker to category",
                    },
                },
                {
                    replace: {
                        description: "Deletes data before Json",
                        destinationField: "text",
                        name: "Delete prefix",
                        regularExpression: ".*{",
                        replacementString: "{",
                        sourceField: "text",
                    },
                },
                {
                    block: {
                        description: "Block 2800 pg error",
                        name: "Block 28000",
                        regularExpression: "sql_error_code\\s*=\\s*28000",
                        sourceField: "text",
                    },
                },
            ],
        },
        {
            rules: [
                {
                    parse: {
                        description: "Parse the fields of the HTTP request",
                        destinationField: "text",
                        name: "HttpRequestParser1",
                        regularExpression: "(?P<remote_addr>\\d{1,3}.\\d{1,3}.\\d{1,3}.\\d{1,3})\\s*-\\s*(?P<user>[^ ]+)\\s*\\[(?P<timestemp>\\d{4}-\\d{2}\\-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{1,6}Z)\\]\\s*\\\\\\\"(?P<method>[A-z]+)\\s[\\/\\\\]+(?P<request>[^\\s]+)\\s*(?P<protocol>[A-z0-9\\/\\.]+)\\\\\\\"\\s*(?P<status>\\d+)\\s*(?P<body_bytes_sent>\\d+)?\\s*?\\\\\\\"(?P<http_referer>[^\"]+)\\\"\\s*\\\\\\\"(?P<http_user_agent>[^\"]+)\\\"\\s(?P<request_time>\\d{1,6})\\s*(?P<response_time>\\d{1,6})",
                        sourceField: "text",
                    },
                },
                {
                    parse: {
                        description: "Parse the fields of the HTTP request - will be applied after HttpRequestParser1",
                        destinationField: "text",
                        name: "HttpRequestParser2",
                        regularExpression: "(?P<remote_addr>\\d{1,3}.\\d{1,3}.\\d{1,3}.\\d{1,3})\\s*-\\s*(?P<user>[^ ]+)\\s*\\[(?P<timestemp>\\d{4}-\\d{2}\\-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{1,6}Z)\\]\\s*\\\\\\\"(?P<method>[A-z]+)\\s[\\/\\\\]+(?P<request>[^\\s]+)\\s*(?P<protocol>[A-z0-9\\/\\.]+)\\\\\\\"\\s*(?P<status>\\d+)\\s*(?P<body_bytes_sent>\\d+)?\\s*?\\\\\\\"(?P<http_referer>[^\"]+)\\\"\\s*\\\\\\\"(?P<http_user_agent>[^\"]+)\\\"\\s(?P<request_time>\\d{1,6})\\s*(?P<response_time>\\d{1,6})",
                        sourceField: "text",
                    },
                },
                {
                    jsonStringify: {
                        destinationField: "text",
                        keepSourceField: false,
                        name: "json_stringify rule",
                        sourceField: "text",
                    },
                },
            ],
        },
    ],
    severities: ["Warning"],
    subsystems: ["subsystem-name"],
});
//change here for existing subsystems from your account
const extractTimestampExample = new coralogix.RulesGroup("extractTimestampExample", {
    applications: ["nginx"],
    description: "rule_group created by coralogix terraform provider",
    order: 4,
    ruleSubgroups: [{
        rules: [{
            extractTimestamp: {
                description: "rule created by coralogix terraform provider",
                fieldFormatStandard: "Strftime",
                name: "example extract-timestamp rule from terraform",
                sourceField: "text",
                timeFormat: "%Y-%m-%dT%H:%M:%S.%f%z",
            },
        }],
    }],
    severities: ["Warning"],
    subsystems: ["subsystem-name"],
});
//change here for existing subsystems from your account
const removeFieldsExample = new coralogix.RulesGroup("removeFieldsExample", {
    applications: ["nginx"],
    description: "rule_group created by coralogix terraform provider",
    order: 3,
    ruleSubgroups: [{
        rules: [{
            removeFields: {
                description: "rule created by coralogix terraform provider",
                excludedFields: [
                    "coralogix.metadata.applicationName",
                    "coralogix.metadata.className",
                ],
                name: "Example remove-fields rule from terraform",
            },
        }],
    }],
    severities: ["Warning"],
    subsystems: ["subsystem-name"],
});
//change here for existing subsystems from your account
const parseJsonFieldExample = new coralogix.RulesGroup("parseJsonFieldExample", {
    applications: ["nginx"],
    description: "rule_group created by coralogix terraform provider",
    order: 2,
    ruleSubgroups: [{
        rules: [{
            parseJsonField: {
                description: "rule created by coralogix terraform provider",
                destinationField: "text",
                keepDestinationField: true,
                keepSourceField: true,
                name: "Example parse-json-field rule from terraform",
                sourceField: "text",
            },
        }],
    }],
    severities: ["Warning"],
    subsystems: ["subsystem-name"],
});
//change here for existing subsystems from your account

import pulumi
import pulumi_coralogix as coralogix

rules_group_example = coralogix.RulesGroup("rulesGroupExample",
    applications=["nginx"],
    description="rule_group creates by coralogix terraform provider",
    order=1,
    rule_subgroups=[
        {
            "rules": [
                {
                    "extract": {
                        "description": "Look for default severity text",
                        "name": "Severity Rule",
                        "regular_expression": "message\\s*:s*(?P<bytes>\\d+)\\s*.*?status\\sis\\s(?P<status>\\[^\"]+)",
                        "source_field": "text",
                    },
                },
                {
                    "json_extract": {
                        "description": "Extracts value from 'worker' and populates 'Category'",
                        "destination_field": "Text",
                        "destination_field_text": "text.free_text",
                        "json_key": "worker",
                        "name": "Worker to category",
                    },
                },
                {
                    "replace": {
                        "description": "Deletes data before Json",
                        "destination_field": "text",
                        "name": "Delete prefix",
                        "regular_expression": ".*{",
                        "replacement_string": "{",
                        "source_field": "text",
                    },
                },
                {
                    "block": {
                        "description": "Block 2800 pg error",
                        "name": "Block 28000",
                        "regular_expression": "sql_error_code\\s*=\\s*28000",
                        "source_field": "text",
                    },
                },
            ],
        },
        {
            "rules": [
                {
                    "parse": {
                        "description": "Parse the fields of the HTTP request",
                        "destination_field": "text",
                        "name": "HttpRequestParser1",
                        "regular_expression": "(?P<remote_addr>\\d{1,3}.\\d{1,3}.\\d{1,3}.\\d{1,3})\\s*-\\s*(?P<user>[^ ]+)\\s*\\[(?P<timestemp>\\d{4}-\\d{2}\\-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{1,6}Z)\\]\\s*\\\\\\\"(?P<method>[A-z]+)\\s[\\/\\\\]+(?P<request>[^\\s]+)\\s*(?P<protocol>[A-z0-9\\/\\.]+)\\\\\\\"\\s*(?P<status>\\d+)\\s*(?P<body_bytes_sent>\\d+)?\\s*?\\\\\\\"(?P<http_referer>[^\"]+)\\\"\\s*\\\\\\\"(?P<http_user_agent>[^\"]+)\\\"\\s(?P<request_time>\\d{1,6})\\s*(?P<response_time>\\d{1,6})",
                        "source_field": "text",
                    },
                },
                {
                    "parse": {
                        "description": "Parse the fields of the HTTP request - will be applied after HttpRequestParser1",
                        "destination_field": "text",
                        "name": "HttpRequestParser2",
                        "regular_expression": "(?P<remote_addr>\\d{1,3}.\\d{1,3}.\\d{1,3}.\\d{1,3})\\s*-\\s*(?P<user>[^ ]+)\\s*\\[(?P<timestemp>\\d{4}-\\d{2}\\-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{1,6}Z)\\]\\s*\\\\\\\"(?P<method>[A-z]+)\\s[\\/\\\\]+(?P<request>[^\\s]+)\\s*(?P<protocol>[A-z0-9\\/\\.]+)\\\\\\\"\\s*(?P<status>\\d+)\\s*(?P<body_bytes_sent>\\d+)?\\s*?\\\\\\\"(?P<http_referer>[^\"]+)\\\"\\s*\\\\\\\"(?P<http_user_agent>[^\"]+)\\\"\\s(?P<request_time>\\d{1,6})\\s*(?P<response_time>\\d{1,6})",
                        "source_field": "text",
                    },
                },
                {
                    "json_stringify": {
                        "destination_field": "text",
                        "keep_source_field": False,
                        "name": "json_stringify rule",
                        "source_field": "text",
                    },
                },
            ],
        },
    ],
    severities=["Warning"],
    subsystems=["subsystem-name"])
#change here for existing subsystems from your account
extract_timestamp_example = coralogix.RulesGroup("extractTimestampExample",
    applications=["nginx"],
    description="rule_group created by coralogix terraform provider",
    order=4,
    rule_subgroups=[{
        "rules": [{
            "extract_timestamp": {
                "description": "rule created by coralogix terraform provider",
                "field_format_standard": "Strftime",
                "name": "example extract-timestamp rule from terraform",
                "source_field": "text",
                "time_format": "%Y-%m-%dT%H:%M:%S.%f%z",
            },
        }],
    }],
    severities=["Warning"],
    subsystems=["subsystem-name"])
#change here for existing subsystems from your account
remove_fields_example = coralogix.RulesGroup("removeFieldsExample",
    applications=["nginx"],
    description="rule_group created by coralogix terraform provider",
    order=3,
    rule_subgroups=[{
        "rules": [{
            "remove_fields": {
                "description": "rule created by coralogix terraform provider",
                "excluded_fields": [
                    "coralogix.metadata.applicationName",
                    "coralogix.metadata.className",
                ],
                "name": "Example remove-fields rule from terraform",
            },
        }],
    }],
    severities=["Warning"],
    subsystems=["subsystem-name"])
#change here for existing subsystems from your account
parse_json_field_example = coralogix.RulesGroup("parseJsonFieldExample",
    applications=["nginx"],
    description="rule_group created by coralogix terraform provider",
    order=2,
    rule_subgroups=[{
        "rules": [{
            "parse_json_field": {
                "description": "rule created by coralogix terraform provider",
                "destination_field": "text",
                "keep_destination_field": True,
                "keep_source_field": True,
                "name": "Example parse-json-field rule from terraform",
                "source_field": "text",
            },
        }],
    }],
    severities=["Warning"],
    subsystems=["subsystem-name"])
#change here for existing subsystems from your account

package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/coralogix/v2/coralogix"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := coralogix.NewRulesGroup(ctx, "rulesGroupExample", &coralogix.RulesGroupArgs{
			Applications: pulumi.StringArray{
				pulumi.String("nginx"),
			},
			Description: pulumi.String("rule_group creates by coralogix terraform provider"),
			Order:       pulumi.Float64(1),
			RuleSubgroups: coralogix.RulesGroupRuleSubgroupArray{
				&coralogix.RulesGroupRuleSubgroupArgs{
					Rules: coralogix.RulesGroupRuleSubgroupRuleArray{
						&coralogix.RulesGroupRuleSubgroupRuleArgs{
							Extract: &coralogix.RulesGroupRuleSubgroupRuleExtractArgs{
								Description:       pulumi.String("Look for default severity text"),
								Name:              pulumi.String("Severity Rule"),
								RegularExpression: pulumi.String("message\\s*:s*(?P<bytes>\\d+)\\s*.*?status\\sis\\s(?P<status>\\[^\"]+)"),
								SourceField:       pulumi.String("text"),
							},
						},
						&coralogix.RulesGroupRuleSubgroupRuleArgs{
							JsonExtract: &coralogix.RulesGroupRuleSubgroupRuleJsonExtractArgs{
								Description:          pulumi.String("Extracts value from 'worker' and populates 'Category'"),
								DestinationField:     pulumi.String("Text"),
								DestinationFieldText: pulumi.String("text.free_text"),
								JsonKey:              pulumi.String("worker"),
								Name:                 pulumi.String("Worker to category"),
							},
						},
						&coralogix.RulesGroupRuleSubgroupRuleArgs{
							Replace: &coralogix.RulesGroupRuleSubgroupRuleReplaceArgs{
								Description:       pulumi.String("Deletes data before Json"),
								DestinationField:  pulumi.String("text"),
								Name:              pulumi.String("Delete prefix"),
								RegularExpression: pulumi.String(".*{"),
								ReplacementString: pulumi.String("{"),
								SourceField:       pulumi.String("text"),
							},
						},
						&coralogix.RulesGroupRuleSubgroupRuleArgs{
							Block: &coralogix.RulesGroupRuleSubgroupRuleBlockArgs{
								Description:       pulumi.String("Block 2800 pg error"),
								Name:              pulumi.String("Block 28000"),
								RegularExpression: pulumi.String("sql_error_code\\s*=\\s*28000"),
								SourceField:       pulumi.String("text"),
							},
						},
					},
				},
				&coralogix.RulesGroupRuleSubgroupArgs{
					Rules: coralogix.RulesGroupRuleSubgroupRuleArray{
						&coralogix.RulesGroupRuleSubgroupRuleArgs{
							Parse: &coralogix.RulesGroupRuleSubgroupRuleParseArgs{
								Description:       pulumi.String("Parse the fields of the HTTP request"),
								DestinationField:  pulumi.String("text"),
								Name:              pulumi.String("HttpRequestParser1"),
								RegularExpression: pulumi.String("(?P<remote_addr>\\d{1,3}.\\d{1,3}.\\d{1,3}.\\d{1,3})\\s*-\\s*(?P<user>[^ ]+)\\s*\\[(?P<timestemp>\\d{4}-\\d{2}\\-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{1,6}Z)\\]\\s*\\\\\\\"(?P<method>[A-z]+)\\s[\\/\\\\]+(?P<request>[^\\s]+)\\s*(?P<protocol>[A-z0-9\\/\\.]+)\\\\\\\"\\s*(?P<status>\\d+)\\s*(?P<body_bytes_sent>\\d+)?\\s*?\\\\\\\"(?P<http_referer>[^\"]+)\\\"\\s*\\\\\\\"(?P<http_user_agent>[^\"]+)\\\"\\s(?P<request_time>\\d{1,6})\\s*(?P<response_time>\\d{1,6})"),
								SourceField:       pulumi.String("text"),
							},
						},
						&coralogix.RulesGroupRuleSubgroupRuleArgs{
							Parse: &coralogix.RulesGroupRuleSubgroupRuleParseArgs{
								Description:       pulumi.String("Parse the fields of the HTTP request - will be applied after HttpRequestParser1"),
								DestinationField:  pulumi.String("text"),
								Name:              pulumi.String("HttpRequestParser2"),
								RegularExpression: pulumi.String("(?P<remote_addr>\\d{1,3}.\\d{1,3}.\\d{1,3}.\\d{1,3})\\s*-\\s*(?P<user>[^ ]+)\\s*\\[(?P<timestemp>\\d{4}-\\d{2}\\-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{1,6}Z)\\]\\s*\\\\\\\"(?P<method>[A-z]+)\\s[\\/\\\\]+(?P<request>[^\\s]+)\\s*(?P<protocol>[A-z0-9\\/\\.]+)\\\\\\\"\\s*(?P<status>\\d+)\\s*(?P<body_bytes_sent>\\d+)?\\s*?\\\\\\\"(?P<http_referer>[^\"]+)\\\"\\s*\\\\\\\"(?P<http_user_agent>[^\"]+)\\\"\\s(?P<request_time>\\d{1,6})\\s*(?P<response_time>\\d{1,6})"),
								SourceField:       pulumi.String("text"),
							},
						},
						&coralogix.RulesGroupRuleSubgroupRuleArgs{
							JsonStringify: &coralogix.RulesGroupRuleSubgroupRuleJsonStringifyArgs{
								DestinationField: pulumi.String("text"),
								KeepSourceField:  pulumi.Bool(false),
								Name:             pulumi.String("json_stringify rule"),
								SourceField:      pulumi.String("text"),
							},
						},
					},
				},
			},
			Severities: pulumi.StringArray{
				pulumi.String("Warning"),
			},
			Subsystems: pulumi.StringArray{
				pulumi.String("subsystem-name"),
			},
		})
		if err != nil {
			return err
		}
		_, err = coralogix.NewRulesGroup(ctx, "extractTimestampExample", &coralogix.RulesGroupArgs{
			Applications: pulumi.StringArray{
				pulumi.String("nginx"),
			},
			Description: pulumi.String("rule_group created by coralogix terraform provider"),
			Order:       pulumi.Float64(4),
			RuleSubgroups: coralogix.RulesGroupRuleSubgroupArray{
				&coralogix.RulesGroupRuleSubgroupArgs{
					Rules: coralogix.RulesGroupRuleSubgroupRuleArray{
						&coralogix.RulesGroupRuleSubgroupRuleArgs{
							ExtractTimestamp: &coralogix.RulesGroupRuleSubgroupRuleExtractTimestampArgs{
								Description:         pulumi.String("rule created by coralogix terraform provider"),
								FieldFormatStandard: pulumi.String("Strftime"),
								Name:                pulumi.String("example extract-timestamp rule from terraform"),
								SourceField:         pulumi.String("text"),
								TimeFormat:          pulumi.String("%Y-%m-%dT%H:%M:%S.%f%z"),
							},
						},
					},
				},
			},
			Severities: pulumi.StringArray{
				pulumi.String("Warning"),
			},
			Subsystems: pulumi.StringArray{
				pulumi.String("subsystem-name"),
			},
		})
		if err != nil {
			return err
		}
		_, err = coralogix.NewRulesGroup(ctx, "removeFieldsExample", &coralogix.RulesGroupArgs{
			Applications: pulumi.StringArray{
				pulumi.String("nginx"),
			},
			Description: pulumi.String("rule_group created by coralogix terraform provider"),
			Order:       pulumi.Float64(3),
			RuleSubgroups: coralogix.RulesGroupRuleSubgroupArray{
				&coralogix.RulesGroupRuleSubgroupArgs{
					Rules: coralogix.RulesGroupRuleSubgroupRuleArray{
						&coralogix.RulesGroupRuleSubgroupRuleArgs{
							RemoveFields: &coralogix.RulesGroupRuleSubgroupRuleRemoveFieldsArgs{
								Description: pulumi.String("rule created by coralogix terraform provider"),
								ExcludedFields: pulumi.StringArray{
									pulumi.String("coralogix.metadata.applicationName"),
									pulumi.String("coralogix.metadata.className"),
								},
								Name: pulumi.String("Example remove-fields rule from terraform"),
							},
						},
					},
				},
			},
			Severities: pulumi.StringArray{
				pulumi.String("Warning"),
			},
			Subsystems: pulumi.StringArray{
				pulumi.String("subsystem-name"),
			},
		})
		if err != nil {
			return err
		}
		_, err = coralogix.NewRulesGroup(ctx, "parseJsonFieldExample", &coralogix.RulesGroupArgs{
			Applications: pulumi.StringArray{
				pulumi.String("nginx"),
			},
			Description: pulumi.String("rule_group created by coralogix terraform provider"),
			Order:       pulumi.Float64(2),
			RuleSubgroups: coralogix.RulesGroupRuleSubgroupArray{
				&coralogix.RulesGroupRuleSubgroupArgs{
					Rules: coralogix.RulesGroupRuleSubgroupRuleArray{
						&coralogix.RulesGroupRuleSubgroupRuleArgs{
							ParseJsonField: &coralogix.RulesGroupRuleSubgroupRuleParseJsonFieldArgs{
								Description:          pulumi.String("rule created by coralogix terraform provider"),
								DestinationField:     pulumi.String("text"),
								KeepDestinationField: pulumi.Bool(true),
								KeepSourceField:      pulumi.Bool(true),
								Name:                 pulumi.String("Example parse-json-field rule from terraform"),
								SourceField:          pulumi.String("text"),
							},
						},
					},
				},
			},
			Severities: pulumi.StringArray{
				pulumi.String("Warning"),
			},
			Subsystems: pulumi.StringArray{
				pulumi.String("subsystem-name"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Coralogix = Pulumi.Coralogix;

return await Deployment.RunAsync(() => 
{
    var rulesGroupExample = new Coralogix.RulesGroup("rulesGroupExample", new()
    {
        Applications = new[]
        {
            "nginx",
        },
        Description = "rule_group creates by coralogix terraform provider",
        Order = 1,
        RuleSubgroups = new[]
        {
            new Coralogix.Inputs.RulesGroupRuleSubgroupArgs
            {
                Rules = new[]
                {
                    new Coralogix.Inputs.RulesGroupRuleSubgroupRuleArgs
                    {
                        Extract = new Coralogix.Inputs.RulesGroupRuleSubgroupRuleExtractArgs
                        {
                            Description = "Look for default severity text",
                            Name = "Severity Rule",
                            RegularExpression = "message\\s*:s*(?P<bytes>\\d+)\\s*.*?status\\sis\\s(?P<status>\\[^\"]+)",
                            SourceField = "text",
                        },
                    },
                    new Coralogix.Inputs.RulesGroupRuleSubgroupRuleArgs
                    {
                        JsonExtract = new Coralogix.Inputs.RulesGroupRuleSubgroupRuleJsonExtractArgs
                        {
                            Description = "Extracts value from 'worker' and populates 'Category'",
                            DestinationField = "Text",
                            DestinationFieldText = "text.free_text",
                            JsonKey = "worker",
                            Name = "Worker to category",
                        },
                    },
                    new Coralogix.Inputs.RulesGroupRuleSubgroupRuleArgs
                    {
                        Replace = new Coralogix.Inputs.RulesGroupRuleSubgroupRuleReplaceArgs
                        {
                            Description = "Deletes data before Json",
                            DestinationField = "text",
                            Name = "Delete prefix",
                            RegularExpression = ".*{",
                            ReplacementString = "{",
                            SourceField = "text",
                        },
                    },
                    new Coralogix.Inputs.RulesGroupRuleSubgroupRuleArgs
                    {
                        Block = new Coralogix.Inputs.RulesGroupRuleSubgroupRuleBlockArgs
                        {
                            Description = "Block 2800 pg error",
                            Name = "Block 28000",
                            RegularExpression = "sql_error_code\\s*=\\s*28000",
                            SourceField = "text",
                        },
                    },
                },
            },
            new Coralogix.Inputs.RulesGroupRuleSubgroupArgs
            {
                Rules = new[]
                {
                    new Coralogix.Inputs.RulesGroupRuleSubgroupRuleArgs
                    {
                        Parse = new Coralogix.Inputs.RulesGroupRuleSubgroupRuleParseArgs
                        {
                            Description = "Parse the fields of the HTTP request",
                            DestinationField = "text",
                            Name = "HttpRequestParser1",
                            RegularExpression = "(?P<remote_addr>\\d{1,3}.\\d{1,3}.\\d{1,3}.\\d{1,3})\\s*-\\s*(?P<user>[^ ]+)\\s*\\[(?P<timestemp>\\d{4}-\\d{2}\\-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{1,6}Z)\\]\\s*\\\\\\\"(?P<method>[A-z]+)\\s[\\/\\\\]+(?P<request>[^\\s]+)\\s*(?P<protocol>[A-z0-9\\/\\.]+)\\\\\\\"\\s*(?P<status>\\d+)\\s*(?P<body_bytes_sent>\\d+)?\\s*?\\\\\\\"(?P<http_referer>[^\"]+)\\\"\\s*\\\\\\\"(?P<http_user_agent>[^\"]+)\\\"\\s(?P<request_time>\\d{1,6})\\s*(?P<response_time>\\d{1,6})",
                            SourceField = "text",
                        },
                    },
                    new Coralogix.Inputs.RulesGroupRuleSubgroupRuleArgs
                    {
                        Parse = new Coralogix.Inputs.RulesGroupRuleSubgroupRuleParseArgs
                        {
                            Description = "Parse the fields of the HTTP request - will be applied after HttpRequestParser1",
                            DestinationField = "text",
                            Name = "HttpRequestParser2",
                            RegularExpression = "(?P<remote_addr>\\d{1,3}.\\d{1,3}.\\d{1,3}.\\d{1,3})\\s*-\\s*(?P<user>[^ ]+)\\s*\\[(?P<timestemp>\\d{4}-\\d{2}\\-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{1,6}Z)\\]\\s*\\\\\\\"(?P<method>[A-z]+)\\s[\\/\\\\]+(?P<request>[^\\s]+)\\s*(?P<protocol>[A-z0-9\\/\\.]+)\\\\\\\"\\s*(?P<status>\\d+)\\s*(?P<body_bytes_sent>\\d+)?\\s*?\\\\\\\"(?P<http_referer>[^\"]+)\\\"\\s*\\\\\\\"(?P<http_user_agent>[^\"]+)\\\"\\s(?P<request_time>\\d{1,6})\\s*(?P<response_time>\\d{1,6})",
                            SourceField = "text",
                        },
                    },
                    new Coralogix.Inputs.RulesGroupRuleSubgroupRuleArgs
                    {
                        JsonStringify = new Coralogix.Inputs.RulesGroupRuleSubgroupRuleJsonStringifyArgs
                        {
                            DestinationField = "text",
                            KeepSourceField = false,
                            Name = "json_stringify rule",
                            SourceField = "text",
                        },
                    },
                },
            },
        },
        Severities = new[]
        {
            "Warning",
        },
        Subsystems = new[]
        {
            "subsystem-name",
        },
    });

    //change here for existing subsystems from your account
    var extractTimestampExample = new Coralogix.RulesGroup("extractTimestampExample", new()
    {
        Applications = new[]
        {
            "nginx",
        },
        Description = "rule_group created by coralogix terraform provider",
        Order = 4,
        RuleSubgroups = new[]
        {
            new Coralogix.Inputs.RulesGroupRuleSubgroupArgs
            {
                Rules = new[]
                {
                    new Coralogix.Inputs.RulesGroupRuleSubgroupRuleArgs
                    {
                        ExtractTimestamp = new Coralogix.Inputs.RulesGroupRuleSubgroupRuleExtractTimestampArgs
                        {
                            Description = "rule created by coralogix terraform provider",
                            FieldFormatStandard = "Strftime",
                            Name = "example extract-timestamp rule from terraform",
                            SourceField = "text",
                            TimeFormat = "%Y-%m-%dT%H:%M:%S.%f%z",
                        },
                    },
                },
            },
        },
        Severities = new[]
        {
            "Warning",
        },
        Subsystems = new[]
        {
            "subsystem-name",
        },
    });

    //change here for existing subsystems from your account
    var removeFieldsExample = new Coralogix.RulesGroup("removeFieldsExample", new()
    {
        Applications = new[]
        {
            "nginx",
        },
        Description = "rule_group created by coralogix terraform provider",
        Order = 3,
        RuleSubgroups = new[]
        {
            new Coralogix.Inputs.RulesGroupRuleSubgroupArgs
            {
                Rules = new[]
                {
                    new Coralogix.Inputs.RulesGroupRuleSubgroupRuleArgs
                    {
                        RemoveFields = new Coralogix.Inputs.RulesGroupRuleSubgroupRuleRemoveFieldsArgs
                        {
                            Description = "rule created by coralogix terraform provider",
                            ExcludedFields = new[]
                            {
                                "coralogix.metadata.applicationName",
                                "coralogix.metadata.className",
                            },
                            Name = "Example remove-fields rule from terraform",
                        },
                    },
                },
            },
        },
        Severities = new[]
        {
            "Warning",
        },
        Subsystems = new[]
        {
            "subsystem-name",
        },
    });

    //change here for existing subsystems from your account
    var parseJsonFieldExample = new Coralogix.RulesGroup("parseJsonFieldExample", new()
    {
        Applications = new[]
        {
            "nginx",
        },
        Description = "rule_group created by coralogix terraform provider",
        Order = 2,
        RuleSubgroups = new[]
        {
            new Coralogix.Inputs.RulesGroupRuleSubgroupArgs
            {
                Rules = new[]
                {
                    new Coralogix.Inputs.RulesGroupRuleSubgroupRuleArgs
                    {
                        ParseJsonField = new Coralogix.Inputs.RulesGroupRuleSubgroupRuleParseJsonFieldArgs
                        {
                            Description = "rule created by coralogix terraform provider",
                            DestinationField = "text",
                            KeepDestinationField = true,
                            KeepSourceField = true,
                            Name = "Example parse-json-field rule from terraform",
                            SourceField = "text",
                        },
                    },
                },
            },
        },
        Severities = new[]
        {
            "Warning",
        },
        Subsystems = new[]
        {
            "subsystem-name",
        },
    });

    //change here for existing subsystems from your account
});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.coralogix.RulesGroup;
import com.pulumi.coralogix.RulesGroupArgs;
import com.pulumi.coralogix.inputs.RulesGroupRuleSubgroupArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var rulesGroupExample = new RulesGroup("rulesGroupExample", RulesGroupArgs.builder()
            .applications("nginx")
            .description("rule_group creates by coralogix terraform provider")
            .order(1)
            .ruleSubgroups(            
                RulesGroupRuleSubgroupArgs.builder()
                    .rules(                    
                        RulesGroupRuleSubgroupRuleArgs.builder()
                            .extract(RulesGroupRuleSubgroupRuleExtractArgs.builder()
                                .description("Look for default severity text")
                                .name("Severity Rule")
                                .regularExpression("message\\s*:s*(?P<bytes>\\d+)\\s*.*?status\\sis\\s(?P<status>\\[^\"]+)")
                                .sourceField("text")
                                .build())
                            .build(),
                        RulesGroupRuleSubgroupRuleArgs.builder()
                            .jsonExtract(RulesGroupRuleSubgroupRuleJsonExtractArgs.builder()
                                .description("Extracts value from 'worker' and populates 'Category'")
                                .destinationField("Text")
                                .destinationFieldText("text.free_text")
                                .jsonKey("worker")
                                .name("Worker to category")
                                .build())
                            .build(),
                        RulesGroupRuleSubgroupRuleArgs.builder()
                            .replace(RulesGroupRuleSubgroupRuleReplaceArgs.builder()
                                .description("Deletes data before Json")
                                .destinationField("text")
                                .name("Delete prefix")
                                .regularExpression(".*{")
                                .replacementString("{")
                                .sourceField("text")
                                .build())
                            .build(),
                        RulesGroupRuleSubgroupRuleArgs.builder()
                            .block(RulesGroupRuleSubgroupRuleBlockArgs.builder()
                                .description("Block 2800 pg error")
                                .name("Block 28000")
                                .regularExpression("sql_error_code\\s*=\\s*28000")
                                .sourceField("text")
                                .build())
                            .build())
                    .build(),
                RulesGroupRuleSubgroupArgs.builder()
                    .rules(                    
                        RulesGroupRuleSubgroupRuleArgs.builder()
                            .parse(RulesGroupRuleSubgroupRuleParseArgs.builder()
                                .description("Parse the fields of the HTTP request")
                                .destinationField("text")
                                .name("HttpRequestParser1")
                                .regularExpression("(?P<remote_addr>\\d{1,3}.\\d{1,3}.\\d{1,3}.\\d{1,3})\\s*-\\s*(?P<user>[^ ]+)\\s*\\[(?P<timestemp>\\d{4}-\\d{2}\\-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{1,6}Z)\\]\\s*\\\\\\\"(?P<method>[A-z]+)\\s[\\/\\\\]+(?P<request>[^\\s]+)\\s*(?P<protocol>[A-z0-9\\/\\.]+)\\\\\\\"\\s*(?P<status>\\d+)\\s*(?P<body_bytes_sent>\\d+)?\\s*?\\\\\\\"(?P<http_referer>[^\"]+)\\\"\\s*\\\\\\\"(?P<http_user_agent>[^\"]+)\\\"\\s(?P<request_time>\\d{1,6})\\s*(?P<response_time>\\d{1,6})")
                                .sourceField("text")
                                .build())
                            .build(),
                        RulesGroupRuleSubgroupRuleArgs.builder()
                            .parse(RulesGroupRuleSubgroupRuleParseArgs.builder()
                                .description("Parse the fields of the HTTP request - will be applied after HttpRequestParser1")
                                .destinationField("text")
                                .name("HttpRequestParser2")
                                .regularExpression("(?P<remote_addr>\\d{1,3}.\\d{1,3}.\\d{1,3}.\\d{1,3})\\s*-\\s*(?P<user>[^ ]+)\\s*\\[(?P<timestemp>\\d{4}-\\d{2}\\-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{1,6}Z)\\]\\s*\\\\\\\"(?P<method>[A-z]+)\\s[\\/\\\\]+(?P<request>[^\\s]+)\\s*(?P<protocol>[A-z0-9\\/\\.]+)\\\\\\\"\\s*(?P<status>\\d+)\\s*(?P<body_bytes_sent>\\d+)?\\s*?\\\\\\\"(?P<http_referer>[^\"]+)\\\"\\s*\\\\\\\"(?P<http_user_agent>[^\"]+)\\\"\\s(?P<request_time>\\d{1,6})\\s*(?P<response_time>\\d{1,6})")
                                .sourceField("text")
                                .build())
                            .build(),
                        RulesGroupRuleSubgroupRuleArgs.builder()
                            .jsonStringify(RulesGroupRuleSubgroupRuleJsonStringifyArgs.builder()
                                .destinationField("text")
                                .keepSourceField("false")
                                .name("json_stringify rule")
                                .sourceField("text")
                                .build())
                            .build())
                    .build())
            .severities("Warning")
            .subsystems("subsystem-name")
            .build());

        //change here for existing subsystems from your account
        var extractTimestampExample = new RulesGroup("extractTimestampExample", RulesGroupArgs.builder()
            .applications("nginx")
            .description("rule_group created by coralogix terraform provider")
            .order(4)
            .ruleSubgroups(RulesGroupRuleSubgroupArgs.builder()
                .rules(RulesGroupRuleSubgroupRuleArgs.builder()
                    .extractTimestamp(RulesGroupRuleSubgroupRuleExtractTimestampArgs.builder()
                        .description("rule created by coralogix terraform provider")
                        .fieldFormatStandard("Strftime")
                        .name("example extract-timestamp rule from terraform")
                        .sourceField("text")
                        .timeFormat("%Y-%m-%dT%H:%M:%S.%f%z")
                        .build())
                    .build())
                .build())
            .severities("Warning")
            .subsystems("subsystem-name")
            .build());

        //change here for existing subsystems from your account
        var removeFieldsExample = new RulesGroup("removeFieldsExample", RulesGroupArgs.builder()
            .applications("nginx")
            .description("rule_group created by coralogix terraform provider")
            .order(3)
            .ruleSubgroups(RulesGroupRuleSubgroupArgs.builder()
                .rules(RulesGroupRuleSubgroupRuleArgs.builder()
                    .removeFields(RulesGroupRuleSubgroupRuleRemoveFieldsArgs.builder()
                        .description("rule created by coralogix terraform provider")
                        .excludedFields(                        
                            "coralogix.metadata.applicationName",
                            "coralogix.metadata.className")
                        .name("Example remove-fields rule from terraform")
                        .build())
                    .build())
                .build())
            .severities("Warning")
            .subsystems("subsystem-name")
            .build());

        //change here for existing subsystems from your account
        var parseJsonFieldExample = new RulesGroup("parseJsonFieldExample", RulesGroupArgs.builder()
            .applications("nginx")
            .description("rule_group created by coralogix terraform provider")
            .order(2)
            .ruleSubgroups(RulesGroupRuleSubgroupArgs.builder()
                .rules(RulesGroupRuleSubgroupRuleArgs.builder()
                    .parseJsonField(RulesGroupRuleSubgroupRuleParseJsonFieldArgs.builder()
                        .description("rule created by coralogix terraform provider")
                        .destinationField("text")
                        .keepDestinationField("true")
                        .keepSourceField("true")
                        .name("Example parse-json-field rule from terraform")
                        .sourceField("text")
                        .build())
                    .build())
                .build())
            .severities("Warning")
            .subsystems("subsystem-name")
            .build());

        //change here for existing subsystems from your account
    }
}

resources:
  rulesGroupExample:
    type: coralogix:RulesGroup
    properties:
      applications:
        - nginx
      # change here for existing applications from your account
      description: rule_group creates by coralogix terraform provider
      order: 1
      ruleSubgroups:
        - rules:
            - extract:
                description: Look for default severity text
                name: Severity Rule
                regularExpression: message\s*:s*(?P<bytes>\d+)\s*.*?status\sis\s(?P<status>\[^"]+)
                sourceField: text
            - jsonExtract:
                description: Extracts value from 'worker' and populates 'Category'
                destinationField: Text
                destinationFieldText: text.free_text
                jsonKey: worker
                name: Worker to category
            - replace:
                description: Deletes data before Json
                destinationField: text
                name: Delete prefix
                regularExpression: .*{
                replacementString: '{'
                sourceField: text
            - block:
                description: Block 2800 pg error
                name: Block 28000
                regularExpression: sql_error_code\s*=\s*28000
                sourceField: text
        - rules:
            - parse:
                description: Parse the fields of the HTTP request
                destinationField: text
                name: HttpRequestParser1
                regularExpression: (?P<remote_addr>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})\s*-\s*(?P<user>[^ ]+)\s*\[(?P<timestemp>\d{4}-\d{2}\-\d{2}T\d{2}\:\d{2}\:\d{2}\.\d{1,6}Z)\]\s*\\\"(?P<method>[A-z]+)\s[\/\\]+(?P<request>[^\s]+)\s*(?P<protocol>[A-z0-9\/\.]+)\\\"\s*(?P<status>\d+)\s*(?P<body_bytes_sent>\d+)?\s*?\\\"(?P<http_referer>[^"]+)\"\s*\\\"(?P<http_user_agent>[^"]+)\"\s(?P<request_time>\d{1,6})\s*(?P<response_time>\d{1,6})
                sourceField: text
            - parse:
                description: Parse the fields of the HTTP request - will be applied after HttpRequestParser1
                destinationField: text
                name: HttpRequestParser2
                regularExpression: (?P<remote_addr>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})\s*-\s*(?P<user>[^ ]+)\s*\[(?P<timestemp>\d{4}-\d{2}\-\d{2}T\d{2}\:\d{2}\:\d{2}\.\d{1,6}Z)\]\s*\\\"(?P<method>[A-z]+)\s[\/\\]+(?P<request>[^\s]+)\s*(?P<protocol>[A-z0-9\/\.]+)\\\"\s*(?P<status>\d+)\s*(?P<body_bytes_sent>\d+)?\s*?\\\"(?P<http_referer>[^"]+)\"\s*\\\"(?P<http_user_agent>[^"]+)\"\s(?P<request_time>\d{1,6})\s*(?P<response_time>\d{1,6})
                sourceField: text
            - jsonStringify:
                destinationField: text
                keepSourceField: 'false'
                name: json_stringify rule
                sourceField: text
      severities:
        - Warning
      subsystems:
        - subsystem-name
  extractTimestampExample:
    type: coralogix:RulesGroup
    properties:
      applications:
        - nginx
      # change here for existing applications from your account
      description: rule_group created by coralogix terraform provider
      order: 4
      ruleSubgroups:
        - rules:
            - extractTimestamp:
                description: rule created by coralogix terraform provider
                fieldFormatStandard: Strftime
                name: example extract-timestamp rule from terraform
                sourceField: text
                timeFormat: '%Y-%m-%dT%H:%M:%S.%f%z'
      severities:
        - Warning
      subsystems:
        - subsystem-name
  removeFieldsExample:
    type: coralogix:RulesGroup
    properties:
      applications:
        - nginx
      # change here for existing applications from your account
      description: rule_group created by coralogix terraform provider
      order: 3
      ruleSubgroups:
        - rules:
            - removeFields:
                description: rule created by coralogix terraform provider
                excludedFields:
                  - coralogix.metadata.applicationName
                  - coralogix.metadata.className
                name: Example remove-fields rule from terraform
      severities:
        - Warning
      subsystems:
        - subsystem-name
  parseJsonFieldExample:
    type: coralogix:RulesGroup
    properties:
      applications:
        - nginx
      # change here for existing applications from your account
      description: rule_group created by coralogix terraform provider
      order: 2
      ruleSubgroups:
        - rules:
            - parseJsonField:
                description: rule created by coralogix terraform provider
                destinationField: text
                keepDestinationField: 'true'
                keepSourceField: 'true'
                name: Example parse-json-field rule from terraform
                sourceField: text
      severities:
        - Warning
      subsystems:
        - subsystem-name

var rulesGroupResource = new Coralogix.RulesGroup("rulesGroupResource", new()
{
    Active = false,
    Applications = new[]
    {
        "string",
    },
    Creator = "string",
    Description = "string",
    Hidden = false,
    Name = "string",
    Order = 0,
    RuleSubgroups = new[]
    {
        new Coralogix.Inputs.RulesGroupRuleSubgroupArgs
        {
            Rules = new[]
            {
                new Coralogix.Inputs.RulesGroupRuleSubgroupRuleArgs
                {
                    Block = new Coralogix.Inputs.RulesGroupRuleSubgroupRuleBlockArgs
                    {
                        Name = "string",
                        RegularExpression = "string",
                        SourceField = "string",
                        Active = false,
                        BlockingAllMatchingBlocks = false,
                        Description = "string",
                        Id = "string",
                        KeepBlockedLogs = false,
                        Order = 0,
                    },
                    Extract = new Coralogix.Inputs.RulesGroupRuleSubgroupRuleExtractArgs
                    {
                        Name = "string",
                        RegularExpression = "string",
                        SourceField = "string",
                        Active = false,
                        Description = "string",
                        Id = "string",
                        Order = 0,
                    },
                    ExtractTimestamp = new Coralogix.Inputs.RulesGroupRuleSubgroupRuleExtractTimestampArgs
                    {
                        FieldFormatStandard = "string",
                        Name = "string",
                        SourceField = "string",
                        TimeFormat = "string",
                        Active = false,
                        Description = "string",
                        Id = "string",
                        Order = 0,
                    },
                    JsonExtract = new Coralogix.Inputs.RulesGroupRuleSubgroupRuleJsonExtractArgs
                    {
                        DestinationField = "string",
                        JsonKey = "string",
                        Name = "string",
                        Active = false,
                        Description = "string",
                        DestinationFieldText = "string",
                        Id = "string",
                        Order = 0,
                    },
                    JsonStringify = new Coralogix.Inputs.RulesGroupRuleSubgroupRuleJsonStringifyArgs
                    {
                        DestinationField = "string",
                        Name = "string",
                        SourceField = "string",
                        Active = false,
                        Description = "string",
                        Id = "string",
                        KeepSourceField = false,
                        Order = 0,
                    },
                    Parse = new Coralogix.Inputs.RulesGroupRuleSubgroupRuleParseArgs
                    {
                        DestinationField = "string",
                        Name = "string",
                        RegularExpression = "string",
                        SourceField = "string",
                        Active = false,
                        Description = "string",
                        Id = "string",
                        Order = 0,
                    },
                    ParseJsonField = new Coralogix.Inputs.RulesGroupRuleSubgroupRuleParseJsonFieldArgs
                    {
                        DestinationField = "string",
                        Name = "string",
                        SourceField = "string",
                        Active = false,
                        Description = "string",
                        Id = "string",
                        KeepDestinationField = false,
                        KeepSourceField = false,
                        Order = 0,
                    },
                    RemoveFields = new Coralogix.Inputs.RulesGroupRuleSubgroupRuleRemoveFieldsArgs
                    {
                        ExcludedFields = new[]
                        {
                            "string",
                        },
                        Name = "string",
                        Active = false,
                        Description = "string",
                        Id = "string",
                        Order = 0,
                    },
                    Replace = new Coralogix.Inputs.RulesGroupRuleSubgroupRuleReplaceArgs
                    {
                        DestinationField = "string",
                        Name = "string",
                        RegularExpression = "string",
                        SourceField = "string",
                        Active = false,
                        Description = "string",
                        Id = "string",
                        Order = 0,
                        ReplacementString = "string",
                    },
                },
            },
            Active = false,
            Id = "string",
            Order = 0,
        },
    },
    RulesGroupId = "string",
    Severities = new[]
    {
        "string",
    },
    Subsystems = new[]
    {
        "string",
    },
    Timeouts = new Coralogix.Inputs.RulesGroupTimeoutsArgs
    {
        Create = "string",
        Delete = "string",
        Read = "string",
        Update = "string",
    },
});

example, err := coralogix.NewRulesGroup(ctx, "rulesGroupResource", &coralogix.RulesGroupArgs{
	Active: pulumi.Bool(false),
	Applications: pulumi.StringArray{
		pulumi.String("string"),
	},
	Creator:     pulumi.String("string"),
	Description: pulumi.String("string"),
	Hidden:      pulumi.Bool(false),
	Name:        pulumi.String("string"),
	Order:       pulumi.Float64(0),
	RuleSubgroups: coralogix.RulesGroupRuleSubgroupArray{
		&coralogix.RulesGroupRuleSubgroupArgs{
			Rules: coralogix.RulesGroupRuleSubgroupRuleArray{
				&coralogix.RulesGroupRuleSubgroupRuleArgs{
					Block: &coralogix.RulesGroupRuleSubgroupRuleBlockArgs{
						Name:                      pulumi.String("string"),
						RegularExpression:         pulumi.String("string"),
						SourceField:               pulumi.String("string"),
						Active:                    pulumi.Bool(false),
						BlockingAllMatchingBlocks: pulumi.Bool(false),
						Description:               pulumi.String("string"),
						Id:                        pulumi.String("string"),
						KeepBlockedLogs:           pulumi.Bool(false),
						Order:                     pulumi.Float64(0),
					},
					Extract: &coralogix.RulesGroupRuleSubgroupRuleExtractArgs{
						Name:              pulumi.String("string"),
						RegularExpression: pulumi.String("string"),
						SourceField:       pulumi.String("string"),
						Active:            pulumi.Bool(false),
						Description:       pulumi.String("string"),
						Id:                pulumi.String("string"),
						Order:             pulumi.Float64(0),
					},
					ExtractTimestamp: &coralogix.RulesGroupRuleSubgroupRuleExtractTimestampArgs{
						FieldFormatStandard: pulumi.String("string"),
						Name:                pulumi.String("string"),
						SourceField:         pulumi.String("string"),
						TimeFormat:          pulumi.String("string"),
						Active:              pulumi.Bool(false),
						Description:         pulumi.String("string"),
						Id:                  pulumi.String("string"),
						Order:               pulumi.Float64(0),
					},
					JsonExtract: &coralogix.RulesGroupRuleSubgroupRuleJsonExtractArgs{
						DestinationField:     pulumi.String("string"),
						JsonKey:              pulumi.String("string"),
						Name:                 pulumi.String("string"),
						Active:               pulumi.Bool(false),
						Description:          pulumi.String("string"),
						DestinationFieldText: pulumi.String("string"),
						Id:                   pulumi.String("string"),
						Order:                pulumi.Float64(0),
					},
					JsonStringify: &coralogix.RulesGroupRuleSubgroupRuleJsonStringifyArgs{
						DestinationField: pulumi.String("string"),
						Name:             pulumi.String("string"),
						SourceField:      pulumi.String("string"),
						Active:           pulumi.Bool(false),
						Description:      pulumi.String("string"),
						Id:               pulumi.String("string"),
						KeepSourceField:  pulumi.Bool(false),
						Order:            pulumi.Float64(0),
					},
					Parse: &coralogix.RulesGroupRuleSubgroupRuleParseArgs{
						DestinationField:  pulumi.String("string"),
						Name:              pulumi.String("string"),
						RegularExpression: pulumi.String("string"),
						SourceField:       pulumi.String("string"),
						Active:            pulumi.Bool(false),
						Description:       pulumi.String("string"),
						Id:                pulumi.String("string"),
						Order:             pulumi.Float64(0),
					},
					ParseJsonField: &coralogix.RulesGroupRuleSubgroupRuleParseJsonFieldArgs{
						DestinationField:     pulumi.String("string"),
						Name:                 pulumi.String("string"),
						SourceField:          pulumi.String("string"),
						Active:               pulumi.Bool(false),
						Description:          pulumi.String("string"),
						Id:                   pulumi.String("string"),
						KeepDestinationField: pulumi.Bool(false),
						KeepSourceField:      pulumi.Bool(false),
						Order:                pulumi.Float64(0),
					},
					RemoveFields: &coralogix.RulesGroupRuleSubgroupRuleRemoveFieldsArgs{
						ExcludedFields: pulumi.StringArray{
							pulumi.String("string"),
						},
						Name:        pulumi.String("string"),
						Active:      pulumi.Bool(false),
						Description: pulumi.String("string"),
						Id:          pulumi.String("string"),
						Order:       pulumi.Float64(0),
					},
					Replace: &coralogix.RulesGroupRuleSubgroupRuleReplaceArgs{
						DestinationField:  pulumi.String("string"),
						Name:              pulumi.String("string"),
						RegularExpression: pulumi.String("string"),
						SourceField:       pulumi.String("string"),
						Active:            pulumi.Bool(false),
						Description:       pulumi.String("string"),
						Id:                pulumi.String("string"),
						Order:             pulumi.Float64(0),
						ReplacementString: pulumi.String("string"),
					},
				},
			},
			Active: pulumi.Bool(false),
			Id:     pulumi.String("string"),
			Order:  pulumi.Float64(0),
		},
	},
	RulesGroupId: pulumi.String("string"),
	Severities: pulumi.StringArray{
		pulumi.String("string"),
	},
	Subsystems: pulumi.StringArray{
		pulumi.String("string"),
	},
	Timeouts: &coralogix.RulesGroupTimeoutsArgs{
		Create: pulumi.String("string"),
		Delete: pulumi.String("string"),
		Read:   pulumi.String("string"),
		Update: pulumi.String("string"),
	},
})