On This Page

Home / Stream/ Reference/ Config Files/samples.yml

samples.yml

samples.yml contains metadata about about stored sample data files (size, number of events, date created, name, and so on).

samples.yml
sample_id: # [object]
  sampleName: # [string, required] File name - Name of the sample data file with extension
  description: # [string] Description - Brief description of this sample file
  ttl: # [number] Expiration (hours) - Time to live (TTL) for the sample; reset after each use. Leave empty to never expire
  tags: # [string] Tags - One or more tags related to this sample file
  created: # [number] Created timestamp - Unix timestamp when sample was created (milliseconds)
  modified: # [number] Modified timestamp - Unix timestamp when sample was last modified (milliseconds)  
  packId: # [string] Pack ID - Pack identifier if sample belongs to a specific pack
  isPackOnly: # [boolean] Pack only flag - Whether sample is only available within a pack context
  lib: # [string] Library - Library or collection name for organizational purposes
  size: # [number] Size - File size in bytes
  numEvents: # [number] Event count - Number of events contained in the sample
  isTemplate: # [boolean] Template flag - Whether this sample serves as a template
  tsTemplateField: # [string] Timestamp template field - Field name to use for timestamp extraction in templates
  context: # [object] Context information - Additional context for the sample
    id: # [string] Context ID - Identifier for the context
    pipelineId: # [string] Context pipeline ID - Associated pipeline for this context
    events: # [array] Context events - Array of events for context

The corresponding sample files reside in $CRIBL_HOME/data/samples.