• /
  • EnglishEspañolFrançais日本語한국어Português
  • Log inStart now

New Relic log configuration actions

|View as Markdown

This page provides a reference for New Relic log configuration actions available in the workflow automation actions catalog. Use these actions to query log configuration resources — parsing rules, data partition rules, obfuscation expressions and rules, and pipeline settings — and perform operations like validating Grok patterns and updating pipeline configuration, directly from a workflow definition.

Prerequisites

Before using New Relic log configuration actions in workflow automation, ensure you have:

  • A New Relic account with appropriate permissions to access log management configuration.
  • The account ID for each account whose log configuration you want to query or update.

List parsing rules

The action identifier is newrelic.logConfigurations.listParsingRules.

Returns all log parsing rules configured for an account.

The following table describes all available input fields for this action.

Input

Type

Description

Example

accountId

Integer

Required. The New Relic account to list parsing rules for. Must be a positive integer.

123456

selectors

List

Optional. JQ selectors to extract specific fields from the action output.

[{"name": "parsingRules", "expression": ".data.actor.account.logConfigurations.parsingRules"}]

The following table describes all output fields returned by this action.

Output

Type

Example

success

Boolean

true when the step executed without error.

errorMessage

String

Populated only if the call fails at the HTTP/transport level. null on success.

data

Object

{
  "data": {
    "actor": {
      "account": {
        "logConfigurations": {
          "parsingRules": [
            {
              "id": "123",
              "accountId": 123456,
              "description": "Parse nginx access logs",
              "enabled": true,
              "grok": "%{IP:clientip} %{WORD:method} %{URIPATHPARAM:request}",
              "lucene": "logtype:nginx",
              "nrql": "SELECT * FROM Log WHERE logtype = 'nginx'",
              "attribute": "message",
              "deleted": false,
              "source": "USER",
              "updatedAt": "2026-08-01T12:00:00Z"
            }
          ]
        }
      }
    }
  }
}

source is a non-null enum: USER or BUILT_IN. updatedAt is nullable.

Workflow example

name: list_log_parsing_rules
description: Audit all active log parsing rules for an account
steps:
  - name: listParsingRules
    type: action
    action: newrelic.logConfigurations.listParsingRules
    version: 1
    inputs:
      accountId: 123456
      selectors:
        - name: parsingRules
          expression: ".data.actor.account.logConfigurations.parsingRules"
    next: end

List data partition rules

The action identifier is newrelic.logConfigurations.listDataPartitionRules.

Returns all log data partition rules configured for an account, including the nested liveArchiveConfiguration for each partition.

The following table describes all available input fields for this action.

Input

Type

Description

Example

accountId

Integer

Required. The New Relic account to list data partition rules for. Must be a positive integer.

123456

selectors

List

Optional. JQ selectors to extract specific fields from the action output.

[{"name": "partitions", "expression": ".data.actor.account.logConfigurations.dataPartitionRules"}]

The following table describes all output fields returned by this action.

Output

Type

Example

success

Boolean

true when the step executed without error.

errorMessage

String

Populated only if the call fails at the HTTP/transport level. null on success.

data

Object

{
  "data": {
    "actor": {
      "account": {
        "logConfigurations": {
          "dataPartitionRules": [
            {
              "id": "456",
              "targetDataPartition": "Log_nginx",
              "description": "Routes nginx logs to a dedicated partition",
              "enabled": true,
              "nrql": "logtype = 'nginx'",
              "retentionPolicy": "STANDARD",
              "deleted": false,
              "createdAt": "2026-08-01T12:00:00Z",
              "updatedAt": "2026-08-01T12:00:00Z",
              "liveArchiveConfiguration": {
                "id": "789",
                "enabled": false,
                "retentionPolicy": "STANDARD",
                "eventType": "Log"
              }
            }
          ]
        }
      }
    }
  }
}

description, nrql, retentionPolicy, and updatedAt are nullable. liveArchiveConfiguration.retentionPolicy is non-null.

Workflow example

name: list_data_partition_rules
description: Audit how logs are routed across data partitions
steps:
  - name: listDataPartitionRules
    type: action
    action: newrelic.logConfigurations.listDataPartitionRules
    version: 1
    inputs:
      accountId: 123456
      selectors:
        - name: partitions
          expression: ".data.actor.account.logConfigurations.dataPartitionRules"
    next: end

List obfuscation expressions

The action identifier is newrelic.logConfigurations.listObfuscationExpressions.

Returns all obfuscation expressions configured for an account. Obfuscation expressions define the regex patterns that obfuscation rules use to match sensitive data in logs.

The following table describes all available input fields for this action.

Input

Type

Description

Example

accountId

Integer

Required. The New Relic account to list obfuscation expressions for. Must be a positive integer.

123456

selectors

List

Optional. JQ selectors to extract specific fields from the action output.

[{"name": "expressions", "expression": ".data.actor.account.logConfigurations.obfuscationExpressions"}]

The following table describes all output fields returned by this action.

Output

Type

Example

success

Boolean

true when the step executed without error.

errorMessage

String

Populated only if the call fails at the HTTP/transport level. null on success.

data

Object

{
  "data": {
    "actor": {
      "account": {
        "logConfigurations": {
          "obfuscationExpressions": [
            {
              "id": "abc123",
              "name": "Credit card number",
              "description": "Matches 13-16 digit credit card numbers",
              "regex": "(\\b\\d{13,16}\\b)",
              "createdAt": "2026-08-01T12:00:00Z",
              "updatedAt": "2026-08-01T12:00:00Z"
            }
          ]
        }
      }
    }
  }
}

description is nullable.

Workflow example

name: list_obfuscation_expressions
description: Verify sensitive data patterns are configured for an account
steps:
  - name: listObfuscationExpressions
    type: action
    action: newrelic.logConfigurations.listObfuscationExpressions
    version: 1
    inputs:
      accountId: 123456
      selectors:
        - name: expressions
          expression: ".data.actor.account.logConfigurations.obfuscationExpressions"
    next: end

List obfuscation rules

The action identifier is newrelic.logConfigurations.listObfuscationRules.

Returns all obfuscation rules configured for an account, including the actions and expressions each rule applies.

The following table describes all available input fields for this action.

Input

Type

Description

Example

accountId

Integer

Required. The New Relic account to list obfuscation rules for. Must be a positive integer.

123456

selectors

List

Optional. JQ selectors to extract specific fields from the action output.

[{"name": "rules", "expression": ".data.actor.account.logConfigurations.obfuscationRules"}]

The following table describes all output fields returned by this action.

Output

Type

Example

success

Boolean

true when the step executed without error.

errorMessage

String

Populated only if the call fails at the HTTP/transport level. null on success.

data

Object

{
  "data": {
    "actor": {
      "account": {
        "logConfigurations": {
          "obfuscationRules": [
            {
              "id": "rule123",
              "name": "Mask credit cards",
              "description": "Obfuscates credit card numbers in all logs",
              "enabled": true,
              "filter": "SELECT * FROM Log",
              "actions": [
                {
                  "id": "act456",
                  "attributes": ["message", "body"],
                  "expression": {
                    "id": "abc123",
                    "name": "Credit card number",
                    "regex": "(\\b\\d{13,16}\\b)"
                  },
                  "method": "MASK"
                }
              ],
              "createdAt": "2026-08-01T12:00:00Z",
              "updatedAt": "2026-08-01T12:00:00Z"
            }
          ]
        }
      }
    }
  }
}

description is nullable. filter is of type Nrql. actions[].attributes is a list of attribute name strings. actions[].expression is the full obfuscation expression object.

Workflow example

name: list_obfuscation_rules
description: Audit which sensitive-data obfuscation rules are active
steps:
  - name: listObfuscationRules
    type: action
    action: newrelic.logConfigurations.listObfuscationRules
    version: 1
    inputs:
      accountId: 123456
      selectors:
        - name: rules
          expression: ".data.actor.account.logConfigurations.obfuscationRules"
    next: end

Get pipeline configuration

The action identifier is newrelic.logConfigurations.getPipelineConfiguration.

Retrieves the current log pipeline configuration for an account, showing which processing steps the pipeline enables or disables.

The following table describes all available input fields for this action.

Input

Type

Description

Example

accountId

Integer

Required. The New Relic account to retrieve pipeline configuration for. Must be a positive integer.

123456

selectors

List

Optional. JQ selectors to extract specific fields from the action output.

[{"name": "config", "expression": ".data.actor.account.logConfigurations.pipelineConfiguration"}]

The following table describes all output fields returned by this action.

Output

Type

Example

success

Boolean

true when the step executed without error.

errorMessage

String

Populated only if the call fails at the HTTP/transport level. null on success.

data

Object

{
  "data": {
    "actor": {
      "account": {
        "logConfigurations": {
          "pipelineConfiguration": {
            "accountId": 123456,
            "accountLevelNativeJsonEnabled": false,
            "enrichmentDisabled": false,
            "entitySynthesisDisabled": false,
            "hasNativeJsonEntitlementEnabled": false,
            "infraAgentAttributesCleanupEnabled": false,
            "jsonParsingDisabled": false,
            "nrLinkingExtractionDisabled": false,
            "nrUnmarshallingFieldsDisabled": false,
            "obfuscationDisabled": false,
            "parsingDisabled": false,
            "patternsEnabled": true,
            "pluginAttributesCleanupEnabled": false,
            "recursiveJsonParsingDisabled": false,
            "syslogJsonParsingDisabled": false,
            "transformationDisabled": false,
            "updatedAt": "2026-08-01T12:00:00Z"
          }
        }
      }
    }
  }
}

updatedAt is nullable — null if the configuration has never been changed from defaults.

Workflow example

name: get_pipeline_configuration
description: Read current pipeline configuration before making changes
steps:
  - name: getPipelineConfiguration
    type: action
    action: newrelic.logConfigurations.getPipelineConfiguration
    version: 1
    inputs:
      accountId: 123456
      selectors:
        - name: pipelineConfig
          expression: ".data.actor.account.logConfigurations.pipelineConfiguration"
    next: end

Test a Grok pattern

The action identifier is newrelic.logConfigurations.testGrok.

Tests a Grok pattern against one or more sample log lines and returns whether each line matched along with the extracted attributes. Use this action to validate a Grok pattern before creating a parsing rule.

The following table describes all available input fields for this action.

Input

Type

Description

Example

accountId

Integer

Required. The New Relic account in which to test the Grok pattern. Must be a positive integer.

123456

grok

String

Required. The Grok pattern to test against the log lines.

"sampleattribute=%{NUMBER:test:int}"

logLines

List

Required. Sample log lines to test the Grok pattern against.

["sampleattribute=42", "sampleattribute=hello"]

selectors

List

Optional. JQ selectors to extract specific fields from the action output.

[{"name": "grokResults", "expression": ".data.actor.account.logConfigurations.testGrok"}]

The following table describes all output fields returned by this action.

Output

Type

Example

success

Boolean

true when the step executed without error.

errorMessage

String

Populated only if the call fails at the HTTP/transport level. null on success.

data

Object

{
  "data": {
    "actor": {
      "account": {
        "logConfigurations": {
          "testGrok": [
            {
              "logLine": "sampleattribute=42",
              "matched": true,
              "attributes": [
                {
                  "name": "test",
                  "value": "42"
                }
              ]
            },
            {
              "logLine": "sampleattribute=hello",
              "matched": false,
              "attributes": []
            }
          ]
        }
      }
    }
  }
}

Workflow example

name: test_grok_pattern
description: Validate a Grok pattern against sample log lines before creating a parsing rule
steps:
  - name: testGrokPattern
    type: action
    action: newrelic.logConfigurations.testGrok
    version: 1
    inputs:
      accountId: 123456
      grok: "sampleattribute=%{NUMBER:test:int}"
      logLines:
        - "sampleattribute=42"
        - "sampleattribute=hello"
      selectors:
        - name: grokResults
          expression: ".data.actor.account.logConfigurations.testGrok"
    next: end

Update pipeline configuration

The action identifier is newrelic.logConfigurations.upsertPipelineConfiguration.

Creates or updates the log pipeline configuration for an account, controlling which processing steps the pipeline enables. All flag inputs are optional — omitting a flag leaves the current value unchanged.

The following table describes all available input fields for this action.

Input

Type

Description

Example

accountId

Integer

Required. The New Relic account in which to update pipeline configuration. Must be a positive integer.

123456

accountLevelNativeJsonEnabled

Boolean

Optional. Enable account-level native JSON parsing.

false

enrichmentDisabled

Boolean

Optional. Disable log enrichment.

false

entitySynthesisDisabled

Boolean

Optional. Disable entity synthesis from logs.

false

hasNativeJsonEntitlementEnabled

Boolean

Optional. Enable native JSON entitlement.

false

infraAgentAttributesCleanupEnabled

Boolean

Optional. Enable cleanup of infrastructure agent attributes.

false

jsonParsingDisabled

Boolean

Optional. Disable JSON parsing of log messages.

false

nrLinkingExtractionDisabled

Boolean

Optional. Disable New Relic linking metadata extraction.

false

nrUnmarshallingFieldsDisabled

Boolean

Optional. Disable New Relic field unmarshalling.

false

obfuscationDisabled

Boolean

Optional. Disable obfuscation processing.

false

parsingDisabled

Boolean

Optional. Disable log parsing rules.

false

patternsEnabled

Boolean

Optional. Enable the log patterns feature.

true

pluginAttributesCleanupEnabled

Boolean

Optional. Enable cleanup of plugin attributes.

false

recursiveJsonParsingDisabled

Boolean

Optional. Disable recursive JSON parsing.

false

syslogJsonParsingDisabled

Boolean

Optional. Disable JSON parsing for syslog messages.

false

transformationDisabled

Boolean

Optional. Disable log transformation rules.

false

selectors

List

Optional. JQ selectors to extract specific fields from the action output.

[{"name": "pipelineConfiguration", "expression": ".data.logConfigurationsUpsertPipelineConfiguration.pipelineConfiguration"}]

The following table describes all output fields returned by this action.

Output

Type

Example

success

Boolean

true when the step executed without error.

errorMessage

String

Populated only if the call fails at the HTTP/transport level. null on success.

data

Object

{
  "data": {
    "logConfigurationsUpsertPipelineConfiguration": {
      "pipelineConfiguration": {
        "accountId": 123456,
        "accountLevelNativeJsonEnabled": false,
        "enrichmentDisabled": false,
        "entitySynthesisDisabled": false,
        "hasNativeJsonEntitlementEnabled": false,
        "infraAgentAttributesCleanupEnabled": false,
        "jsonParsingDisabled": false,
        "nrLinkingExtractionDisabled": false,
        "nrUnmarshallingFieldsDisabled": false,
        "obfuscationDisabled": false,
        "parsingDisabled": false,
        "patternsEnabled": true,
        "pluginAttributesCleanupEnabled": false,
        "recursiveJsonParsingDisabled": false,
        "syslogJsonParsingDisabled": false,
        "transformationDisabled": false,
        "updatedAt": "2026-10-15T10:00:00Z"
      }
    }
  }
}

updatedAt is nullable — null if the configuration has never been changed from defaults.

Workflow example

name: update_pipeline_configuration
description: Disable parsing and obfuscation temporarily during an incident
steps:
  - name: upsertPipelineConfiguration
    type: action
    action: newrelic.logConfigurations.upsertPipelineConfiguration
    version: 1
    inputs:
      accountId: 123456
      parsingDisabled: false
      obfuscationDisabled: false
      patternsEnabled: true
      selectors:
        - name: pipelineConfiguration
          expression: ".data.logConfigurationsUpsertPipelineConfiguration.pipelineConfiguration"
    next: end
Copyright © 2026 New Relic Inc.
CareersTerms of ServiceDMCA PolicyPrivacyWebsite TermsPatent NoticeModern Slavery Act

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.