[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-cel-programs":3,"mdc-x9p68o-key":34,"related-org-elastic-cel-programs":4289,"related-repo-elastic-cel-programs":4463},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":32,"mdContent":33},"cel-programs","write CEL programs for data collection","Use for all CEL and mito work on integrations that collect from APIs — writing CEL programs, cel.yml.hbs templates, manifest configuration, mock-first development with the mito CLI, system test mock setup, and answering CEL\u002Fmito questions. Load this skill whenever any data stream uses the cel input type.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19,20],{"name":13,"slug":14,"type":15},"Data Engineering","data-engineering","tag",{"name":17,"slug":18,"type":15},"Integrations","integrations",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"API Development","api-development",11,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegration-skills","2026-07-12T07:47:10.207064","Apache-2.0",2,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":31},[],null,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegration-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fcel-programs","---\nname: cel-programs\ndescription: \"Use for all CEL and mito work on integrations that collect from APIs — writing CEL programs, cel.yml.hbs templates, manifest configuration, mock-first development with the mito CLI, system test mock setup, and answering CEL\u002Fmito questions. Load this skill whenever any data stream uses the cel input type.\"\nlicense: Apache-2.0\nmetadata:\n  author: elastic\n  version: \"1.0\"\n---\n\n# cel-programs\n\n\n## When to use\n\nUse this skill when tasks include:\n- creating or editing `cel.yml.hbs` agent stream templates\n- configuring data stream manifests for the `cel` input type\n- writing CEL programs with pagination, cursor management, or authentication\n- testing or debugging a CEL program locally with mito\n- setting up system tests with mock APIs for CEL-based data streams\n- prototyping a new CEL-based data stream's collection logic\n- any CEL or mito question, regardless of context\n\n## When not to use\n\nDo not use this skill as the primary guide for:\n- ingest pipeline processor design (`ingest-pipelines`)\n- ECS field mapping (`ecs-field-mappings`)\n- package scaffolding (`create-integration`)\n- system test execution with the Elastic stack (`integration-testing` → `references\u002Fsystem-testing.md`)\n\n## Mandatory workflow — mock → mito → template\n\n**This is not a suggestion. Every CEL program MUST be developed in this order.** The subagent must not write `cel.yml.hbs` until the CEL program has been validated with mito against a running mock. Skipping steps or reordering causes failures that are hard to debug.\n\n**Do NOT write more than ~10–15 new lines of CEL before running mito.** Build the program incrementally in phases (skeleton → error handling → event mapping → pagination → cursor guard), validating with mito after each phase. Writing a large program in one shot leads to cascading compilation errors that are extremely hard to debug. Follow the phased approach in `references\u002Fcel-incremental-build.md`.\n\n| Step | Action | Output |\n|------|--------|--------|\n| **1. Create the system test mock** | Write the `elastic\u002Fstream` config at `_dev\u002Fdeploy\u002Fdocker\u002Ffiles\u002Fconfig-\u003Cstream>.yml` with rules matching all API endpoints. Write `test-default-config.yml`. | Mock config file, docker-compose service, test config |\n| **2. Start the mock locally** | `stream http-server --addr=:8090 --config=...` | Running mock at `http:\u002F\u002Flocalhost:8090` |\n| **3. Create a plain `.cel` file and `state.json`** | Write the CEL program as a standalone `.cel` file. Create `state.json` with the same keys the future `state:` block will contain, but with literal test values instead of Handlebars. Point `url` at the local mock. | `program.cel`, `state.json` in `\u002Ftmp` or working dir |\n| **4. Run mito and iterate** | Build incrementally per `references\u002Fcel-incremental-build.md`: Phase 0 skeleton → Phase 1 error handling → Phase 2 events → Phase 3 pagination → Phase 4 cursor. Run `mito -data state.json -log_requests program.cel` after each phase. Do not proceed until mito output is correct. | Validated CEL program |\n| **5. ONLY THEN write `cel.yml.hbs`** | Copy the working CEL expression into `program: \\|` in the Handlebars template. Replace literal test values with `{{var}}` references. Configure manifests. | Final integration template |\n\n**Step 3 detail — translating template vars to mito state:** When the future `cel.yml.hbs` will have a `state:` block like `api_key: {{api_key}}` and `batch_size: {{batch_size}}`, the `state.json` for mito testing uses the same key names with literal test values:\n\n```json\n{\n  \"url\": \"http:\u002F\u002Flocalhost:8090\",\n  \"api_key\": \"test-key\",\n  \"batch_size\": 50,\n  \"initial_interval\": \"24h\"\n}\n```\n\nThis mirrors the runtime state the CEL input would provide. Add `cursor` to test subsequent-run behavior.\n\nFor the full mock-first workflow details, CLI flags, execution model, and quality standards: load `references\u002Fmito-reference.md`.\n\n---\n\n## cel.yml.hbs template anatomy\n\nThe `cel.yml.hbs` file at `data_stream\u002F\u003Cstream>\u002Fagent\u002Fstream\u002Fcel.yml.hbs` is a Handlebars template that renders the final CEL input configuration. It has these sections in order:\n\n```yaml\ninterval: {{interval}}\nresource.tracer:\n  enabled: {{enable_request_tracer}}\n  filename: \"..\u002F..\u002Flogs\u002Fcel\u002Fhttp-request-trace-*.ndjson\"\n  maxbackups: 5\n{{#if proxy_url}}\nresource.proxy_url: {{proxy_url}}\n{{\u002Fif}}\n{{#if ssl}}\nresource.ssl: {{ssl}}\n{{\u002Fif}}\n{{#if http_client_timeout}}\nresource.timeout: {{http_client_timeout}}\n{{\u002Fif}}\nresource.url: \u003Cconstructed from vars>\nstate:\n  \u003Ccredentials and pagination config from vars>\nredact:\n  fields:\n    - \u003Csensitive state keys>\nmax_executions: \u003Cnumber, for heavy pagination>\nprogram: |\n  \u003CCEL expression>\ntags:\n{{#if preserve_original_event}}\n  - preserve_original_event\n{{\u002Fif}}\n{{#each tags as |tag|}}\n  - {{tag}}\n{{\u002Feach}}\n{{#contains \"forwarded\" tags}}\npublisher_pipeline.disable_host: true\n{{\u002Fcontains}}\n{{#if processors}}\nprocessors:\n{{processors}}\n{{\u002Fif}}\n```\n\n### Handlebars patterns\n\n| Pattern | Purpose |\n|---------|---------|\n| `{{var_name}}` | Direct variable substitution |\n| `{{#if var_name}}...{{\u002Fif}}` | Conditional block for optional config |\n| `{{#each tags as \\|tag\\|}}` | Iteration over list vars |\n| `{{#contains \"forwarded\" tags}}` | Check if list contains value |\n\n### Key template fields\n\n- `resource.url` — base URL, often constructed from multiple vars (e.g., `{{url}}\u002Fapi\u002Fv1\u002Fendpoint`)\n- `resource.headers` (ga 8.18.1) — static headers the same for every request (`Content-Type`, `Accept`, API version headers). Set here rather than in-program when headers never vary. Applied before auth headers.\n- `state:` — block where manifest vars are injected as CEL state; credentials and pagination settings go here\n- `redact.fields` — list state keys containing secrets to redact from debug logs\n- `max_executions` — override default 1000 for integrations with heavy pagination (e.g., 5000)\n- `program: |` — the CEL expression; must be a YAML literal block scalar\n\n### Do NOT set `data_stream.dataset` in integration packages\n\n**Integration packages** (`type: integration`) must **never** include `data_stream.dataset` in `cel.yml.hbs` or define a `data_stream.dataset` manifest var. The framework automatically routes documents to the correct data stream. Setting `data_stream.dataset` overrides this routing and causes documents to land in the wrong index — typically resulting in \"0 hits\" during system tests.\n\nOnly **input-type packages** (`type: input`) use `data_stream.dataset` because they have no predefined data streams.\n\n## Data stream manifest configuration\n\nThe data stream `manifest.yml` defines the CEL input stream and its variables.\n\n### Standard vars every CEL stream should include\n\n| Var | Type | Purpose |\n|-----|------|---------|\n| `url` | text | API base URL |\n| `interval` | text | Polling interval (e.g., `5m`) |\n| `initial_interval` | text | Lookback window on first run (e.g., `24h`) |\n| `enable_request_tracer` | bool | Enable HTTP request tracing |\n| `http_client_timeout` | text | Request timeout (e.g., `30s`) |\n| `proxy_url` | text | HTTP proxy URL |\n| `ssl` | yaml | TLS configuration |\n| `tags` | text (multi) | Event tags |\n| `preserve_original_event` | bool | Keep original event |\n| `processors` | yaml | Beat processors |\n\nAuth-specific vars depend on the API (API key, OAuth client_id\u002Fsecret\u002Ftoken_url, bearer token, etc.).\n\nDeclare `enable_request_tracer` in the data stream manifest, not at the input level. Input-level tracing enables logging for all data streams in the policy.\n\n### Package-level vs data-stream-level vars\n\n- **Package-level** vars in the root `manifest.yml` under `policy_templates[].inputs[].vars`: shared across streams (e.g., `url`, auth credentials)\n- **Data-stream-level** vars in `data_stream\u002F\u003Cstream>\u002Fmanifest.yml` under `streams[].vars`: stream-specific (e.g., `interval`, `batch_size`, `initial_interval`)\n\n## Scope of the CEL program\n\nThe CEL program's responsibility is **data collection only**:\n\n1. **Fetch data** from the API endpoint(s)\n2. **Handle pagination** — walk through all pages within a single polling cycle\n3. **Manage cursor state** — store timestamps or page tokens in `cursor` so the next polling interval resumes where the last one left off, avoiding re-collection of already-fetched events\n4. **Emit raw events** — output `{\"message\": e.encode_json()}` for each record\n\nThe CEL program does **not** handle:\n\n- **Elasticsearch-level deduplication** — if overlapping time windows cause a few duplicate events to be collected, that is acceptable. The ingest pipeline or Elasticsearch `_id` routing handles dedup at index time, not the CEL program.\n- **Field mapping or transformation** — the ingest pipeline handles parsing, ECS mapping, and enrichment.\n- **Filtering by content** — unless the API supports server-side filtering parameters, do not filter events in the CEL program. Emit everything and let the pipeline decide.\n\nDo not search the codebase for `_id`, `document_id`, or deduplication patterns. These are not CEL concerns.\n\n## CEL program structure patterns\n\n### Pagination strategy selection\n\n| API behavior | Pattern | Key indicators |\n|---|---|---|\n| Returns total count + supports offset | Offset pagination | `total_count`, `offset`, `limit` in request\u002Fresponse |\n| Returns records since a timestamp | Timestamp cursor | Time-range params, no explicit page tokens |\n| Returns `Link` header with next URL | Link header | `Link: \u003Curl>; rel=\"next\"` in response headers |\n| Returns next-page URL in response body | Next-URL | `next`, `nextLink`, `@odata.nextLink` field in JSON |\n| GraphQL with `pageInfo` | GraphQL cursor | `hasNextPage`, `endCursor` in `pageInfo` object |\n| Multi-phase subscription\u002Fcontent flow | Multi-step state machine | Multiple API calls with work queues in state |\n\n**Cursor timestamp selection** — use the **last** record's timestamp when the API sorts ascending; **first** when descending; `max()` with a regression guard when sort order is not guaranteed.\n\nFull code, package references, and YAML snippets for each pattern: `references\u002Fcel-pagination-patterns.md`.\n\n## Authentication patterns\n\nThree strategies: **header** (credentials in `state:`, passed via `Header` map), **query parameter** (credentials appended to URL via `.format_query()`), **signed query** (HMAC signature computed in CEL). Config-level `auth.oauth2`\u002F`auth.digest`\u002F`auth.aws` applies to all requests including `.do_request()`; `auth.basic`\u002F`auth.token` applies only to direct calls (`get()`, `post()`). Prefer input-level auth over in-program token fetching.\n\nFor full code examples, optional-header syntax, and config-level auth scope details: load `references\u002Fcel-auth-patterns.md`.\n\n## State management rules\n\n1. **`state.url`** is populated from `resource.url` config; must be preserved in output or hardcoded\n2. **`cursor`** is the only state persisted across input restarts; store pagination positions and timestamps here\n3. **`events`** array is removed after each evaluation; never rely on it in subsequent runs\n4. **`want_more: true`** triggers immediate re-evaluation, but only if `events` is non-empty. **Pagination continuation guardrail:** when a next-page cursor\u002Ftoken exists, always set `want_more: true` regardless of how many events were collected on the current page. Tying `want_more` to `size(events) > 0` stalls pagination silently — the next cursor is valid, and an empty `events` array is safe to emit. The correct pattern is `\"want_more\": next_cursor != \"\"`.\n5. **All other state keys** are retained within a session but lost on restart — use `state.with()` to propagate them automatically\n6. **Numbers** are serialized as floats in state JSON; cast with `int()` when using as integers\n7. **Optional access** with `state.?cursor.last_timestamp.orValue(default)` prevents errors when cursor is absent\n8. **Secrets** — every sensitive field in `state` must have a corresponding `redact` entry. `state.secret` is always redacted automatically. When `secret_state` (ga 9.4.0) is available, prefer it.\n9. **Cursor updates require a published event** — the input only persists cursor updates when at least one event is published. If a program updates the cursor but returns zero events, the cursor change is lost.\n10. **Do not duplicate request\u002Fresponse handling across branches** — when an initialization branch (cursor creation, subscription, token exchange) and a steady-state branch both need the same fetch logic, consolidate it. Two approaches: split the init into a separate evaluation via `want_more: true` (Technique 6 Variant A), or use an intermediate result map to unify the branches within one evaluation (Variant B). Both are valid — see `references\u002Fcel-code-style.md` Technique 6 and the init-then-steady-state pattern in `references\u002Fcel-pagination-patterns.md`.\n11. **Nesting depth** — `.as()` chain depth must not exceed 5 levels on any execution path. HTTP programs must target 2 levels inside `state.with()` (`resp` + `body`). Cursor defaults, window bounds, and page tokens must be extracted as pre-bindings *before* `state.with()`. Single-use values such as `int(state.batch_size)` must be inlined at the call site, not wrapped in `.as()`. Load `references\u002Fcel-code-style.md` for flattening techniques and before\u002Fafter examples.\n\n### Map merge and field removal\n\n`with()`, `with_replace()`, `with_update()`, and `drop()` are general-purpose map operations — they work on any map, not just state or cursor. `with()` does a **shallow merge**: nested objects are replaced entirely. This makes it a tool for cursor state transitions (omitting a sub-object removes it via clobber) as well as for building request headers, transforming response data, and constructing intermediate maps. Full semantics and examples: `references\u002Fcel-code-style.md`.\n\n## Event output format\n\n**Events must contain ONLY `\"message\"`** — `{\"message\": e.encode_json()}`. Do not set `@timestamp` or any other field; the framework adds `@timestamp`, and duplicates cause silent document rejection in ES 9.x. See `references\u002Fcel-idioms.md` for correct\u002Fincorrect examples.\n\n## Response handling\n\n**`resp.Body.decode_json()`** — the `bytes(resp.Body)` wrapper was required in older runtime versions but is no longer needed. Use `resp.Body.decode_json()` directly.\n\n## Error handling\n\nEvery CEL program must handle HTTP errors. Two forms:\n\n- **Single-object error (retry):** `\"events\": {\"error\": {...}}` — logs at ERROR, sets degraded status, **deletes the cursor** so the next evaluation retries. Use when data was not collected.\n- **Array error (advance):** `\"events\": [{\"error\": {...}}]` — cursor **is** updated. Use when the program should advance past the error. Requires a `terminate` processor in the ingest pipeline (ES 8.16.0+).\n\nError message format: `\"METHOD path: body-or-status\"`. Code examples: `references\u002Fcel-idioms.md`.\n\n### Placeholder events\n\nWhen advancing the cursor with no real events, emit a placeholder (`[{\"retry\": true}]`) and add a `- drop_event.when.equals.retry: true` entry in the `processors:` section so it is discarded before indexing. Full pattern and alternatives: `references\u002Fcel-idioms.md`.\n\n## Rate limiting and retry\n\n**Do NOT implement rate limiting or retry logic in the CEL program.** No `rate_limit()` calls, no `\"rate_limit\"` state propagation, no 429-specific branches, no retry loops. These add excessive nesting and complexity for marginal benefit.\n\nWhen an API has a documented rate limit, use config-only YAML settings in `cel.yml.hbs`:\n\n```yaml\nresource.rate_limit.limit: 10   # max requests per second\nresource.rate_limit.burst: 5    # max burst above sustained rate\n```\n\nWhen custom retry behavior is needed, use config-only YAML settings:\n\n```yaml\nresource.retry.max_attempts: 5    # default: 5\nresource.retry.wait_min: 1s       # default: 1s\nresource.retry.wait_max: 60s      # default: 60s\n```\n\nThe input framework enforces both transparently. See `references\u002Fcel-rate-limiting.md` for guidance on when to add these settings.\n\n## Type safety\n\n**Avoid `dyn()`** — defeats type checking. Rarely needed in practice.\n\n**All numbers are float64** — the CEL input transmits all numbers as `float64`. Numbers >=1e7 render in scientific notation in Elasticsearch. Convert intended-integer fields to strings in the CEL program or via ingest pipeline. Safe integer range: [-(2^53 - 1), 2^53 - 1].\n\n## Debugging aids\n\n- **`debug(tag, value)`** — logs to `cel_debug` at DEBUG level.\n- **`try(expr)` \u002F `is_error(value)`** — structured error handling without crashing the program.\n- **`failure_dump`** (ga 8.18.0) — full evaluation state dump on failure. Note: dumps may contain secrets.\n- **`remaining_executions`** (ga 9.2) — how many evaluations remain in the `max_executions` budget.\n\n---\n\n## Mito CLI\n\nMito (`github.com\u002Felastic\u002Fmito`) is the local CEL evaluation CLI. **A CEL program that has not been tested with mito is not acceptable.** Follow the mandatory workflow at the top of this skill: mock → mito → template. Do NOT write `cel.yml.hbs` until the program passes mito validation.\n\nFor installation, CLI flags, input state structure, execution model, the full mock-first workflow steps, mito→integration mapping, and quality standards: load `references\u002Fmito-reference.md`.\n\n---\n\n## Data anonymization\n\n**All data committed to the repository must be fully anonymized.** This applies to default values in manifest vars (use `https:\u002F\u002Fapi.example.com`), example values in CEL state, mock API responses, pipeline test fixtures from CEL output, and sample payloads captured during mito prototyping.\n\nRefer to the `anonymize-logs` skill for the full anonymization policy and placeholder conventions.\n\n## Handoff to other skills\n\n- `integration-testing` → `references\u002Fsystem-testing.md` to run system tests (the mock API is already in place from CEL development)\n- `integration-testing` → `references\u002Fpipeline-testing.md` to validate ingest pipeline behavior on CEL-produced events\n- `create-integration` skill for overall package layout\n\n## Reference files\n\n**IMPORTANT**: These reference files contain the actual working code examples and patterns. The summaries above are not sufficient to write correct CEL programs — you MUST load the relevant references before writing code.\n\n**Always load these five** when building a CEL program — **in this order** (mock\u002Fmito before templates):\n\n| File | Contains | Load order |\n|------|----------|------------|\n| `references\u002Fcel-system-tests.md` | Mock API setup with elastic\u002Fstream, docker-compose config, rule format, variable-capture patterns, GraphQL mock examples, hit_count calculation, and debugging 0-hits failures | 1st — you need this before writing any CEL |\n| `references\u002Fcel-incremental-build.md` | **Mandatory** phased build ladder (skeleton → error handling → events → pagination → cursor), syntax anti-patterns that cause compilation failures (`bytes()`, `parse_time()`, tuples, unbalanced parens), and debugging guidance | 2nd — you MUST follow this phased approach; do not write the full program before validating a skeleton |\n| `references\u002Fmito-reference.md` | Mito CLI flags, input state structure, mock-first workflow, translating template vars to state.json, extension library quick-reference, syntax pitfalls, testscript harness | 3rd — you need this to develop and validate the program |\n| `references\u002Fcel-template-examples.md` | Complete working `cel.yml.hbs` examples (minimal GET, paginated timestamp cursor, OAuth, GraphQL cursor) with corresponding manifest configs — **these are FINAL output; do not write templates until mito passes** | 4th — only needed at step 5 of the workflow |\n| `references\u002Fcel-code-style.md` | **Nesting discipline**: the 3-level HTTP core rule, six flattening\u002Fstructuring techniques (including intermediate result maps for shared logic), shallow merge semantics, cursor namespacing with clobber, merge strategies (`with`\u002F`with_replace`\u002F`with_update`), `drop()`, and links to well-structured reference integrations — **must read before writing any multi-line CEL** | 5th — read this before writing your CEL program so structure is right from the start |\n\n**Load these based on the task:**\n\n| File | Load when |\n|------|-----------|\n| `references\u002Fcel-pagination-patterns.md` | Writing any pagination logic — all 6 patterns with code |\n| `references\u002Fcel-auth-patterns.md` | Implementing authentication — header, query param, signed, and config-level auth patterns |\n| `references\u002Fcel-rate-limiting.md` | Rate limiting policy — config-only approach, when to add `resource.rate_limit.*` and `resource.retry.*` settings |\n| `references\u002Fcel-idioms.md` | Quick-reference for common idioms, HTTP request patterns, structure conventions |\n| `references\u002Fcel-polymorphic-patterns.md` | Choosing between pure-CEL, mito lib, and config approaches for auth, headers, rate limiting — version-tagged |\n| `references\u002Fcel-expression.md` | Expression-specific reference: interface contract, translation framing (Python→CEL), incremental build phases, core structure, event output, error handling, pagination, state management, syntax rules, quality checklist |\n| `references\u002Fcel-taxonomy.md` | Taxonomy classification: pagination and state management classes, least-complexity principle, mapping to skill vocabulary, how to classify from test-api.py |\n| `references\u002Fcel-complexity-baselines.md` | Per-pattern-class complexity baselines from a ceplx survey of 316 programs, skip threshold, reviewer challenge examples, diagnostic interpretation |\n| `references\u002Fexpression-builder-subagent-guidance.md` | Subagent operating manual for the **cel-expression-builder**: translates test-api.py into a validated `.cel` file + taxonomy classification. Does not touch templates, manifests, or mocks. |\n| `references\u002Freviewer-subagent-guidance.md` | Subagent operating manual for the **cel-expression-reviewer**: checks generated CEL against complexity baselines and source fidelity, produces specific challenges or accepts |\n| `references\u002Fcel-function-reference.md` | Looking up available CEL functions per extension and their first mito version |\n| `references\u002Fbuilder-subagent-guidance.md` | Subagent operating manual for the **cel-program-builder** orchestrator: scope boundaries, skill-load sequence, the 9-step mock-first \u002F mito-incremental workflow with mock completeness gate, delegation to cel-expression-builder, reporting contract. The orchestrator dispatches subagents by passing this file's **path** in the task prompt; the subagent reads it itself in its own fresh context. Do NOT embed\u002Fpaste its contents into the task prompt. |\n\nSee also: [CEL input docs](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Freference\u002Fbeats\u002Ffilebeat\u002Ffilebeat-input-cel) · [Mito lib docs](https:\u002F\u002Fpkg.go.dev\u002Fgithub.com\u002Felastic\u002Fmito\u002Flib) · [Mito repo](https:\u002F\u002Fgithub.com\u002Felastic\u002Fmito) · [CEL language spec](https:\u002F\u002Fcel.dev\u002F)\n",{"data":35,"body":38},{"name":4,"description":6,"license":26,"metadata":36},{"author":8,"version":37},"1.0",{"type":39,"children":40},"root",[41,48,55,61,118,124,129,189,195,213,231,503,550,728,741,753,757,763,783,1461,1468,1558,1564,1651,1665,1717,1743,1749,1762,1768,2017,2022,2034,2040,2118,2124,2135,2194,2206,2247,2266,2272,2278,2491,2523,2535,2541,2651,2663,2669,2997,3003,3056,3062,3107,3113,3142,3148,3153,3212,3231,3237,3272,3278,3304,3315,3367,3372,3444,3457,3463,3479,3503,3509,3591,3594,3600,3627,3638,3641,3647,3665,3678,3684,3730,3736,3746,3763,3967,3975,4244,4283],{"type":42,"tag":43,"props":44,"children":45},"element","h1",{"id":4},[46],{"type":47,"value":4},"text",{"type":42,"tag":49,"props":50,"children":52},"h2",{"id":51},"when-to-use",[53],{"type":47,"value":54},"When to use",{"type":42,"tag":56,"props":57,"children":58},"p",{},[59],{"type":47,"value":60},"Use this skill when tasks include:",{"type":42,"tag":62,"props":63,"children":64},"ul",{},[65,80,93,98,103,108,113],{"type":42,"tag":66,"props":67,"children":68},"li",{},[69,71,78],{"type":47,"value":70},"creating or editing ",{"type":42,"tag":72,"props":73,"children":75},"code",{"className":74},[],[76],{"type":47,"value":77},"cel.yml.hbs",{"type":47,"value":79}," agent stream templates",{"type":42,"tag":66,"props":81,"children":82},{},[83,85,91],{"type":47,"value":84},"configuring data stream manifests for the ",{"type":42,"tag":72,"props":86,"children":88},{"className":87},[],[89],{"type":47,"value":90},"cel",{"type":47,"value":92}," input type",{"type":42,"tag":66,"props":94,"children":95},{},[96],{"type":47,"value":97},"writing CEL programs with pagination, cursor management, or authentication",{"type":42,"tag":66,"props":99,"children":100},{},[101],{"type":47,"value":102},"testing or debugging a CEL program locally with mito",{"type":42,"tag":66,"props":104,"children":105},{},[106],{"type":47,"value":107},"setting up system tests with mock APIs for CEL-based data streams",{"type":42,"tag":66,"props":109,"children":110},{},[111],{"type":47,"value":112},"prototyping a new CEL-based data stream's collection logic",{"type":42,"tag":66,"props":114,"children":115},{},[116],{"type":47,"value":117},"any CEL or mito question, regardless of context",{"type":42,"tag":49,"props":119,"children":121},{"id":120},"when-not-to-use",[122],{"type":47,"value":123},"When not to use",{"type":42,"tag":56,"props":125,"children":126},{},[127],{"type":47,"value":128},"Do not use this skill as the primary guide for:",{"type":42,"tag":62,"props":130,"children":131},{},[132,145,157,169],{"type":42,"tag":66,"props":133,"children":134},{},[135,137,143],{"type":47,"value":136},"ingest pipeline processor design (",{"type":42,"tag":72,"props":138,"children":140},{"className":139},[],[141],{"type":47,"value":142},"ingest-pipelines",{"type":47,"value":144},")",{"type":42,"tag":66,"props":146,"children":147},{},[148,150,156],{"type":47,"value":149},"ECS field mapping (",{"type":42,"tag":72,"props":151,"children":153},{"className":152},[],[154],{"type":47,"value":155},"ecs-field-mappings",{"type":47,"value":144},{"type":42,"tag":66,"props":158,"children":159},{},[160,162,168],{"type":47,"value":161},"package scaffolding (",{"type":42,"tag":72,"props":163,"children":165},{"className":164},[],[166],{"type":47,"value":167},"create-integration",{"type":47,"value":144},{"type":42,"tag":66,"props":170,"children":171},{},[172,174,180,182,188],{"type":47,"value":173},"system test execution with the Elastic stack (",{"type":42,"tag":72,"props":175,"children":177},{"className":176},[],[178],{"type":47,"value":179},"integration-testing",{"type":47,"value":181}," → ",{"type":42,"tag":72,"props":183,"children":185},{"className":184},[],[186],{"type":47,"value":187},"references\u002Fsystem-testing.md",{"type":47,"value":144},{"type":42,"tag":49,"props":190,"children":192},{"id":191},"mandatory-workflow-mock-mito-template",[193],{"type":47,"value":194},"Mandatory workflow — mock → mito → template",{"type":42,"tag":56,"props":196,"children":197},{},[198,204,206,211],{"type":42,"tag":199,"props":200,"children":201},"strong",{},[202],{"type":47,"value":203},"This is not a suggestion. Every CEL program MUST be developed in this order.",{"type":47,"value":205}," The subagent must not write ",{"type":42,"tag":72,"props":207,"children":209},{"className":208},[],[210],{"type":47,"value":77},{"type":47,"value":212}," until the CEL program has been validated with mito against a running mock. Skipping steps or reordering causes failures that are hard to debug.",{"type":42,"tag":56,"props":214,"children":215},{},[216,221,223,229],{"type":42,"tag":199,"props":217,"children":218},{},[219],{"type":47,"value":220},"Do NOT write more than ~10–15 new lines of CEL before running mito.",{"type":47,"value":222}," Build the program incrementally in phases (skeleton → error handling → event mapping → pagination → cursor guard), validating with mito after each phase. Writing a large program in one shot leads to cascading compilation errors that are extremely hard to debug. Follow the phased approach in ",{"type":42,"tag":72,"props":224,"children":226},{"className":225},[],[227],{"type":47,"value":228},"references\u002Fcel-incremental-build.md",{"type":47,"value":230},".",{"type":42,"tag":232,"props":233,"children":234},"table",{},[235,259],{"type":42,"tag":236,"props":237,"children":238},"thead",{},[239],{"type":42,"tag":240,"props":241,"children":242},"tr",{},[243,249,254],{"type":42,"tag":244,"props":245,"children":246},"th",{},[247],{"type":47,"value":248},"Step",{"type":42,"tag":244,"props":250,"children":251},{},[252],{"type":47,"value":253},"Action",{"type":42,"tag":244,"props":255,"children":256},{},[257],{"type":47,"value":258},"Output",{"type":42,"tag":260,"props":261,"children":262},"tbody",{},[263,308,339,425,461],{"type":42,"tag":240,"props":264,"children":265},{},[266,275,303],{"type":42,"tag":267,"props":268,"children":269},"td",{},[270],{"type":42,"tag":199,"props":271,"children":272},{},[273],{"type":47,"value":274},"1. Create the system test mock",{"type":42,"tag":267,"props":276,"children":277},{},[278,280,286,288,294,296,302],{"type":47,"value":279},"Write the ",{"type":42,"tag":72,"props":281,"children":283},{"className":282},[],[284],{"type":47,"value":285},"elastic\u002Fstream",{"type":47,"value":287}," config at ",{"type":42,"tag":72,"props":289,"children":291},{"className":290},[],[292],{"type":47,"value":293},"_dev\u002Fdeploy\u002Fdocker\u002Ffiles\u002Fconfig-\u003Cstream>.yml",{"type":47,"value":295}," with rules matching all API endpoints. Write ",{"type":42,"tag":72,"props":297,"children":299},{"className":298},[],[300],{"type":47,"value":301},"test-default-config.yml",{"type":47,"value":230},{"type":42,"tag":267,"props":304,"children":305},{},[306],{"type":47,"value":307},"Mock config file, docker-compose service, test config",{"type":42,"tag":240,"props":309,"children":310},{},[311,319,328],{"type":42,"tag":267,"props":312,"children":313},{},[314],{"type":42,"tag":199,"props":315,"children":316},{},[317],{"type":47,"value":318},"2. Start the mock locally",{"type":42,"tag":267,"props":320,"children":321},{},[322],{"type":42,"tag":72,"props":323,"children":325},{"className":324},[],[326],{"type":47,"value":327},"stream http-server --addr=:8090 --config=...",{"type":42,"tag":267,"props":329,"children":330},{},[331,333],{"type":47,"value":332},"Running mock at ",{"type":42,"tag":72,"props":334,"children":336},{"className":335},[],[337],{"type":47,"value":338},"http:\u002F\u002Flocalhost:8090",{"type":42,"tag":240,"props":340,"children":341},{},[342,364,399],{"type":42,"tag":267,"props":343,"children":344},{},[345],{"type":42,"tag":199,"props":346,"children":347},{},[348,350,356,358],{"type":47,"value":349},"3. Create a plain ",{"type":42,"tag":72,"props":351,"children":353},{"className":352},[],[354],{"type":47,"value":355},".cel",{"type":47,"value":357}," file and ",{"type":42,"tag":72,"props":359,"children":361},{"className":360},[],[362],{"type":47,"value":363},"state.json",{"type":42,"tag":267,"props":365,"children":366},{},[367,369,374,376,381,383,389,391,397],{"type":47,"value":368},"Write the CEL program as a standalone ",{"type":42,"tag":72,"props":370,"children":372},{"className":371},[],[373],{"type":47,"value":355},{"type":47,"value":375}," file. Create ",{"type":42,"tag":72,"props":377,"children":379},{"className":378},[],[380],{"type":47,"value":363},{"type":47,"value":382}," with the same keys the future ",{"type":42,"tag":72,"props":384,"children":386},{"className":385},[],[387],{"type":47,"value":388},"state:",{"type":47,"value":390}," block will contain, but with literal test values instead of Handlebars. Point ",{"type":42,"tag":72,"props":392,"children":394},{"className":393},[],[395],{"type":47,"value":396},"url",{"type":47,"value":398}," at the local mock.",{"type":42,"tag":267,"props":400,"children":401},{},[402,408,410,415,417,423],{"type":42,"tag":72,"props":403,"children":405},{"className":404},[],[406],{"type":47,"value":407},"program.cel",{"type":47,"value":409},", ",{"type":42,"tag":72,"props":411,"children":413},{"className":412},[],[414],{"type":47,"value":363},{"type":47,"value":416}," in ",{"type":42,"tag":72,"props":418,"children":420},{"className":419},[],[421],{"type":47,"value":422},"\u002Ftmp",{"type":47,"value":424}," or working dir",{"type":42,"tag":240,"props":426,"children":427},{},[428,436,456],{"type":42,"tag":267,"props":429,"children":430},{},[431],{"type":42,"tag":199,"props":432,"children":433},{},[434],{"type":47,"value":435},"4. Run mito and iterate",{"type":42,"tag":267,"props":437,"children":438},{},[439,441,446,448,454],{"type":47,"value":440},"Build incrementally per ",{"type":42,"tag":72,"props":442,"children":444},{"className":443},[],[445],{"type":47,"value":228},{"type":47,"value":447},": Phase 0 skeleton → Phase 1 error handling → Phase 2 events → Phase 3 pagination → Phase 4 cursor. Run ",{"type":42,"tag":72,"props":449,"children":451},{"className":450},[],[452],{"type":47,"value":453},"mito -data state.json -log_requests program.cel",{"type":47,"value":455}," after each phase. Do not proceed until mito output is correct.",{"type":42,"tag":267,"props":457,"children":458},{},[459],{"type":47,"value":460},"Validated CEL program",{"type":42,"tag":240,"props":462,"children":463},{},[464,477,498],{"type":42,"tag":267,"props":465,"children":466},{},[467],{"type":42,"tag":199,"props":468,"children":469},{},[470,472],{"type":47,"value":471},"5. ONLY THEN write ",{"type":42,"tag":72,"props":473,"children":475},{"className":474},[],[476],{"type":47,"value":77},{"type":42,"tag":267,"props":478,"children":479},{},[480,482,488,490,496],{"type":47,"value":481},"Copy the working CEL expression into ",{"type":42,"tag":72,"props":483,"children":485},{"className":484},[],[486],{"type":47,"value":487},"program: |",{"type":47,"value":489}," in the Handlebars template. Replace literal test values with ",{"type":42,"tag":72,"props":491,"children":493},{"className":492},[],[494],{"type":47,"value":495},"{{var}}",{"type":47,"value":497}," references. Configure manifests.",{"type":42,"tag":267,"props":499,"children":500},{},[501],{"type":47,"value":502},"Final integration template",{"type":42,"tag":56,"props":504,"children":505},{},[506,511,513,518,520,525,527,533,535,541,543,548],{"type":42,"tag":199,"props":507,"children":508},{},[509],{"type":47,"value":510},"Step 3 detail — translating template vars to mito state:",{"type":47,"value":512}," When the future ",{"type":42,"tag":72,"props":514,"children":516},{"className":515},[],[517],{"type":47,"value":77},{"type":47,"value":519}," will have a ",{"type":42,"tag":72,"props":521,"children":523},{"className":522},[],[524],{"type":47,"value":388},{"type":47,"value":526}," block like ",{"type":42,"tag":72,"props":528,"children":530},{"className":529},[],[531],{"type":47,"value":532},"api_key: {{api_key}}",{"type":47,"value":534}," and ",{"type":42,"tag":72,"props":536,"children":538},{"className":537},[],[539],{"type":47,"value":540},"batch_size: {{batch_size}}",{"type":47,"value":542},", the ",{"type":42,"tag":72,"props":544,"children":546},{"className":545},[],[547],{"type":47,"value":363},{"type":47,"value":549}," for mito testing uses the same key names with literal test values:",{"type":42,"tag":551,"props":552,"children":557},"pre",{"className":553,"code":554,"language":555,"meta":556,"style":556},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"url\": \"http:\u002F\u002Flocalhost:8090\",\n  \"api_key\": \"test-key\",\n  \"batch_size\": 50,\n  \"initial_interval\": \"24h\"\n}\n","json","",[558],{"type":42,"tag":72,"props":559,"children":560},{"__ignoreMap":556},[561,573,615,653,684,719],{"type":42,"tag":562,"props":563,"children":566},"span",{"class":564,"line":565},"line",1,[567],{"type":42,"tag":562,"props":568,"children":570},{"style":569},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[571],{"type":47,"value":572},"{\n",{"type":42,"tag":562,"props":574,"children":575},{"class":564,"line":27},[576,581,586,591,596,601,606,610],{"type":42,"tag":562,"props":577,"children":578},{"style":569},[579],{"type":47,"value":580},"  \"",{"type":42,"tag":562,"props":582,"children":584},{"style":583},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[585],{"type":47,"value":396},{"type":42,"tag":562,"props":587,"children":588},{"style":569},[589],{"type":47,"value":590},"\"",{"type":42,"tag":562,"props":592,"children":593},{"style":569},[594],{"type":47,"value":595},":",{"type":42,"tag":562,"props":597,"children":598},{"style":569},[599],{"type":47,"value":600}," \"",{"type":42,"tag":562,"props":602,"children":604},{"style":603},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[605],{"type":47,"value":338},{"type":42,"tag":562,"props":607,"children":608},{"style":569},[609],{"type":47,"value":590},{"type":42,"tag":562,"props":611,"children":612},{"style":569},[613],{"type":47,"value":614},",\n",{"type":42,"tag":562,"props":616,"children":618},{"class":564,"line":617},3,[619,623,628,632,636,640,645,649],{"type":42,"tag":562,"props":620,"children":621},{"style":569},[622],{"type":47,"value":580},{"type":42,"tag":562,"props":624,"children":625},{"style":583},[626],{"type":47,"value":627},"api_key",{"type":42,"tag":562,"props":629,"children":630},{"style":569},[631],{"type":47,"value":590},{"type":42,"tag":562,"props":633,"children":634},{"style":569},[635],{"type":47,"value":595},{"type":42,"tag":562,"props":637,"children":638},{"style":569},[639],{"type":47,"value":600},{"type":42,"tag":562,"props":641,"children":642},{"style":603},[643],{"type":47,"value":644},"test-key",{"type":42,"tag":562,"props":646,"children":647},{"style":569},[648],{"type":47,"value":590},{"type":42,"tag":562,"props":650,"children":651},{"style":569},[652],{"type":47,"value":614},{"type":42,"tag":562,"props":654,"children":656},{"class":564,"line":655},4,[657,661,666,670,674,680],{"type":42,"tag":562,"props":658,"children":659},{"style":569},[660],{"type":47,"value":580},{"type":42,"tag":562,"props":662,"children":663},{"style":583},[664],{"type":47,"value":665},"batch_size",{"type":42,"tag":562,"props":667,"children":668},{"style":569},[669],{"type":47,"value":590},{"type":42,"tag":562,"props":671,"children":672},{"style":569},[673],{"type":47,"value":595},{"type":42,"tag":562,"props":675,"children":677},{"style":676},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[678],{"type":47,"value":679}," 50",{"type":42,"tag":562,"props":681,"children":682},{"style":569},[683],{"type":47,"value":614},{"type":42,"tag":562,"props":685,"children":687},{"class":564,"line":686},5,[688,692,697,701,705,709,714],{"type":42,"tag":562,"props":689,"children":690},{"style":569},[691],{"type":47,"value":580},{"type":42,"tag":562,"props":693,"children":694},{"style":583},[695],{"type":47,"value":696},"initial_interval",{"type":42,"tag":562,"props":698,"children":699},{"style":569},[700],{"type":47,"value":590},{"type":42,"tag":562,"props":702,"children":703},{"style":569},[704],{"type":47,"value":595},{"type":42,"tag":562,"props":706,"children":707},{"style":569},[708],{"type":47,"value":600},{"type":42,"tag":562,"props":710,"children":711},{"style":603},[712],{"type":47,"value":713},"24h",{"type":42,"tag":562,"props":715,"children":716},{"style":569},[717],{"type":47,"value":718},"\"\n",{"type":42,"tag":562,"props":720,"children":722},{"class":564,"line":721},6,[723],{"type":42,"tag":562,"props":724,"children":725},{"style":569},[726],{"type":47,"value":727},"}\n",{"type":42,"tag":56,"props":729,"children":730},{},[731,733,739],{"type":47,"value":732},"This mirrors the runtime state the CEL input would provide. Add ",{"type":42,"tag":72,"props":734,"children":736},{"className":735},[],[737],{"type":47,"value":738},"cursor",{"type":47,"value":740}," to test subsequent-run behavior.",{"type":42,"tag":56,"props":742,"children":743},{},[744,746,752],{"type":47,"value":745},"For the full mock-first workflow details, CLI flags, execution model, and quality standards: load ",{"type":42,"tag":72,"props":747,"children":749},{"className":748},[],[750],{"type":47,"value":751},"references\u002Fmito-reference.md",{"type":47,"value":230},{"type":42,"tag":754,"props":755,"children":756},"hr",{},[],{"type":42,"tag":49,"props":758,"children":760},{"id":759},"celymlhbs-template-anatomy",[761],{"type":47,"value":762},"cel.yml.hbs template anatomy",{"type":42,"tag":56,"props":764,"children":765},{},[766,768,773,775,781],{"type":47,"value":767},"The ",{"type":42,"tag":72,"props":769,"children":771},{"className":770},[],[772],{"type":47,"value":77},{"type":47,"value":774}," file at ",{"type":42,"tag":72,"props":776,"children":778},{"className":777},[],[779],{"type":47,"value":780},"data_stream\u002F\u003Cstream>\u002Fagent\u002Fstream\u002Fcel.yml.hbs",{"type":47,"value":782}," is a Handlebars template that renders the final CEL input configuration. It has these sections in order:",{"type":42,"tag":551,"props":784,"children":788},{"className":785,"code":786,"language":787,"meta":556,"style":556},"language-yaml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","interval: {{interval}}\nresource.tracer:\n  enabled: {{enable_request_tracer}}\n  filename: \"..\u002F..\u002Flogs\u002Fcel\u002Fhttp-request-trace-*.ndjson\"\n  maxbackups: 5\n{{#if proxy_url}}\nresource.proxy_url: {{proxy_url}}\n{{\u002Fif}}\n{{#if ssl}}\nresource.ssl: {{ssl}}\n{{\u002Fif}}\n{{#if http_client_timeout}}\nresource.timeout: {{http_client_timeout}}\n{{\u002Fif}}\nresource.url: \u003Cconstructed from vars>\nstate:\n  \u003Ccredentials and pagination config from vars>\nredact:\n  fields:\n    - \u003Csensitive state keys>\nmax_executions: \u003Cnumber, for heavy pagination>\nprogram: |\n  \u003CCEL expression>\ntags:\n{{#if preserve_original_event}}\n  - preserve_original_event\n{{\u002Fif}}\n{{#each tags as |tag|}}\n  - {{tag}}\n{{\u002Feach}}\n{{#contains \"forwarded\" tags}}\npublisher_pipeline.disable_host: true\n{{\u002Fcontains}}\n{{#if processors}}\nprocessors:\n{{processors}}\n{{\u002Fif}}\n","yaml",[789],{"type":42,"tag":72,"props":790,"children":791},{"__ignoreMap":556},[792,819,832,857,882,899,922,948,965,986,1012,1027,1048,1074,1090,1108,1121,1130,1143,1156,1170,1188,1207,1216,1229,1250,1264,1280,1301,1321,1338,1359,1378,1395,1416,1429,1445],{"type":42,"tag":562,"props":793,"children":794},{"class":564,"line":565},[795,801,805,810,814],{"type":42,"tag":562,"props":796,"children":798},{"style":797},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[799],{"type":47,"value":800},"interval",{"type":42,"tag":562,"props":802,"children":803},{"style":569},[804],{"type":47,"value":595},{"type":42,"tag":562,"props":806,"children":807},{"style":569},[808],{"type":47,"value":809}," {{",{"type":42,"tag":562,"props":811,"children":812},{"style":603},[813],{"type":47,"value":800},{"type":42,"tag":562,"props":815,"children":816},{"style":569},[817],{"type":47,"value":818},"}}\n",{"type":42,"tag":562,"props":820,"children":821},{"class":564,"line":27},[822,827],{"type":42,"tag":562,"props":823,"children":824},{"style":797},[825],{"type":47,"value":826},"resource.tracer",{"type":42,"tag":562,"props":828,"children":829},{"style":569},[830],{"type":47,"value":831},":\n",{"type":42,"tag":562,"props":833,"children":834},{"class":564,"line":617},[835,840,844,848,853],{"type":42,"tag":562,"props":836,"children":837},{"style":797},[838],{"type":47,"value":839},"  enabled",{"type":42,"tag":562,"props":841,"children":842},{"style":569},[843],{"type":47,"value":595},{"type":42,"tag":562,"props":845,"children":846},{"style":569},[847],{"type":47,"value":809},{"type":42,"tag":562,"props":849,"children":850},{"style":603},[851],{"type":47,"value":852},"enable_request_tracer",{"type":42,"tag":562,"props":854,"children":855},{"style":569},[856],{"type":47,"value":818},{"type":42,"tag":562,"props":858,"children":859},{"class":564,"line":655},[860,865,869,873,878],{"type":42,"tag":562,"props":861,"children":862},{"style":797},[863],{"type":47,"value":864},"  filename",{"type":42,"tag":562,"props":866,"children":867},{"style":569},[868],{"type":47,"value":595},{"type":42,"tag":562,"props":870,"children":871},{"style":569},[872],{"type":47,"value":600},{"type":42,"tag":562,"props":874,"children":875},{"style":603},[876],{"type":47,"value":877},"..\u002F..\u002Flogs\u002Fcel\u002Fhttp-request-trace-*.ndjson",{"type":42,"tag":562,"props":879,"children":880},{"style":569},[881],{"type":47,"value":718},{"type":42,"tag":562,"props":883,"children":884},{"class":564,"line":686},[885,890,894],{"type":42,"tag":562,"props":886,"children":887},{"style":797},[888],{"type":47,"value":889},"  maxbackups",{"type":42,"tag":562,"props":891,"children":892},{"style":569},[893],{"type":47,"value":595},{"type":42,"tag":562,"props":895,"children":896},{"style":676},[897],{"type":47,"value":898}," 5\n",{"type":42,"tag":562,"props":900,"children":901},{"class":564,"line":721},[902,907,913,918],{"type":42,"tag":562,"props":903,"children":904},{"style":569},[905],{"type":47,"value":906},"{{",{"type":42,"tag":562,"props":908,"children":910},{"style":909},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[911],{"type":47,"value":912},"#",{"type":42,"tag":562,"props":914,"children":915},{"style":603},[916],{"type":47,"value":917},"if proxy_url",{"type":42,"tag":562,"props":919,"children":920},{"style":569},[921],{"type":47,"value":818},{"type":42,"tag":562,"props":923,"children":925},{"class":564,"line":924},7,[926,931,935,939,944],{"type":42,"tag":562,"props":927,"children":928},{"style":797},[929],{"type":47,"value":930},"resource.proxy_url",{"type":42,"tag":562,"props":932,"children":933},{"style":569},[934],{"type":47,"value":595},{"type":42,"tag":562,"props":936,"children":937},{"style":569},[938],{"type":47,"value":809},{"type":42,"tag":562,"props":940,"children":941},{"style":603},[942],{"type":47,"value":943},"proxy_url",{"type":42,"tag":562,"props":945,"children":946},{"style":569},[947],{"type":47,"value":818},{"type":42,"tag":562,"props":949,"children":951},{"class":564,"line":950},8,[952,956,961],{"type":42,"tag":562,"props":953,"children":954},{"style":569},[955],{"type":47,"value":906},{"type":42,"tag":562,"props":957,"children":958},{"style":603},[959],{"type":47,"value":960},"\u002Fif",{"type":42,"tag":562,"props":962,"children":963},{"style":569},[964],{"type":47,"value":818},{"type":42,"tag":562,"props":966,"children":968},{"class":564,"line":967},9,[969,973,977,982],{"type":42,"tag":562,"props":970,"children":971},{"style":569},[972],{"type":47,"value":906},{"type":42,"tag":562,"props":974,"children":975},{"style":909},[976],{"type":47,"value":912},{"type":42,"tag":562,"props":978,"children":979},{"style":603},[980],{"type":47,"value":981},"if ssl",{"type":42,"tag":562,"props":983,"children":984},{"style":569},[985],{"type":47,"value":818},{"type":42,"tag":562,"props":987,"children":989},{"class":564,"line":988},10,[990,995,999,1003,1008],{"type":42,"tag":562,"props":991,"children":992},{"style":797},[993],{"type":47,"value":994},"resource.ssl",{"type":42,"tag":562,"props":996,"children":997},{"style":569},[998],{"type":47,"value":595},{"type":42,"tag":562,"props":1000,"children":1001},{"style":569},[1002],{"type":47,"value":809},{"type":42,"tag":562,"props":1004,"children":1005},{"style":603},[1006],{"type":47,"value":1007},"ssl",{"type":42,"tag":562,"props":1009,"children":1010},{"style":569},[1011],{"type":47,"value":818},{"type":42,"tag":562,"props":1013,"children":1014},{"class":564,"line":23},[1015,1019,1023],{"type":42,"tag":562,"props":1016,"children":1017},{"style":569},[1018],{"type":47,"value":906},{"type":42,"tag":562,"props":1020,"children":1021},{"style":603},[1022],{"type":47,"value":960},{"type":42,"tag":562,"props":1024,"children":1025},{"style":569},[1026],{"type":47,"value":818},{"type":42,"tag":562,"props":1028,"children":1030},{"class":564,"line":1029},12,[1031,1035,1039,1044],{"type":42,"tag":562,"props":1032,"children":1033},{"style":569},[1034],{"type":47,"value":906},{"type":42,"tag":562,"props":1036,"children":1037},{"style":909},[1038],{"type":47,"value":912},{"type":42,"tag":562,"props":1040,"children":1041},{"style":603},[1042],{"type":47,"value":1043},"if http_client_timeout",{"type":42,"tag":562,"props":1045,"children":1046},{"style":569},[1047],{"type":47,"value":818},{"type":42,"tag":562,"props":1049,"children":1051},{"class":564,"line":1050},13,[1052,1057,1061,1065,1070],{"type":42,"tag":562,"props":1053,"children":1054},{"style":797},[1055],{"type":47,"value":1056},"resource.timeout",{"type":42,"tag":562,"props":1058,"children":1059},{"style":569},[1060],{"type":47,"value":595},{"type":42,"tag":562,"props":1062,"children":1063},{"style":569},[1064],{"type":47,"value":809},{"type":42,"tag":562,"props":1066,"children":1067},{"style":603},[1068],{"type":47,"value":1069},"http_client_timeout",{"type":42,"tag":562,"props":1071,"children":1072},{"style":569},[1073],{"type":47,"value":818},{"type":42,"tag":562,"props":1075,"children":1077},{"class":564,"line":1076},14,[1078,1082,1086],{"type":42,"tag":562,"props":1079,"children":1080},{"style":569},[1081],{"type":47,"value":906},{"type":42,"tag":562,"props":1083,"children":1084},{"style":603},[1085],{"type":47,"value":960},{"type":42,"tag":562,"props":1087,"children":1088},{"style":569},[1089],{"type":47,"value":818},{"type":42,"tag":562,"props":1091,"children":1093},{"class":564,"line":1092},15,[1094,1099,1103],{"type":42,"tag":562,"props":1095,"children":1096},{"style":797},[1097],{"type":47,"value":1098},"resource.url",{"type":42,"tag":562,"props":1100,"children":1101},{"style":569},[1102],{"type":47,"value":595},{"type":42,"tag":562,"props":1104,"children":1105},{"style":603},[1106],{"type":47,"value":1107}," \u003Cconstructed from vars>\n",{"type":42,"tag":562,"props":1109,"children":1111},{"class":564,"line":1110},16,[1112,1117],{"type":42,"tag":562,"props":1113,"children":1114},{"style":797},[1115],{"type":47,"value":1116},"state",{"type":42,"tag":562,"props":1118,"children":1119},{"style":569},[1120],{"type":47,"value":831},{"type":42,"tag":562,"props":1122,"children":1124},{"class":564,"line":1123},17,[1125],{"type":42,"tag":562,"props":1126,"children":1127},{"style":603},[1128],{"type":47,"value":1129},"  \u003Ccredentials and pagination config from vars>\n",{"type":42,"tag":562,"props":1131,"children":1133},{"class":564,"line":1132},18,[1134,1139],{"type":42,"tag":562,"props":1135,"children":1136},{"style":797},[1137],{"type":47,"value":1138},"redact",{"type":42,"tag":562,"props":1140,"children":1141},{"style":569},[1142],{"type":47,"value":831},{"type":42,"tag":562,"props":1144,"children":1146},{"class":564,"line":1145},19,[1147,1152],{"type":42,"tag":562,"props":1148,"children":1149},{"style":797},[1150],{"type":47,"value":1151},"  fields",{"type":42,"tag":562,"props":1153,"children":1154},{"style":569},[1155],{"type":47,"value":831},{"type":42,"tag":562,"props":1157,"children":1159},{"class":564,"line":1158},20,[1160,1165],{"type":42,"tag":562,"props":1161,"children":1162},{"style":569},[1163],{"type":47,"value":1164},"    -",{"type":42,"tag":562,"props":1166,"children":1167},{"style":603},[1168],{"type":47,"value":1169}," \u003Csensitive state keys>\n",{"type":42,"tag":562,"props":1171,"children":1173},{"class":564,"line":1172},21,[1174,1179,1183],{"type":42,"tag":562,"props":1175,"children":1176},{"style":797},[1177],{"type":47,"value":1178},"max_executions",{"type":42,"tag":562,"props":1180,"children":1181},{"style":569},[1182],{"type":47,"value":595},{"type":42,"tag":562,"props":1184,"children":1185},{"style":603},[1186],{"type":47,"value":1187}," \u003Cnumber, for heavy pagination>\n",{"type":42,"tag":562,"props":1189,"children":1191},{"class":564,"line":1190},22,[1192,1197,1201],{"type":42,"tag":562,"props":1193,"children":1194},{"style":797},[1195],{"type":47,"value":1196},"program",{"type":42,"tag":562,"props":1198,"children":1199},{"style":569},[1200],{"type":47,"value":595},{"type":42,"tag":562,"props":1202,"children":1204},{"style":1203},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[1205],{"type":47,"value":1206}," |\n",{"type":42,"tag":562,"props":1208,"children":1210},{"class":564,"line":1209},23,[1211],{"type":42,"tag":562,"props":1212,"children":1213},{"style":603},[1214],{"type":47,"value":1215},"  \u003CCEL expression>\n",{"type":42,"tag":562,"props":1217,"children":1219},{"class":564,"line":1218},24,[1220,1225],{"type":42,"tag":562,"props":1221,"children":1222},{"style":797},[1223],{"type":47,"value":1224},"tags",{"type":42,"tag":562,"props":1226,"children":1227},{"style":569},[1228],{"type":47,"value":831},{"type":42,"tag":562,"props":1230,"children":1232},{"class":564,"line":1231},25,[1233,1237,1241,1246],{"type":42,"tag":562,"props":1234,"children":1235},{"style":569},[1236],{"type":47,"value":906},{"type":42,"tag":562,"props":1238,"children":1239},{"style":909},[1240],{"type":47,"value":912},{"type":42,"tag":562,"props":1242,"children":1243},{"style":603},[1244],{"type":47,"value":1245},"if preserve_original_event",{"type":42,"tag":562,"props":1247,"children":1248},{"style":569},[1249],{"type":47,"value":818},{"type":42,"tag":562,"props":1251,"children":1253},{"class":564,"line":1252},26,[1254,1259],{"type":42,"tag":562,"props":1255,"children":1256},{"style":569},[1257],{"type":47,"value":1258},"  -",{"type":42,"tag":562,"props":1260,"children":1261},{"style":603},[1262],{"type":47,"value":1263}," preserve_original_event\n",{"type":42,"tag":562,"props":1265,"children":1267},{"class":564,"line":1266},27,[1268,1272,1276],{"type":42,"tag":562,"props":1269,"children":1270},{"style":569},[1271],{"type":47,"value":906},{"type":42,"tag":562,"props":1273,"children":1274},{"style":603},[1275],{"type":47,"value":960},{"type":42,"tag":562,"props":1277,"children":1278},{"style":569},[1279],{"type":47,"value":818},{"type":42,"tag":562,"props":1281,"children":1283},{"class":564,"line":1282},28,[1284,1288,1292,1297],{"type":42,"tag":562,"props":1285,"children":1286},{"style":569},[1287],{"type":47,"value":906},{"type":42,"tag":562,"props":1289,"children":1290},{"style":909},[1291],{"type":47,"value":912},{"type":42,"tag":562,"props":1293,"children":1294},{"style":603},[1295],{"type":47,"value":1296},"each tags as |tag|",{"type":42,"tag":562,"props":1298,"children":1299},{"style":569},[1300],{"type":47,"value":818},{"type":42,"tag":562,"props":1302,"children":1304},{"class":564,"line":1303},29,[1305,1309,1313,1317],{"type":42,"tag":562,"props":1306,"children":1307},{"style":569},[1308],{"type":47,"value":1258},{"type":42,"tag":562,"props":1310,"children":1311},{"style":569},[1312],{"type":47,"value":809},{"type":42,"tag":562,"props":1314,"children":1315},{"style":603},[1316],{"type":47,"value":15},{"type":42,"tag":562,"props":1318,"children":1319},{"style":569},[1320],{"type":47,"value":818},{"type":42,"tag":562,"props":1322,"children":1324},{"class":564,"line":1323},30,[1325,1329,1334],{"type":42,"tag":562,"props":1326,"children":1327},{"style":569},[1328],{"type":47,"value":906},{"type":42,"tag":562,"props":1330,"children":1331},{"style":603},[1332],{"type":47,"value":1333},"\u002Feach",{"type":42,"tag":562,"props":1335,"children":1336},{"style":569},[1337],{"type":47,"value":818},{"type":42,"tag":562,"props":1339,"children":1341},{"class":564,"line":1340},31,[1342,1346,1350,1355],{"type":42,"tag":562,"props":1343,"children":1344},{"style":569},[1345],{"type":47,"value":906},{"type":42,"tag":562,"props":1347,"children":1348},{"style":909},[1349],{"type":47,"value":912},{"type":42,"tag":562,"props":1351,"children":1352},{"style":603},[1353],{"type":47,"value":1354},"contains \"forwarded\" tags",{"type":42,"tag":562,"props":1356,"children":1357},{"style":569},[1358],{"type":47,"value":818},{"type":42,"tag":562,"props":1360,"children":1362},{"class":564,"line":1361},32,[1363,1368,1372],{"type":42,"tag":562,"props":1364,"children":1365},{"style":797},[1366],{"type":47,"value":1367},"publisher_pipeline.disable_host",{"type":42,"tag":562,"props":1369,"children":1370},{"style":569},[1371],{"type":47,"value":595},{"type":42,"tag":562,"props":1373,"children":1375},{"style":1374},"--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC",[1376],{"type":47,"value":1377}," true\n",{"type":42,"tag":562,"props":1379,"children":1381},{"class":564,"line":1380},33,[1382,1386,1391],{"type":42,"tag":562,"props":1383,"children":1384},{"style":569},[1385],{"type":47,"value":906},{"type":42,"tag":562,"props":1387,"children":1388},{"style":603},[1389],{"type":47,"value":1390},"\u002Fcontains",{"type":42,"tag":562,"props":1392,"children":1393},{"style":569},[1394],{"type":47,"value":818},{"type":42,"tag":562,"props":1396,"children":1398},{"class":564,"line":1397},34,[1399,1403,1407,1412],{"type":42,"tag":562,"props":1400,"children":1401},{"style":569},[1402],{"type":47,"value":906},{"type":42,"tag":562,"props":1404,"children":1405},{"style":909},[1406],{"type":47,"value":912},{"type":42,"tag":562,"props":1408,"children":1409},{"style":603},[1410],{"type":47,"value":1411},"if processors",{"type":42,"tag":562,"props":1413,"children":1414},{"style":569},[1415],{"type":47,"value":818},{"type":42,"tag":562,"props":1417,"children":1419},{"class":564,"line":1418},35,[1420,1425],{"type":42,"tag":562,"props":1421,"children":1422},{"style":797},[1423],{"type":47,"value":1424},"processors",{"type":42,"tag":562,"props":1426,"children":1427},{"style":569},[1428],{"type":47,"value":831},{"type":42,"tag":562,"props":1430,"children":1432},{"class":564,"line":1431},36,[1433,1437,1441],{"type":42,"tag":562,"props":1434,"children":1435},{"style":569},[1436],{"type":47,"value":906},{"type":42,"tag":562,"props":1438,"children":1439},{"style":603},[1440],{"type":47,"value":1424},{"type":42,"tag":562,"props":1442,"children":1443},{"style":569},[1444],{"type":47,"value":818},{"type":42,"tag":562,"props":1446,"children":1448},{"class":564,"line":1447},37,[1449,1453,1457],{"type":42,"tag":562,"props":1450,"children":1451},{"style":569},[1452],{"type":47,"value":906},{"type":42,"tag":562,"props":1454,"children":1455},{"style":603},[1456],{"type":47,"value":960},{"type":42,"tag":562,"props":1458,"children":1459},{"style":569},[1460],{"type":47,"value":818},{"type":42,"tag":1462,"props":1463,"children":1465},"h3",{"id":1464},"handlebars-patterns",[1466],{"type":47,"value":1467},"Handlebars patterns",{"type":42,"tag":232,"props":1469,"children":1470},{},[1471,1487],{"type":42,"tag":236,"props":1472,"children":1473},{},[1474],{"type":42,"tag":240,"props":1475,"children":1476},{},[1477,1482],{"type":42,"tag":244,"props":1478,"children":1479},{},[1480],{"type":47,"value":1481},"Pattern",{"type":42,"tag":244,"props":1483,"children":1484},{},[1485],{"type":47,"value":1486},"Purpose",{"type":42,"tag":260,"props":1488,"children":1489},{},[1490,1507,1524,1541],{"type":42,"tag":240,"props":1491,"children":1492},{},[1493,1502],{"type":42,"tag":267,"props":1494,"children":1495},{},[1496],{"type":42,"tag":72,"props":1497,"children":1499},{"className":1498},[],[1500],{"type":47,"value":1501},"{{var_name}}",{"type":42,"tag":267,"props":1503,"children":1504},{},[1505],{"type":47,"value":1506},"Direct variable substitution",{"type":42,"tag":240,"props":1508,"children":1509},{},[1510,1519],{"type":42,"tag":267,"props":1511,"children":1512},{},[1513],{"type":42,"tag":72,"props":1514,"children":1516},{"className":1515},[],[1517],{"type":47,"value":1518},"{{#if var_name}}...{{\u002Fif}}",{"type":42,"tag":267,"props":1520,"children":1521},{},[1522],{"type":47,"value":1523},"Conditional block for optional config",{"type":42,"tag":240,"props":1525,"children":1526},{},[1527,1536],{"type":42,"tag":267,"props":1528,"children":1529},{},[1530],{"type":42,"tag":72,"props":1531,"children":1533},{"className":1532},[],[1534],{"type":47,"value":1535},"{{#each tags as |tag|}}",{"type":42,"tag":267,"props":1537,"children":1538},{},[1539],{"type":47,"value":1540},"Iteration over list vars",{"type":42,"tag":240,"props":1542,"children":1543},{},[1544,1553],{"type":42,"tag":267,"props":1545,"children":1546},{},[1547],{"type":42,"tag":72,"props":1548,"children":1550},{"className":1549},[],[1551],{"type":47,"value":1552},"{{#contains \"forwarded\" tags}}",{"type":42,"tag":267,"props":1554,"children":1555},{},[1556],{"type":47,"value":1557},"Check if list contains value",{"type":42,"tag":1462,"props":1559,"children":1561},{"id":1560},"key-template-fields",[1562],{"type":47,"value":1563},"Key template fields",{"type":42,"tag":62,"props":1565,"children":1566},{},[1567,1584,1610,1620,1631,1641],{"type":42,"tag":66,"props":1568,"children":1569},{},[1570,1575,1577,1583],{"type":42,"tag":72,"props":1571,"children":1573},{"className":1572},[],[1574],{"type":47,"value":1098},{"type":47,"value":1576}," — base URL, often constructed from multiple vars (e.g., ",{"type":42,"tag":72,"props":1578,"children":1580},{"className":1579},[],[1581],{"type":47,"value":1582},"{{url}}\u002Fapi\u002Fv1\u002Fendpoint",{"type":47,"value":144},{"type":42,"tag":66,"props":1585,"children":1586},{},[1587,1593,1595,1601,1602,1608],{"type":42,"tag":72,"props":1588,"children":1590},{"className":1589},[],[1591],{"type":47,"value":1592},"resource.headers",{"type":47,"value":1594}," (ga 8.18.1) — static headers the same for every request (",{"type":42,"tag":72,"props":1596,"children":1598},{"className":1597},[],[1599],{"type":47,"value":1600},"Content-Type",{"type":47,"value":409},{"type":42,"tag":72,"props":1603,"children":1605},{"className":1604},[],[1606],{"type":47,"value":1607},"Accept",{"type":47,"value":1609},", API version headers). Set here rather than in-program when headers never vary. Applied before auth headers.",{"type":42,"tag":66,"props":1611,"children":1612},{},[1613,1618],{"type":42,"tag":72,"props":1614,"children":1616},{"className":1615},[],[1617],{"type":47,"value":388},{"type":47,"value":1619}," — block where manifest vars are injected as CEL state; credentials and pagination settings go here",{"type":42,"tag":66,"props":1621,"children":1622},{},[1623,1629],{"type":42,"tag":72,"props":1624,"children":1626},{"className":1625},[],[1627],{"type":47,"value":1628},"redact.fields",{"type":47,"value":1630}," — list state keys containing secrets to redact from debug logs",{"type":42,"tag":66,"props":1632,"children":1633},{},[1634,1639],{"type":42,"tag":72,"props":1635,"children":1637},{"className":1636},[],[1638],{"type":47,"value":1178},{"type":47,"value":1640}," — override default 1000 for integrations with heavy pagination (e.g., 5000)",{"type":42,"tag":66,"props":1642,"children":1643},{},[1644,1649],{"type":42,"tag":72,"props":1645,"children":1647},{"className":1646},[],[1648],{"type":47,"value":487},{"type":47,"value":1650}," — the CEL expression; must be a YAML literal block scalar",{"type":42,"tag":1462,"props":1652,"children":1654},{"id":1653},"do-not-set-data_streamdataset-in-integration-packages",[1655,1657,1663],{"type":47,"value":1656},"Do NOT set ",{"type":42,"tag":72,"props":1658,"children":1660},{"className":1659},[],[1661],{"type":47,"value":1662},"data_stream.dataset",{"type":47,"value":1664}," in integration packages",{"type":42,"tag":56,"props":1666,"children":1667},{},[1668,1673,1675,1681,1683,1688,1690,1695,1696,1701,1703,1708,1710,1715],{"type":42,"tag":199,"props":1669,"children":1670},{},[1671],{"type":47,"value":1672},"Integration packages",{"type":47,"value":1674}," (",{"type":42,"tag":72,"props":1676,"children":1678},{"className":1677},[],[1679],{"type":47,"value":1680},"type: integration",{"type":47,"value":1682},") must ",{"type":42,"tag":199,"props":1684,"children":1685},{},[1686],{"type":47,"value":1687},"never",{"type":47,"value":1689}," include ",{"type":42,"tag":72,"props":1691,"children":1693},{"className":1692},[],[1694],{"type":47,"value":1662},{"type":47,"value":416},{"type":42,"tag":72,"props":1697,"children":1699},{"className":1698},[],[1700],{"type":47,"value":77},{"type":47,"value":1702}," or define a ",{"type":42,"tag":72,"props":1704,"children":1706},{"className":1705},[],[1707],{"type":47,"value":1662},{"type":47,"value":1709}," manifest var. The framework automatically routes documents to the correct data stream. Setting ",{"type":42,"tag":72,"props":1711,"children":1713},{"className":1712},[],[1714],{"type":47,"value":1662},{"type":47,"value":1716}," overrides this routing and causes documents to land in the wrong index — typically resulting in \"0 hits\" during system tests.",{"type":42,"tag":56,"props":1718,"children":1719},{},[1720,1722,1727,1728,1734,1736,1741],{"type":47,"value":1721},"Only ",{"type":42,"tag":199,"props":1723,"children":1724},{},[1725],{"type":47,"value":1726},"input-type packages",{"type":47,"value":1674},{"type":42,"tag":72,"props":1729,"children":1731},{"className":1730},[],[1732],{"type":47,"value":1733},"type: input",{"type":47,"value":1735},") use ",{"type":42,"tag":72,"props":1737,"children":1739},{"className":1738},[],[1740],{"type":47,"value":1662},{"type":47,"value":1742}," because they have no predefined data streams.",{"type":42,"tag":49,"props":1744,"children":1746},{"id":1745},"data-stream-manifest-configuration",[1747],{"type":47,"value":1748},"Data stream manifest configuration",{"type":42,"tag":56,"props":1750,"children":1751},{},[1752,1754,1760],{"type":47,"value":1753},"The data stream ",{"type":42,"tag":72,"props":1755,"children":1757},{"className":1756},[],[1758],{"type":47,"value":1759},"manifest.yml",{"type":47,"value":1761}," defines the CEL input stream and its variables.",{"type":42,"tag":1462,"props":1763,"children":1765},{"id":1764},"standard-vars-every-cel-stream-should-include",[1766],{"type":47,"value":1767},"Standard vars every CEL stream should include",{"type":42,"tag":232,"props":1769,"children":1770},{},[1771,1791],{"type":42,"tag":236,"props":1772,"children":1773},{},[1774],{"type":42,"tag":240,"props":1775,"children":1776},{},[1777,1782,1787],{"type":42,"tag":244,"props":1778,"children":1779},{},[1780],{"type":47,"value":1781},"Var",{"type":42,"tag":244,"props":1783,"children":1784},{},[1785],{"type":47,"value":1786},"Type",{"type":42,"tag":244,"props":1788,"children":1789},{},[1790],{"type":47,"value":1486},{"type":42,"tag":260,"props":1792,"children":1793},{},[1794,1814,1841,1867,1888,1915,1935,1955,1976,1997],{"type":42,"tag":240,"props":1795,"children":1796},{},[1797,1805,1809],{"type":42,"tag":267,"props":1798,"children":1799},{},[1800],{"type":42,"tag":72,"props":1801,"children":1803},{"className":1802},[],[1804],{"type":47,"value":396},{"type":42,"tag":267,"props":1806,"children":1807},{},[1808],{"type":47,"value":47},{"type":42,"tag":267,"props":1810,"children":1811},{},[1812],{"type":47,"value":1813},"API base URL",{"type":42,"tag":240,"props":1815,"children":1816},{},[1817,1825,1829],{"type":42,"tag":267,"props":1818,"children":1819},{},[1820],{"type":42,"tag":72,"props":1821,"children":1823},{"className":1822},[],[1824],{"type":47,"value":800},{"type":42,"tag":267,"props":1826,"children":1827},{},[1828],{"type":47,"value":47},{"type":42,"tag":267,"props":1830,"children":1831},{},[1832,1834,1840],{"type":47,"value":1833},"Polling interval (e.g., ",{"type":42,"tag":72,"props":1835,"children":1837},{"className":1836},[],[1838],{"type":47,"value":1839},"5m",{"type":47,"value":144},{"type":42,"tag":240,"props":1842,"children":1843},{},[1844,1852,1856],{"type":42,"tag":267,"props":1845,"children":1846},{},[1847],{"type":42,"tag":72,"props":1848,"children":1850},{"className":1849},[],[1851],{"type":47,"value":696},{"type":42,"tag":267,"props":1853,"children":1854},{},[1855],{"type":47,"value":47},{"type":42,"tag":267,"props":1857,"children":1858},{},[1859,1861,1866],{"type":47,"value":1860},"Lookback window on first run (e.g., ",{"type":42,"tag":72,"props":1862,"children":1864},{"className":1863},[],[1865],{"type":47,"value":713},{"type":47,"value":144},{"type":42,"tag":240,"props":1868,"children":1869},{},[1870,1878,1883],{"type":42,"tag":267,"props":1871,"children":1872},{},[1873],{"type":42,"tag":72,"props":1874,"children":1876},{"className":1875},[],[1877],{"type":47,"value":852},{"type":42,"tag":267,"props":1879,"children":1880},{},[1881],{"type":47,"value":1882},"bool",{"type":42,"tag":267,"props":1884,"children":1885},{},[1886],{"type":47,"value":1887},"Enable HTTP request tracing",{"type":42,"tag":240,"props":1889,"children":1890},{},[1891,1899,1903],{"type":42,"tag":267,"props":1892,"children":1893},{},[1894],{"type":42,"tag":72,"props":1895,"children":1897},{"className":1896},[],[1898],{"type":47,"value":1069},{"type":42,"tag":267,"props":1900,"children":1901},{},[1902],{"type":47,"value":47},{"type":42,"tag":267,"props":1904,"children":1905},{},[1906,1908,1914],{"type":47,"value":1907},"Request timeout (e.g., ",{"type":42,"tag":72,"props":1909,"children":1911},{"className":1910},[],[1912],{"type":47,"value":1913},"30s",{"type":47,"value":144},{"type":42,"tag":240,"props":1916,"children":1917},{},[1918,1926,1930],{"type":42,"tag":267,"props":1919,"children":1920},{},[1921],{"type":42,"tag":72,"props":1922,"children":1924},{"className":1923},[],[1925],{"type":47,"value":943},{"type":42,"tag":267,"props":1927,"children":1928},{},[1929],{"type":47,"value":47},{"type":42,"tag":267,"props":1931,"children":1932},{},[1933],{"type":47,"value":1934},"HTTP proxy URL",{"type":42,"tag":240,"props":1936,"children":1937},{},[1938,1946,1950],{"type":42,"tag":267,"props":1939,"children":1940},{},[1941],{"type":42,"tag":72,"props":1942,"children":1944},{"className":1943},[],[1945],{"type":47,"value":1007},{"type":42,"tag":267,"props":1947,"children":1948},{},[1949],{"type":47,"value":787},{"type":42,"tag":267,"props":1951,"children":1952},{},[1953],{"type":47,"value":1954},"TLS configuration",{"type":42,"tag":240,"props":1956,"children":1957},{},[1958,1966,1971],{"type":42,"tag":267,"props":1959,"children":1960},{},[1961],{"type":42,"tag":72,"props":1962,"children":1964},{"className":1963},[],[1965],{"type":47,"value":1224},{"type":42,"tag":267,"props":1967,"children":1968},{},[1969],{"type":47,"value":1970},"text (multi)",{"type":42,"tag":267,"props":1972,"children":1973},{},[1974],{"type":47,"value":1975},"Event tags",{"type":42,"tag":240,"props":1977,"children":1978},{},[1979,1988,1992],{"type":42,"tag":267,"props":1980,"children":1981},{},[1982],{"type":42,"tag":72,"props":1983,"children":1985},{"className":1984},[],[1986],{"type":47,"value":1987},"preserve_original_event",{"type":42,"tag":267,"props":1989,"children":1990},{},[1991],{"type":47,"value":1882},{"type":42,"tag":267,"props":1993,"children":1994},{},[1995],{"type":47,"value":1996},"Keep original event",{"type":42,"tag":240,"props":1998,"children":1999},{},[2000,2008,2012],{"type":42,"tag":267,"props":2001,"children":2002},{},[2003],{"type":42,"tag":72,"props":2004,"children":2006},{"className":2005},[],[2007],{"type":47,"value":1424},{"type":42,"tag":267,"props":2009,"children":2010},{},[2011],{"type":47,"value":787},{"type":42,"tag":267,"props":2013,"children":2014},{},[2015],{"type":47,"value":2016},"Beat processors",{"type":42,"tag":56,"props":2018,"children":2019},{},[2020],{"type":47,"value":2021},"Auth-specific vars depend on the API (API key, OAuth client_id\u002Fsecret\u002Ftoken_url, bearer token, etc.).",{"type":42,"tag":56,"props":2023,"children":2024},{},[2025,2027,2032],{"type":47,"value":2026},"Declare ",{"type":42,"tag":72,"props":2028,"children":2030},{"className":2029},[],[2031],{"type":47,"value":852},{"type":47,"value":2033}," in the data stream manifest, not at the input level. Input-level tracing enables logging for all data streams in the policy.",{"type":42,"tag":1462,"props":2035,"children":2037},{"id":2036},"package-level-vs-data-stream-level-vars",[2038],{"type":47,"value":2039},"Package-level vs data-stream-level vars",{"type":42,"tag":62,"props":2041,"children":2042},{},[2043,2075],{"type":42,"tag":66,"props":2044,"children":2045},{},[2046,2051,2053,2058,2060,2066,2068,2073],{"type":42,"tag":199,"props":2047,"children":2048},{},[2049],{"type":47,"value":2050},"Package-level",{"type":47,"value":2052}," vars in the root ",{"type":42,"tag":72,"props":2054,"children":2056},{"className":2055},[],[2057],{"type":47,"value":1759},{"type":47,"value":2059}," under ",{"type":42,"tag":72,"props":2061,"children":2063},{"className":2062},[],[2064],{"type":47,"value":2065},"policy_templates[].inputs[].vars",{"type":47,"value":2067},": shared across streams (e.g., ",{"type":42,"tag":72,"props":2069,"children":2071},{"className":2070},[],[2072],{"type":47,"value":396},{"type":47,"value":2074},", auth credentials)",{"type":42,"tag":66,"props":2076,"children":2077},{},[2078,2083,2085,2091,2092,2098,2100,2105,2106,2111,2112,2117],{"type":42,"tag":199,"props":2079,"children":2080},{},[2081],{"type":47,"value":2082},"Data-stream-level",{"type":47,"value":2084}," vars in ",{"type":42,"tag":72,"props":2086,"children":2088},{"className":2087},[],[2089],{"type":47,"value":2090},"data_stream\u002F\u003Cstream>\u002Fmanifest.yml",{"type":47,"value":2059},{"type":42,"tag":72,"props":2093,"children":2095},{"className":2094},[],[2096],{"type":47,"value":2097},"streams[].vars",{"type":47,"value":2099},": stream-specific (e.g., ",{"type":42,"tag":72,"props":2101,"children":2103},{"className":2102},[],[2104],{"type":47,"value":800},{"type":47,"value":409},{"type":42,"tag":72,"props":2107,"children":2109},{"className":2108},[],[2110],{"type":47,"value":665},{"type":47,"value":409},{"type":42,"tag":72,"props":2113,"children":2115},{"className":2114},[],[2116],{"type":47,"value":696},{"type":47,"value":144},{"type":42,"tag":49,"props":2119,"children":2121},{"id":2120},"scope-of-the-cel-program",[2122],{"type":47,"value":2123},"Scope of the CEL program",{"type":42,"tag":56,"props":2125,"children":2126},{},[2127,2129,2134],{"type":47,"value":2128},"The CEL program's responsibility is ",{"type":42,"tag":199,"props":2130,"children":2131},{},[2132],{"type":47,"value":2133},"data collection only",{"type":47,"value":595},{"type":42,"tag":2136,"props":2137,"children":2138},"ol",{},[2139,2149,2159,2176],{"type":42,"tag":66,"props":2140,"children":2141},{},[2142,2147],{"type":42,"tag":199,"props":2143,"children":2144},{},[2145],{"type":47,"value":2146},"Fetch data",{"type":47,"value":2148}," from the API endpoint(s)",{"type":42,"tag":66,"props":2150,"children":2151},{},[2152,2157],{"type":42,"tag":199,"props":2153,"children":2154},{},[2155],{"type":47,"value":2156},"Handle pagination",{"type":47,"value":2158}," — walk through all pages within a single polling cycle",{"type":42,"tag":66,"props":2160,"children":2161},{},[2162,2167,2169,2174],{"type":42,"tag":199,"props":2163,"children":2164},{},[2165],{"type":47,"value":2166},"Manage cursor state",{"type":47,"value":2168}," — store timestamps or page tokens in ",{"type":42,"tag":72,"props":2170,"children":2172},{"className":2171},[],[2173],{"type":47,"value":738},{"type":47,"value":2175}," so the next polling interval resumes where the last one left off, avoiding re-collection of already-fetched events",{"type":42,"tag":66,"props":2177,"children":2178},{},[2179,2184,2186,2192],{"type":42,"tag":199,"props":2180,"children":2181},{},[2182],{"type":47,"value":2183},"Emit raw events",{"type":47,"value":2185}," — output ",{"type":42,"tag":72,"props":2187,"children":2189},{"className":2188},[],[2190],{"type":47,"value":2191},"{\"message\": e.encode_json()}",{"type":47,"value":2193}," for each record",{"type":42,"tag":56,"props":2195,"children":2196},{},[2197,2199,2204],{"type":47,"value":2198},"The CEL program does ",{"type":42,"tag":199,"props":2200,"children":2201},{},[2202],{"type":47,"value":2203},"not",{"type":47,"value":2205}," handle:",{"type":42,"tag":62,"props":2207,"children":2208},{},[2209,2227,2237],{"type":42,"tag":66,"props":2210,"children":2211},{},[2212,2217,2219,2225],{"type":42,"tag":199,"props":2213,"children":2214},{},[2215],{"type":47,"value":2216},"Elasticsearch-level deduplication",{"type":47,"value":2218}," — if overlapping time windows cause a few duplicate events to be collected, that is acceptable. The ingest pipeline or Elasticsearch ",{"type":42,"tag":72,"props":2220,"children":2222},{"className":2221},[],[2223],{"type":47,"value":2224},"_id",{"type":47,"value":2226}," routing handles dedup at index time, not the CEL program.",{"type":42,"tag":66,"props":2228,"children":2229},{},[2230,2235],{"type":42,"tag":199,"props":2231,"children":2232},{},[2233],{"type":47,"value":2234},"Field mapping or transformation",{"type":47,"value":2236}," — the ingest pipeline handles parsing, ECS mapping, and enrichment.",{"type":42,"tag":66,"props":2238,"children":2239},{},[2240,2245],{"type":42,"tag":199,"props":2241,"children":2242},{},[2243],{"type":47,"value":2244},"Filtering by content",{"type":47,"value":2246}," — unless the API supports server-side filtering parameters, do not filter events in the CEL program. Emit everything and let the pipeline decide.",{"type":42,"tag":56,"props":2248,"children":2249},{},[2250,2252,2257,2258,2264],{"type":47,"value":2251},"Do not search the codebase for ",{"type":42,"tag":72,"props":2253,"children":2255},{"className":2254},[],[2256],{"type":47,"value":2224},{"type":47,"value":409},{"type":42,"tag":72,"props":2259,"children":2261},{"className":2260},[],[2262],{"type":47,"value":2263},"document_id",{"type":47,"value":2265},", or deduplication patterns. These are not CEL concerns.",{"type":42,"tag":49,"props":2267,"children":2269},{"id":2268},"cel-program-structure-patterns",[2270],{"type":47,"value":2271},"CEL program structure patterns",{"type":42,"tag":1462,"props":2273,"children":2275},{"id":2274},"pagination-strategy-selection",[2276],{"type":47,"value":2277},"Pagination strategy selection",{"type":42,"tag":232,"props":2279,"children":2280},{},[2281,2301],{"type":42,"tag":236,"props":2282,"children":2283},{},[2284],{"type":42,"tag":240,"props":2285,"children":2286},{},[2287,2292,2296],{"type":42,"tag":244,"props":2288,"children":2289},{},[2290],{"type":47,"value":2291},"API behavior",{"type":42,"tag":244,"props":2293,"children":2294},{},[2295],{"type":47,"value":1481},{"type":42,"tag":244,"props":2297,"children":2298},{},[2299],{"type":47,"value":2300},"Key indicators",{"type":42,"tag":260,"props":2302,"children":2303},{},[2304,2342,2360,2392,2430,2473],{"type":42,"tag":240,"props":2305,"children":2306},{},[2307,2312,2317],{"type":42,"tag":267,"props":2308,"children":2309},{},[2310],{"type":47,"value":2311},"Returns total count + supports offset",{"type":42,"tag":267,"props":2313,"children":2314},{},[2315],{"type":47,"value":2316},"Offset pagination",{"type":42,"tag":267,"props":2318,"children":2319},{},[2320,2326,2327,2333,2334,2340],{"type":42,"tag":72,"props":2321,"children":2323},{"className":2322},[],[2324],{"type":47,"value":2325},"total_count",{"type":47,"value":409},{"type":42,"tag":72,"props":2328,"children":2330},{"className":2329},[],[2331],{"type":47,"value":2332},"offset",{"type":47,"value":409},{"type":42,"tag":72,"props":2335,"children":2337},{"className":2336},[],[2338],{"type":47,"value":2339},"limit",{"type":47,"value":2341}," in request\u002Fresponse",{"type":42,"tag":240,"props":2343,"children":2344},{},[2345,2350,2355],{"type":42,"tag":267,"props":2346,"children":2347},{},[2348],{"type":47,"value":2349},"Returns records since a timestamp",{"type":42,"tag":267,"props":2351,"children":2352},{},[2353],{"type":47,"value":2354},"Timestamp cursor",{"type":42,"tag":267,"props":2356,"children":2357},{},[2358],{"type":47,"value":2359},"Time-range params, no explicit page tokens",{"type":42,"tag":240,"props":2361,"children":2362},{},[2363,2376,2381],{"type":42,"tag":267,"props":2364,"children":2365},{},[2366,2368,2374],{"type":47,"value":2367},"Returns ",{"type":42,"tag":72,"props":2369,"children":2371},{"className":2370},[],[2372],{"type":47,"value":2373},"Link",{"type":47,"value":2375}," header with next URL",{"type":42,"tag":267,"props":2377,"children":2378},{},[2379],{"type":47,"value":2380},"Link header",{"type":42,"tag":267,"props":2382,"children":2383},{},[2384,2390],{"type":42,"tag":72,"props":2385,"children":2387},{"className":2386},[],[2388],{"type":47,"value":2389},"Link: \u003Curl>; rel=\"next\"",{"type":47,"value":2391}," in response headers",{"type":42,"tag":240,"props":2393,"children":2394},{},[2395,2400,2405],{"type":42,"tag":267,"props":2396,"children":2397},{},[2398],{"type":47,"value":2399},"Returns next-page URL in response body",{"type":42,"tag":267,"props":2401,"children":2402},{},[2403],{"type":47,"value":2404},"Next-URL",{"type":42,"tag":267,"props":2406,"children":2407},{},[2408,2414,2415,2421,2422,2428],{"type":42,"tag":72,"props":2409,"children":2411},{"className":2410},[],[2412],{"type":47,"value":2413},"next",{"type":47,"value":409},{"type":42,"tag":72,"props":2416,"children":2418},{"className":2417},[],[2419],{"type":47,"value":2420},"nextLink",{"type":47,"value":409},{"type":42,"tag":72,"props":2423,"children":2425},{"className":2424},[],[2426],{"type":47,"value":2427},"@odata.nextLink",{"type":47,"value":2429}," field in JSON",{"type":42,"tag":240,"props":2431,"children":2432},{},[2433,2444,2449],{"type":42,"tag":267,"props":2434,"children":2435},{},[2436,2438],{"type":47,"value":2437},"GraphQL with ",{"type":42,"tag":72,"props":2439,"children":2441},{"className":2440},[],[2442],{"type":47,"value":2443},"pageInfo",{"type":42,"tag":267,"props":2445,"children":2446},{},[2447],{"type":47,"value":2448},"GraphQL cursor",{"type":42,"tag":267,"props":2450,"children":2451},{},[2452,2458,2459,2465,2466,2471],{"type":42,"tag":72,"props":2453,"children":2455},{"className":2454},[],[2456],{"type":47,"value":2457},"hasNextPage",{"type":47,"value":409},{"type":42,"tag":72,"props":2460,"children":2462},{"className":2461},[],[2463],{"type":47,"value":2464},"endCursor",{"type":47,"value":416},{"type":42,"tag":72,"props":2467,"children":2469},{"className":2468},[],[2470],{"type":47,"value":2443},{"type":47,"value":2472}," object",{"type":42,"tag":240,"props":2474,"children":2475},{},[2476,2481,2486],{"type":42,"tag":267,"props":2477,"children":2478},{},[2479],{"type":47,"value":2480},"Multi-phase subscription\u002Fcontent flow",{"type":42,"tag":267,"props":2482,"children":2483},{},[2484],{"type":47,"value":2485},"Multi-step state machine",{"type":42,"tag":267,"props":2487,"children":2488},{},[2489],{"type":47,"value":2490},"Multiple API calls with work queues in state",{"type":42,"tag":56,"props":2492,"children":2493},{},[2494,2499,2501,2506,2508,2513,2515,2521],{"type":42,"tag":199,"props":2495,"children":2496},{},[2497],{"type":47,"value":2498},"Cursor timestamp selection",{"type":47,"value":2500}," — use the ",{"type":42,"tag":199,"props":2502,"children":2503},{},[2504],{"type":47,"value":2505},"last",{"type":47,"value":2507}," record's timestamp when the API sorts ascending; ",{"type":42,"tag":199,"props":2509,"children":2510},{},[2511],{"type":47,"value":2512},"first",{"type":47,"value":2514}," when descending; ",{"type":42,"tag":72,"props":2516,"children":2518},{"className":2517},[],[2519],{"type":47,"value":2520},"max()",{"type":47,"value":2522}," with a regression guard when sort order is not guaranteed.",{"type":42,"tag":56,"props":2524,"children":2525},{},[2526,2528,2534],{"type":47,"value":2527},"Full code, package references, and YAML snippets for each pattern: ",{"type":42,"tag":72,"props":2529,"children":2531},{"className":2530},[],[2532],{"type":47,"value":2533},"references\u002Fcel-pagination-patterns.md",{"type":47,"value":230},{"type":42,"tag":49,"props":2536,"children":2538},{"id":2537},"authentication-patterns",[2539],{"type":47,"value":2540},"Authentication patterns",{"type":42,"tag":56,"props":2542,"children":2543},{},[2544,2546,2551,2553,2558,2560,2566,2568,2573,2575,2581,2583,2588,2590,2596,2598,2604,2605,2611,2613,2619,2621,2627,2628,2634,2636,2642,2643,2649],{"type":47,"value":2545},"Three strategies: ",{"type":42,"tag":199,"props":2547,"children":2548},{},[2549],{"type":47,"value":2550},"header",{"type":47,"value":2552}," (credentials in ",{"type":42,"tag":72,"props":2554,"children":2556},{"className":2555},[],[2557],{"type":47,"value":388},{"type":47,"value":2559},", passed via ",{"type":42,"tag":72,"props":2561,"children":2563},{"className":2562},[],[2564],{"type":47,"value":2565},"Header",{"type":47,"value":2567}," map), ",{"type":42,"tag":199,"props":2569,"children":2570},{},[2571],{"type":47,"value":2572},"query parameter",{"type":47,"value":2574}," (credentials appended to URL via ",{"type":42,"tag":72,"props":2576,"children":2578},{"className":2577},[],[2579],{"type":47,"value":2580},".format_query()",{"type":47,"value":2582},"), ",{"type":42,"tag":199,"props":2584,"children":2585},{},[2586],{"type":47,"value":2587},"signed query",{"type":47,"value":2589}," (HMAC signature computed in CEL). Config-level ",{"type":42,"tag":72,"props":2591,"children":2593},{"className":2592},[],[2594],{"type":47,"value":2595},"auth.oauth2",{"type":47,"value":2597},"\u002F",{"type":42,"tag":72,"props":2599,"children":2601},{"className":2600},[],[2602],{"type":47,"value":2603},"auth.digest",{"type":47,"value":2597},{"type":42,"tag":72,"props":2606,"children":2608},{"className":2607},[],[2609],{"type":47,"value":2610},"auth.aws",{"type":47,"value":2612}," applies to all requests including ",{"type":42,"tag":72,"props":2614,"children":2616},{"className":2615},[],[2617],{"type":47,"value":2618},".do_request()",{"type":47,"value":2620},"; ",{"type":42,"tag":72,"props":2622,"children":2624},{"className":2623},[],[2625],{"type":47,"value":2626},"auth.basic",{"type":47,"value":2597},{"type":42,"tag":72,"props":2629,"children":2631},{"className":2630},[],[2632],{"type":47,"value":2633},"auth.token",{"type":47,"value":2635}," applies only to direct calls (",{"type":42,"tag":72,"props":2637,"children":2639},{"className":2638},[],[2640],{"type":47,"value":2641},"get()",{"type":47,"value":409},{"type":42,"tag":72,"props":2644,"children":2646},{"className":2645},[],[2647],{"type":47,"value":2648},"post()",{"type":47,"value":2650},"). Prefer input-level auth over in-program token fetching.",{"type":42,"tag":56,"props":2652,"children":2653},{},[2654,2656,2662],{"type":47,"value":2655},"For full code examples, optional-header syntax, and config-level auth scope details: load ",{"type":42,"tag":72,"props":2657,"children":2659},{"className":2658},[],[2660],{"type":47,"value":2661},"references\u002Fcel-auth-patterns.md",{"type":47,"value":230},{"type":42,"tag":49,"props":2664,"children":2666},{"id":2665},"state-management-rules",[2667],{"type":47,"value":2668},"State management rules",{"type":42,"tag":2136,"props":2670,"children":2671},{},[2672,2693,2706,2720,2785,2803,2821,2839,2879,2889,2920],{"type":42,"tag":66,"props":2673,"children":2674},{},[2675,2684,2686,2691],{"type":42,"tag":199,"props":2676,"children":2677},{},[2678],{"type":42,"tag":72,"props":2679,"children":2681},{"className":2680},[],[2682],{"type":47,"value":2683},"state.url",{"type":47,"value":2685}," is populated from ",{"type":42,"tag":72,"props":2687,"children":2689},{"className":2688},[],[2690],{"type":47,"value":1098},{"type":47,"value":2692}," config; must be preserved in output or hardcoded",{"type":42,"tag":66,"props":2694,"children":2695},{},[2696,2704],{"type":42,"tag":199,"props":2697,"children":2698},{},[2699],{"type":42,"tag":72,"props":2700,"children":2702},{"className":2701},[],[2703],{"type":47,"value":738},{"type":47,"value":2705}," is the only state persisted across input restarts; store pagination positions and timestamps here",{"type":42,"tag":66,"props":2707,"children":2708},{},[2709,2718],{"type":42,"tag":199,"props":2710,"children":2711},{},[2712],{"type":42,"tag":72,"props":2713,"children":2715},{"className":2714},[],[2716],{"type":47,"value":2717},"events",{"type":47,"value":2719}," array is removed after each evaluation; never rely on it in subsequent runs",{"type":42,"tag":66,"props":2721,"children":2722},{},[2723,2732,2734,2739,2741,2746,2748,2753,2755,2761,2763,2769,2771,2776,2778,2784],{"type":42,"tag":199,"props":2724,"children":2725},{},[2726],{"type":42,"tag":72,"props":2727,"children":2729},{"className":2728},[],[2730],{"type":47,"value":2731},"want_more: true",{"type":47,"value":2733}," triggers immediate re-evaluation, but only if ",{"type":42,"tag":72,"props":2735,"children":2737},{"className":2736},[],[2738],{"type":47,"value":2717},{"type":47,"value":2740}," is non-empty. ",{"type":42,"tag":199,"props":2742,"children":2743},{},[2744],{"type":47,"value":2745},"Pagination continuation guardrail:",{"type":47,"value":2747}," when a next-page cursor\u002Ftoken exists, always set ",{"type":42,"tag":72,"props":2749,"children":2751},{"className":2750},[],[2752],{"type":47,"value":2731},{"type":47,"value":2754}," regardless of how many events were collected on the current page. Tying ",{"type":42,"tag":72,"props":2756,"children":2758},{"className":2757},[],[2759],{"type":47,"value":2760},"want_more",{"type":47,"value":2762}," to ",{"type":42,"tag":72,"props":2764,"children":2766},{"className":2765},[],[2767],{"type":47,"value":2768},"size(events) > 0",{"type":47,"value":2770}," stalls pagination silently — the next cursor is valid, and an empty ",{"type":42,"tag":72,"props":2772,"children":2774},{"className":2773},[],[2775],{"type":47,"value":2717},{"type":47,"value":2777}," array is safe to emit. The correct pattern is ",{"type":42,"tag":72,"props":2779,"children":2781},{"className":2780},[],[2782],{"type":47,"value":2783},"\"want_more\": next_cursor != \"\"",{"type":47,"value":230},{"type":42,"tag":66,"props":2786,"children":2787},{},[2788,2793,2795,2801],{"type":42,"tag":199,"props":2789,"children":2790},{},[2791],{"type":47,"value":2792},"All other state keys",{"type":47,"value":2794}," are retained within a session but lost on restart — use ",{"type":42,"tag":72,"props":2796,"children":2798},{"className":2797},[],[2799],{"type":47,"value":2800},"state.with()",{"type":47,"value":2802}," to propagate them automatically",{"type":42,"tag":66,"props":2804,"children":2805},{},[2806,2811,2813,2819],{"type":42,"tag":199,"props":2807,"children":2808},{},[2809],{"type":47,"value":2810},"Numbers",{"type":47,"value":2812}," are serialized as floats in state JSON; cast with ",{"type":42,"tag":72,"props":2814,"children":2816},{"className":2815},[],[2817],{"type":47,"value":2818},"int()",{"type":47,"value":2820}," when using as integers",{"type":42,"tag":66,"props":2822,"children":2823},{},[2824,2829,2831,2837],{"type":42,"tag":199,"props":2825,"children":2826},{},[2827],{"type":47,"value":2828},"Optional access",{"type":47,"value":2830}," with ",{"type":42,"tag":72,"props":2832,"children":2834},{"className":2833},[],[2835],{"type":47,"value":2836},"state.?cursor.last_timestamp.orValue(default)",{"type":47,"value":2838}," prevents errors when cursor is absent",{"type":42,"tag":66,"props":2840,"children":2841},{},[2842,2847,2849,2854,2856,2861,2863,2869,2871,2877],{"type":42,"tag":199,"props":2843,"children":2844},{},[2845],{"type":47,"value":2846},"Secrets",{"type":47,"value":2848}," — every sensitive field in ",{"type":42,"tag":72,"props":2850,"children":2852},{"className":2851},[],[2853],{"type":47,"value":1116},{"type":47,"value":2855}," must have a corresponding ",{"type":42,"tag":72,"props":2857,"children":2859},{"className":2858},[],[2860],{"type":47,"value":1138},{"type":47,"value":2862}," entry. ",{"type":42,"tag":72,"props":2864,"children":2866},{"className":2865},[],[2867],{"type":47,"value":2868},"state.secret",{"type":47,"value":2870}," is always redacted automatically. When ",{"type":42,"tag":72,"props":2872,"children":2874},{"className":2873},[],[2875],{"type":47,"value":2876},"secret_state",{"type":47,"value":2878}," (ga 9.4.0) is available, prefer it.",{"type":42,"tag":66,"props":2880,"children":2881},{},[2882,2887],{"type":42,"tag":199,"props":2883,"children":2884},{},[2885],{"type":47,"value":2886},"Cursor updates require a published event",{"type":47,"value":2888}," — the input only persists cursor updates when at least one event is published. If a program updates the cursor but returns zero events, the cursor change is lost.",{"type":42,"tag":66,"props":2890,"children":2891},{},[2892,2897,2899,2904,2906,2912,2914,2919],{"type":42,"tag":199,"props":2893,"children":2894},{},[2895],{"type":47,"value":2896},"Do not duplicate request\u002Fresponse handling across branches",{"type":47,"value":2898}," — when an initialization branch (cursor creation, subscription, token exchange) and a steady-state branch both need the same fetch logic, consolidate it. Two approaches: split the init into a separate evaluation via ",{"type":42,"tag":72,"props":2900,"children":2902},{"className":2901},[],[2903],{"type":47,"value":2731},{"type":47,"value":2905}," (Technique 6 Variant A), or use an intermediate result map to unify the branches within one evaluation (Variant B). Both are valid — see ",{"type":42,"tag":72,"props":2907,"children":2909},{"className":2908},[],[2910],{"type":47,"value":2911},"references\u002Fcel-code-style.md",{"type":47,"value":2913}," Technique 6 and the init-then-steady-state pattern in ",{"type":42,"tag":72,"props":2915,"children":2917},{"className":2916},[],[2918],{"type":47,"value":2533},{"type":47,"value":230},{"type":42,"tag":66,"props":2921,"children":2922},{},[2923,2928,2930,2936,2938,2943,2944,2950,2952,2958,2960,2966,2968,2973,2975,2981,2983,2988,2990,2995],{"type":42,"tag":199,"props":2924,"children":2925},{},[2926],{"type":47,"value":2927},"Nesting depth",{"type":47,"value":2929}," — ",{"type":42,"tag":72,"props":2931,"children":2933},{"className":2932},[],[2934],{"type":47,"value":2935},".as()",{"type":47,"value":2937}," chain depth must not exceed 5 levels on any execution path. HTTP programs must target 2 levels inside ",{"type":42,"tag":72,"props":2939,"children":2941},{"className":2940},[],[2942],{"type":47,"value":2800},{"type":47,"value":1674},{"type":42,"tag":72,"props":2945,"children":2947},{"className":2946},[],[2948],{"type":47,"value":2949},"resp",{"type":47,"value":2951}," + ",{"type":42,"tag":72,"props":2953,"children":2955},{"className":2954},[],[2956],{"type":47,"value":2957},"body",{"type":47,"value":2959},"). Cursor defaults, window bounds, and page tokens must be extracted as pre-bindings ",{"type":42,"tag":2961,"props":2962,"children":2963},"em",{},[2964],{"type":47,"value":2965},"before",{"type":47,"value":2967}," ",{"type":42,"tag":72,"props":2969,"children":2971},{"className":2970},[],[2972],{"type":47,"value":2800},{"type":47,"value":2974},". Single-use values such as ",{"type":42,"tag":72,"props":2976,"children":2978},{"className":2977},[],[2979],{"type":47,"value":2980},"int(state.batch_size)",{"type":47,"value":2982}," must be inlined at the call site, not wrapped in ",{"type":42,"tag":72,"props":2984,"children":2986},{"className":2985},[],[2987],{"type":47,"value":2935},{"type":47,"value":2989},". Load ",{"type":42,"tag":72,"props":2991,"children":2993},{"className":2992},[],[2994],{"type":47,"value":2911},{"type":47,"value":2996}," for flattening techniques and before\u002Fafter examples.",{"type":42,"tag":1462,"props":2998,"children":3000},{"id":2999},"map-merge-and-field-removal",[3001],{"type":47,"value":3002},"Map merge and field removal",{"type":42,"tag":56,"props":3004,"children":3005},{},[3006,3012,3013,3019,3020,3026,3028,3034,3036,3041,3043,3048,3050,3055],{"type":42,"tag":72,"props":3007,"children":3009},{"className":3008},[],[3010],{"type":47,"value":3011},"with()",{"type":47,"value":409},{"type":42,"tag":72,"props":3014,"children":3016},{"className":3015},[],[3017],{"type":47,"value":3018},"with_replace()",{"type":47,"value":409},{"type":42,"tag":72,"props":3021,"children":3023},{"className":3022},[],[3024],{"type":47,"value":3025},"with_update()",{"type":47,"value":3027},", and ",{"type":42,"tag":72,"props":3029,"children":3031},{"className":3030},[],[3032],{"type":47,"value":3033},"drop()",{"type":47,"value":3035}," are general-purpose map operations — they work on any map, not just state or cursor. ",{"type":42,"tag":72,"props":3037,"children":3039},{"className":3038},[],[3040],{"type":47,"value":3011},{"type":47,"value":3042}," does a ",{"type":42,"tag":199,"props":3044,"children":3045},{},[3046],{"type":47,"value":3047},"shallow merge",{"type":47,"value":3049},": nested objects are replaced entirely. This makes it a tool for cursor state transitions (omitting a sub-object removes it via clobber) as well as for building request headers, transforming response data, and constructing intermediate maps. Full semantics and examples: ",{"type":42,"tag":72,"props":3051,"children":3053},{"className":3052},[],[3054],{"type":47,"value":2911},{"type":47,"value":230},{"type":42,"tag":49,"props":3057,"children":3059},{"id":3058},"event-output-format",[3060],{"type":47,"value":3061},"Event output format",{"type":42,"tag":56,"props":3063,"children":3064},{},[3065,3076,3077,3082,3084,3090,3092,3097,3099,3105],{"type":42,"tag":199,"props":3066,"children":3067},{},[3068,3070],{"type":47,"value":3069},"Events must contain ONLY ",{"type":42,"tag":72,"props":3071,"children":3073},{"className":3072},[],[3074],{"type":47,"value":3075},"\"message\"",{"type":47,"value":2929},{"type":42,"tag":72,"props":3078,"children":3080},{"className":3079},[],[3081],{"type":47,"value":2191},{"type":47,"value":3083},". Do not set ",{"type":42,"tag":72,"props":3085,"children":3087},{"className":3086},[],[3088],{"type":47,"value":3089},"@timestamp",{"type":47,"value":3091}," or any other field; the framework adds ",{"type":42,"tag":72,"props":3093,"children":3095},{"className":3094},[],[3096],{"type":47,"value":3089},{"type":47,"value":3098},", and duplicates cause silent document rejection in ES 9.x. See ",{"type":42,"tag":72,"props":3100,"children":3102},{"className":3101},[],[3103],{"type":47,"value":3104},"references\u002Fcel-idioms.md",{"type":47,"value":3106}," for correct\u002Fincorrect examples.",{"type":42,"tag":49,"props":3108,"children":3110},{"id":3109},"response-handling",[3111],{"type":47,"value":3112},"Response handling",{"type":42,"tag":56,"props":3114,"children":3115},{},[3116,3125,3127,3133,3135,3140],{"type":42,"tag":199,"props":3117,"children":3118},{},[3119],{"type":42,"tag":72,"props":3120,"children":3122},{"className":3121},[],[3123],{"type":47,"value":3124},"resp.Body.decode_json()",{"type":47,"value":3126}," — the ",{"type":42,"tag":72,"props":3128,"children":3130},{"className":3129},[],[3131],{"type":47,"value":3132},"bytes(resp.Body)",{"type":47,"value":3134}," wrapper was required in older runtime versions but is no longer needed. Use ",{"type":42,"tag":72,"props":3136,"children":3138},{"className":3137},[],[3139],{"type":47,"value":3124},{"type":47,"value":3141}," directly.",{"type":42,"tag":49,"props":3143,"children":3145},{"id":3144},"error-handling",[3146],{"type":47,"value":3147},"Error handling",{"type":42,"tag":56,"props":3149,"children":3150},{},[3151],{"type":47,"value":3152},"Every CEL program must handle HTTP errors. Two forms:",{"type":42,"tag":62,"props":3154,"children":3155},{},[3156,3180],{"type":42,"tag":66,"props":3157,"children":3158},{},[3159,3164,3165,3171,3173,3178],{"type":42,"tag":199,"props":3160,"children":3161},{},[3162],{"type":47,"value":3163},"Single-object error (retry):",{"type":47,"value":2967},{"type":42,"tag":72,"props":3166,"children":3168},{"className":3167},[],[3169],{"type":47,"value":3170},"\"events\": {\"error\": {...}}",{"type":47,"value":3172}," — logs at ERROR, sets degraded status, ",{"type":42,"tag":199,"props":3174,"children":3175},{},[3176],{"type":47,"value":3177},"deletes the cursor",{"type":47,"value":3179}," so the next evaluation retries. Use when data was not collected.",{"type":42,"tag":66,"props":3181,"children":3182},{},[3183,3188,3189,3195,3197,3202,3204,3210],{"type":42,"tag":199,"props":3184,"children":3185},{},[3186],{"type":47,"value":3187},"Array error (advance):",{"type":47,"value":2967},{"type":42,"tag":72,"props":3190,"children":3192},{"className":3191},[],[3193],{"type":47,"value":3194},"\"events\": [{\"error\": {...}}]",{"type":47,"value":3196}," — cursor ",{"type":42,"tag":199,"props":3198,"children":3199},{},[3200],{"type":47,"value":3201},"is",{"type":47,"value":3203}," updated. Use when the program should advance past the error. Requires a ",{"type":42,"tag":72,"props":3205,"children":3207},{"className":3206},[],[3208],{"type":47,"value":3209},"terminate",{"type":47,"value":3211}," processor in the ingest pipeline (ES 8.16.0+).",{"type":42,"tag":56,"props":3213,"children":3214},{},[3215,3217,3223,3225,3230],{"type":47,"value":3216},"Error message format: ",{"type":42,"tag":72,"props":3218,"children":3220},{"className":3219},[],[3221],{"type":47,"value":3222},"\"METHOD path: body-or-status\"",{"type":47,"value":3224},". Code examples: ",{"type":42,"tag":72,"props":3226,"children":3228},{"className":3227},[],[3229],{"type":47,"value":3104},{"type":47,"value":230},{"type":42,"tag":1462,"props":3232,"children":3234},{"id":3233},"placeholder-events",[3235],{"type":47,"value":3236},"Placeholder events",{"type":42,"tag":56,"props":3238,"children":3239},{},[3240,3242,3248,3250,3256,3258,3264,3266,3271],{"type":47,"value":3241},"When advancing the cursor with no real events, emit a placeholder (",{"type":42,"tag":72,"props":3243,"children":3245},{"className":3244},[],[3246],{"type":47,"value":3247},"[{\"retry\": true}]",{"type":47,"value":3249},") and add a ",{"type":42,"tag":72,"props":3251,"children":3253},{"className":3252},[],[3254],{"type":47,"value":3255},"- drop_event.when.equals.retry: true",{"type":47,"value":3257}," entry in the ",{"type":42,"tag":72,"props":3259,"children":3261},{"className":3260},[],[3262],{"type":47,"value":3263},"processors:",{"type":47,"value":3265}," section so it is discarded before indexing. Full pattern and alternatives: ",{"type":42,"tag":72,"props":3267,"children":3269},{"className":3268},[],[3270],{"type":47,"value":3104},{"type":47,"value":230},{"type":42,"tag":49,"props":3273,"children":3275},{"id":3274},"rate-limiting-and-retry",[3276],{"type":47,"value":3277},"Rate limiting and retry",{"type":42,"tag":56,"props":3279,"children":3280},{},[3281,3286,3288,3294,3296,3302],{"type":42,"tag":199,"props":3282,"children":3283},{},[3284],{"type":47,"value":3285},"Do NOT implement rate limiting or retry logic in the CEL program.",{"type":47,"value":3287}," No ",{"type":42,"tag":72,"props":3289,"children":3291},{"className":3290},[],[3292],{"type":47,"value":3293},"rate_limit()",{"type":47,"value":3295}," calls, no ",{"type":42,"tag":72,"props":3297,"children":3299},{"className":3298},[],[3300],{"type":47,"value":3301},"\"rate_limit\"",{"type":47,"value":3303}," state propagation, no 429-specific branches, no retry loops. These add excessive nesting and complexity for marginal benefit.",{"type":42,"tag":56,"props":3305,"children":3306},{},[3307,3309,3314],{"type":47,"value":3308},"When an API has a documented rate limit, use config-only YAML settings in ",{"type":42,"tag":72,"props":3310,"children":3312},{"className":3311},[],[3313],{"type":47,"value":77},{"type":47,"value":595},{"type":42,"tag":551,"props":3316,"children":3318},{"className":785,"code":3317,"language":787,"meta":556,"style":556},"resource.rate_limit.limit: 10   # max requests per second\nresource.rate_limit.burst: 5    # max burst above sustained rate\n",[3319],{"type":42,"tag":72,"props":3320,"children":3321},{"__ignoreMap":556},[3322,3345],{"type":42,"tag":562,"props":3323,"children":3324},{"class":564,"line":565},[3325,3330,3334,3339],{"type":42,"tag":562,"props":3326,"children":3327},{"style":797},[3328],{"type":47,"value":3329},"resource.rate_limit.limit",{"type":42,"tag":562,"props":3331,"children":3332},{"style":569},[3333],{"type":47,"value":595},{"type":42,"tag":562,"props":3335,"children":3336},{"style":676},[3337],{"type":47,"value":3338}," 10",{"type":42,"tag":562,"props":3340,"children":3342},{"style":3341},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[3343],{"type":47,"value":3344},"   # max requests per second\n",{"type":42,"tag":562,"props":3346,"children":3347},{"class":564,"line":27},[3348,3353,3357,3362],{"type":42,"tag":562,"props":3349,"children":3350},{"style":797},[3351],{"type":47,"value":3352},"resource.rate_limit.burst",{"type":42,"tag":562,"props":3354,"children":3355},{"style":569},[3356],{"type":47,"value":595},{"type":42,"tag":562,"props":3358,"children":3359},{"style":676},[3360],{"type":47,"value":3361}," 5",{"type":42,"tag":562,"props":3363,"children":3364},{"style":3341},[3365],{"type":47,"value":3366},"    # max burst above sustained rate\n",{"type":42,"tag":56,"props":3368,"children":3369},{},[3370],{"type":47,"value":3371},"When custom retry behavior is needed, use config-only YAML settings:",{"type":42,"tag":551,"props":3373,"children":3375},{"className":785,"code":3374,"language":787,"meta":556,"style":556},"resource.retry.max_attempts: 5    # default: 5\nresource.retry.wait_min: 1s       # default: 1s\nresource.retry.wait_max: 60s      # default: 60s\n",[3376],{"type":42,"tag":72,"props":3377,"children":3378},{"__ignoreMap":556},[3379,3400,3422],{"type":42,"tag":562,"props":3380,"children":3381},{"class":564,"line":565},[3382,3387,3391,3395],{"type":42,"tag":562,"props":3383,"children":3384},{"style":797},[3385],{"type":47,"value":3386},"resource.retry.max_attempts",{"type":42,"tag":562,"props":3388,"children":3389},{"style":569},[3390],{"type":47,"value":595},{"type":42,"tag":562,"props":3392,"children":3393},{"style":676},[3394],{"type":47,"value":3361},{"type":42,"tag":562,"props":3396,"children":3397},{"style":3341},[3398],{"type":47,"value":3399},"    # default: 5\n",{"type":42,"tag":562,"props":3401,"children":3402},{"class":564,"line":27},[3403,3408,3412,3417],{"type":42,"tag":562,"props":3404,"children":3405},{"style":797},[3406],{"type":47,"value":3407},"resource.retry.wait_min",{"type":42,"tag":562,"props":3409,"children":3410},{"style":569},[3411],{"type":47,"value":595},{"type":42,"tag":562,"props":3413,"children":3414},{"style":603},[3415],{"type":47,"value":3416}," 1s",{"type":42,"tag":562,"props":3418,"children":3419},{"style":3341},[3420],{"type":47,"value":3421},"       # default: 1s\n",{"type":42,"tag":562,"props":3423,"children":3424},{"class":564,"line":617},[3425,3430,3434,3439],{"type":42,"tag":562,"props":3426,"children":3427},{"style":797},[3428],{"type":47,"value":3429},"resource.retry.wait_max",{"type":42,"tag":562,"props":3431,"children":3432},{"style":569},[3433],{"type":47,"value":595},{"type":42,"tag":562,"props":3435,"children":3436},{"style":603},[3437],{"type":47,"value":3438}," 60s",{"type":42,"tag":562,"props":3440,"children":3441},{"style":3341},[3442],{"type":47,"value":3443},"      # default: 60s\n",{"type":42,"tag":56,"props":3445,"children":3446},{},[3447,3449,3455],{"type":47,"value":3448},"The input framework enforces both transparently. See ",{"type":42,"tag":72,"props":3450,"children":3452},{"className":3451},[],[3453],{"type":47,"value":3454},"references\u002Fcel-rate-limiting.md",{"type":47,"value":3456}," for guidance on when to add these settings.",{"type":42,"tag":49,"props":3458,"children":3460},{"id":3459},"type-safety",[3461],{"type":47,"value":3462},"Type safety",{"type":42,"tag":56,"props":3464,"children":3465},{},[3466,3477],{"type":42,"tag":199,"props":3467,"children":3468},{},[3469,3471],{"type":47,"value":3470},"Avoid ",{"type":42,"tag":72,"props":3472,"children":3474},{"className":3473},[],[3475],{"type":47,"value":3476},"dyn()",{"type":47,"value":3478}," — defeats type checking. Rarely needed in practice.",{"type":42,"tag":56,"props":3480,"children":3481},{},[3482,3487,3489,3495,3497,3502],{"type":42,"tag":199,"props":3483,"children":3484},{},[3485],{"type":47,"value":3486},"All numbers are float64",{"type":47,"value":3488}," — the CEL input transmits all numbers as ",{"type":42,"tag":72,"props":3490,"children":3492},{"className":3491},[],[3493],{"type":47,"value":3494},"float64",{"type":47,"value":3496},". Numbers >=1e7 render in scientific notation in Elasticsearch. Convert intended-integer fields to strings in the CEL program or via ingest pipeline. Safe integer range: ",{"type":42,"tag":562,"props":3498,"children":3499},{},[3500],{"type":47,"value":3501},"-(2^53 - 1), 2^53 - 1",{"type":47,"value":230},{"type":42,"tag":49,"props":3504,"children":3506},{"id":3505},"debugging-aids",[3507],{"type":47,"value":3508},"Debugging aids",{"type":42,"tag":62,"props":3510,"children":3511},{},[3512,3534,3556,3570],{"type":42,"tag":66,"props":3513,"children":3514},{},[3515,3524,3526,3532],{"type":42,"tag":199,"props":3516,"children":3517},{},[3518],{"type":42,"tag":72,"props":3519,"children":3521},{"className":3520},[],[3522],{"type":47,"value":3523},"debug(tag, value)",{"type":47,"value":3525}," — logs to ",{"type":42,"tag":72,"props":3527,"children":3529},{"className":3528},[],[3530],{"type":47,"value":3531},"cel_debug",{"type":47,"value":3533}," at DEBUG level.",{"type":42,"tag":66,"props":3535,"children":3536},{},[3537,3554],{"type":42,"tag":199,"props":3538,"children":3539},{},[3540,3546,3548],{"type":42,"tag":72,"props":3541,"children":3543},{"className":3542},[],[3544],{"type":47,"value":3545},"try(expr)",{"type":47,"value":3547}," \u002F ",{"type":42,"tag":72,"props":3549,"children":3551},{"className":3550},[],[3552],{"type":47,"value":3553},"is_error(value)",{"type":47,"value":3555}," — structured error handling without crashing the program.",{"type":42,"tag":66,"props":3557,"children":3558},{},[3559,3568],{"type":42,"tag":199,"props":3560,"children":3561},{},[3562],{"type":42,"tag":72,"props":3563,"children":3565},{"className":3564},[],[3566],{"type":47,"value":3567},"failure_dump",{"type":47,"value":3569}," (ga 8.18.0) — full evaluation state dump on failure. Note: dumps may contain secrets.",{"type":42,"tag":66,"props":3571,"children":3572},{},[3573,3582,3584,3589],{"type":42,"tag":199,"props":3574,"children":3575},{},[3576],{"type":42,"tag":72,"props":3577,"children":3579},{"className":3578},[],[3580],{"type":47,"value":3581},"remaining_executions",{"type":47,"value":3583}," (ga 9.2) — how many evaluations remain in the ",{"type":42,"tag":72,"props":3585,"children":3587},{"className":3586},[],[3588],{"type":47,"value":1178},{"type":47,"value":3590}," budget.",{"type":42,"tag":754,"props":3592,"children":3593},{},[],{"type":42,"tag":49,"props":3595,"children":3597},{"id":3596},"mito-cli",[3598],{"type":47,"value":3599},"Mito CLI",{"type":42,"tag":56,"props":3601,"children":3602},{},[3603,3605,3611,3613,3618,3620,3625],{"type":47,"value":3604},"Mito (",{"type":42,"tag":72,"props":3606,"children":3608},{"className":3607},[],[3609],{"type":47,"value":3610},"github.com\u002Felastic\u002Fmito",{"type":47,"value":3612},") is the local CEL evaluation CLI. ",{"type":42,"tag":199,"props":3614,"children":3615},{},[3616],{"type":47,"value":3617},"A CEL program that has not been tested with mito is not acceptable.",{"type":47,"value":3619}," Follow the mandatory workflow at the top of this skill: mock → mito → template. Do NOT write ",{"type":42,"tag":72,"props":3621,"children":3623},{"className":3622},[],[3624],{"type":47,"value":77},{"type":47,"value":3626}," until the program passes mito validation.",{"type":42,"tag":56,"props":3628,"children":3629},{},[3630,3632,3637],{"type":47,"value":3631},"For installation, CLI flags, input state structure, execution model, the full mock-first workflow steps, mito→integration mapping, and quality standards: load ",{"type":42,"tag":72,"props":3633,"children":3635},{"className":3634},[],[3636],{"type":47,"value":751},{"type":47,"value":230},{"type":42,"tag":754,"props":3639,"children":3640},{},[],{"type":42,"tag":49,"props":3642,"children":3644},{"id":3643},"data-anonymization",[3645],{"type":47,"value":3646},"Data anonymization",{"type":42,"tag":56,"props":3648,"children":3649},{},[3650,3655,3657,3663],{"type":42,"tag":199,"props":3651,"children":3652},{},[3653],{"type":47,"value":3654},"All data committed to the repository must be fully anonymized.",{"type":47,"value":3656}," This applies to default values in manifest vars (use ",{"type":42,"tag":72,"props":3658,"children":3660},{"className":3659},[],[3661],{"type":47,"value":3662},"https:\u002F\u002Fapi.example.com",{"type":47,"value":3664},"), example values in CEL state, mock API responses, pipeline test fixtures from CEL output, and sample payloads captured during mito prototyping.",{"type":42,"tag":56,"props":3666,"children":3667},{},[3668,3670,3676],{"type":47,"value":3669},"Refer to the ",{"type":42,"tag":72,"props":3671,"children":3673},{"className":3672},[],[3674],{"type":47,"value":3675},"anonymize-logs",{"type":47,"value":3677}," skill for the full anonymization policy and placeholder conventions.",{"type":42,"tag":49,"props":3679,"children":3681},{"id":3680},"handoff-to-other-skills",[3682],{"type":47,"value":3683},"Handoff to other skills",{"type":42,"tag":62,"props":3685,"children":3686},{},[3687,3703,3720],{"type":42,"tag":66,"props":3688,"children":3689},{},[3690,3695,3696,3701],{"type":42,"tag":72,"props":3691,"children":3693},{"className":3692},[],[3694],{"type":47,"value":179},{"type":47,"value":181},{"type":42,"tag":72,"props":3697,"children":3699},{"className":3698},[],[3700],{"type":47,"value":187},{"type":47,"value":3702}," to run system tests (the mock API is already in place from CEL development)",{"type":42,"tag":66,"props":3704,"children":3705},{},[3706,3711,3712,3718],{"type":42,"tag":72,"props":3707,"children":3709},{"className":3708},[],[3710],{"type":47,"value":179},{"type":47,"value":181},{"type":42,"tag":72,"props":3713,"children":3715},{"className":3714},[],[3716],{"type":47,"value":3717},"references\u002Fpipeline-testing.md",{"type":47,"value":3719}," to validate ingest pipeline behavior on CEL-produced events",{"type":42,"tag":66,"props":3721,"children":3722},{},[3723,3728],{"type":42,"tag":72,"props":3724,"children":3726},{"className":3725},[],[3727],{"type":47,"value":167},{"type":47,"value":3729}," skill for overall package layout",{"type":42,"tag":49,"props":3731,"children":3733},{"id":3732},"reference-files",[3734],{"type":47,"value":3735},"Reference files",{"type":42,"tag":56,"props":3737,"children":3738},{},[3739,3744],{"type":42,"tag":199,"props":3740,"children":3741},{},[3742],{"type":47,"value":3743},"IMPORTANT",{"type":47,"value":3745},": These reference files contain the actual working code examples and patterns. The summaries above are not sufficient to write correct CEL programs — you MUST load the relevant references before writing code.",{"type":42,"tag":56,"props":3747,"children":3748},{},[3749,3754,3756,3761],{"type":42,"tag":199,"props":3750,"children":3751},{},[3752],{"type":47,"value":3753},"Always load these five",{"type":47,"value":3755}," when building a CEL program — ",{"type":42,"tag":199,"props":3757,"children":3758},{},[3759],{"type":47,"value":3760},"in this order",{"type":47,"value":3762}," (mock\u002Fmito before templates):",{"type":42,"tag":232,"props":3764,"children":3765},{},[3766,3787],{"type":42,"tag":236,"props":3767,"children":3768},{},[3769],{"type":42,"tag":240,"props":3770,"children":3771},{},[3772,3777,3782],{"type":42,"tag":244,"props":3773,"children":3774},{},[3775],{"type":47,"value":3776},"File",{"type":42,"tag":244,"props":3778,"children":3779},{},[3780],{"type":47,"value":3781},"Contains",{"type":42,"tag":244,"props":3783,"children":3784},{},[3785],{"type":47,"value":3786},"Load order",{"type":42,"tag":260,"props":3788,"children":3789},{},[3790,3812,3853,3874,3908],{"type":42,"tag":240,"props":3791,"children":3792},{},[3793,3802,3807],{"type":42,"tag":267,"props":3794,"children":3795},{},[3796],{"type":42,"tag":72,"props":3797,"children":3799},{"className":3798},[],[3800],{"type":47,"value":3801},"references\u002Fcel-system-tests.md",{"type":42,"tag":267,"props":3803,"children":3804},{},[3805],{"type":47,"value":3806},"Mock API setup with elastic\u002Fstream, docker-compose config, rule format, variable-capture patterns, GraphQL mock examples, hit_count calculation, and debugging 0-hits failures",{"type":42,"tag":267,"props":3808,"children":3809},{},[3810],{"type":47,"value":3811},"1st — you need this before writing any CEL",{"type":42,"tag":240,"props":3813,"children":3814},{},[3815,3823,3848],{"type":42,"tag":267,"props":3816,"children":3817},{},[3818],{"type":42,"tag":72,"props":3819,"children":3821},{"className":3820},[],[3822],{"type":47,"value":228},{"type":42,"tag":267,"props":3824,"children":3825},{},[3826,3831,3833,3839,3840,3846],{"type":42,"tag":199,"props":3827,"children":3828},{},[3829],{"type":47,"value":3830},"Mandatory",{"type":47,"value":3832}," phased build ladder (skeleton → error handling → events → pagination → cursor), syntax anti-patterns that cause compilation failures (",{"type":42,"tag":72,"props":3834,"children":3836},{"className":3835},[],[3837],{"type":47,"value":3838},"bytes()",{"type":47,"value":409},{"type":42,"tag":72,"props":3841,"children":3843},{"className":3842},[],[3844],{"type":47,"value":3845},"parse_time()",{"type":47,"value":3847},", tuples, unbalanced parens), and debugging guidance",{"type":42,"tag":267,"props":3849,"children":3850},{},[3851],{"type":47,"value":3852},"2nd — you MUST follow this phased approach; do not write the full program before validating a skeleton",{"type":42,"tag":240,"props":3854,"children":3855},{},[3856,3864,3869],{"type":42,"tag":267,"props":3857,"children":3858},{},[3859],{"type":42,"tag":72,"props":3860,"children":3862},{"className":3861},[],[3863],{"type":47,"value":751},{"type":42,"tag":267,"props":3865,"children":3866},{},[3867],{"type":47,"value":3868},"Mito CLI flags, input state structure, mock-first workflow, translating template vars to state.json, extension library quick-reference, syntax pitfalls, testscript harness",{"type":42,"tag":267,"props":3870,"children":3871},{},[3872],{"type":47,"value":3873},"3rd — you need this to develop and validate the program",{"type":42,"tag":240,"props":3875,"children":3876},{},[3877,3886,3903],{"type":42,"tag":267,"props":3878,"children":3879},{},[3880],{"type":42,"tag":72,"props":3881,"children":3883},{"className":3882},[],[3884],{"type":47,"value":3885},"references\u002Fcel-template-examples.md",{"type":42,"tag":267,"props":3887,"children":3888},{},[3889,3891,3896,3898],{"type":47,"value":3890},"Complete working ",{"type":42,"tag":72,"props":3892,"children":3894},{"className":3893},[],[3895],{"type":47,"value":77},{"type":47,"value":3897}," examples (minimal GET, paginated timestamp cursor, OAuth, GraphQL cursor) with corresponding manifest configs — ",{"type":42,"tag":199,"props":3899,"children":3900},{},[3901],{"type":47,"value":3902},"these are FINAL output; do not write templates until mito passes",{"type":42,"tag":267,"props":3904,"children":3905},{},[3906],{"type":47,"value":3907},"4th — only needed at step 5 of the workflow",{"type":42,"tag":240,"props":3909,"children":3910},{},[3911,3919,3962],{"type":42,"tag":267,"props":3912,"children":3913},{},[3914],{"type":42,"tag":72,"props":3915,"children":3917},{"className":3916},[],[3918],{"type":47,"value":2911},{"type":42,"tag":267,"props":3920,"children":3921},{},[3922,3927,3929,3935,3936,3942,3943,3949,3950,3955,3957],{"type":42,"tag":199,"props":3923,"children":3924},{},[3925],{"type":47,"value":3926},"Nesting discipline",{"type":47,"value":3928},": the 3-level HTTP core rule, six flattening\u002Fstructuring techniques (including intermediate result maps for shared logic), shallow merge semantics, cursor namespacing with clobber, merge strategies (",{"type":42,"tag":72,"props":3930,"children":3932},{"className":3931},[],[3933],{"type":47,"value":3934},"with",{"type":47,"value":2597},{"type":42,"tag":72,"props":3937,"children":3939},{"className":3938},[],[3940],{"type":47,"value":3941},"with_replace",{"type":47,"value":2597},{"type":42,"tag":72,"props":3944,"children":3946},{"className":3945},[],[3947],{"type":47,"value":3948},"with_update",{"type":47,"value":2582},{"type":42,"tag":72,"props":3951,"children":3953},{"className":3952},[],[3954],{"type":47,"value":3033},{"type":47,"value":3956},", and links to well-structured reference integrations — ",{"type":42,"tag":199,"props":3958,"children":3959},{},[3960],{"type":47,"value":3961},"must read before writing any multi-line CEL",{"type":42,"tag":267,"props":3963,"children":3964},{},[3965],{"type":47,"value":3966},"5th — read this before writing your CEL program so structure is right from the start",{"type":42,"tag":56,"props":3968,"children":3969},{},[3970],{"type":42,"tag":199,"props":3971,"children":3972},{},[3973],{"type":47,"value":3974},"Load these based on the task:",{"type":42,"tag":232,"props":3976,"children":3977},{},[3978,3993],{"type":42,"tag":236,"props":3979,"children":3980},{},[3981],{"type":42,"tag":240,"props":3982,"children":3983},{},[3984,3988],{"type":42,"tag":244,"props":3985,"children":3986},{},[3987],{"type":47,"value":3776},{"type":42,"tag":244,"props":3989,"children":3990},{},[3991],{"type":47,"value":3992},"Load when",{"type":42,"tag":260,"props":3994,"children":3995},{},[3996,4012,4028,4059,4075,4092,4109,4126,4143,4174,4197,4214],{"type":42,"tag":240,"props":3997,"children":3998},{},[3999,4007],{"type":42,"tag":267,"props":4000,"children":4001},{},[4002],{"type":42,"tag":72,"props":4003,"children":4005},{"className":4004},[],[4006],{"type":47,"value":2533},{"type":42,"tag":267,"props":4008,"children":4009},{},[4010],{"type":47,"value":4011},"Writing any pagination logic — all 6 patterns with code",{"type":42,"tag":240,"props":4013,"children":4014},{},[4015,4023],{"type":42,"tag":267,"props":4016,"children":4017},{},[4018],{"type":42,"tag":72,"props":4019,"children":4021},{"className":4020},[],[4022],{"type":47,"value":2661},{"type":42,"tag":267,"props":4024,"children":4025},{},[4026],{"type":47,"value":4027},"Implementing authentication — header, query param, signed, and config-level auth patterns",{"type":42,"tag":240,"props":4029,"children":4030},{},[4031,4039],{"type":42,"tag":267,"props":4032,"children":4033},{},[4034],{"type":42,"tag":72,"props":4035,"children":4037},{"className":4036},[],[4038],{"type":47,"value":3454},{"type":42,"tag":267,"props":4040,"children":4041},{},[4042,4044,4050,4051,4057],{"type":47,"value":4043},"Rate limiting policy — config-only approach, when to add ",{"type":42,"tag":72,"props":4045,"children":4047},{"className":4046},[],[4048],{"type":47,"value":4049},"resource.rate_limit.*",{"type":47,"value":534},{"type":42,"tag":72,"props":4052,"children":4054},{"className":4053},[],[4055],{"type":47,"value":4056},"resource.retry.*",{"type":47,"value":4058}," settings",{"type":42,"tag":240,"props":4060,"children":4061},{},[4062,4070],{"type":42,"tag":267,"props":4063,"children":4064},{},[4065],{"type":42,"tag":72,"props":4066,"children":4068},{"className":4067},[],[4069],{"type":47,"value":3104},{"type":42,"tag":267,"props":4071,"children":4072},{},[4073],{"type":47,"value":4074},"Quick-reference for common idioms, HTTP request patterns, structure conventions",{"type":42,"tag":240,"props":4076,"children":4077},{},[4078,4087],{"type":42,"tag":267,"props":4079,"children":4080},{},[4081],{"type":42,"tag":72,"props":4082,"children":4084},{"className":4083},[],[4085],{"type":47,"value":4086},"references\u002Fcel-polymorphic-patterns.md",{"type":42,"tag":267,"props":4088,"children":4089},{},[4090],{"type":47,"value":4091},"Choosing between pure-CEL, mito lib, and config approaches for auth, headers, rate limiting — version-tagged",{"type":42,"tag":240,"props":4093,"children":4094},{},[4095,4104],{"type":42,"tag":267,"props":4096,"children":4097},{},[4098],{"type":42,"tag":72,"props":4099,"children":4101},{"className":4100},[],[4102],{"type":47,"value":4103},"references\u002Fcel-expression.md",{"type":42,"tag":267,"props":4105,"children":4106},{},[4107],{"type":47,"value":4108},"Expression-specific reference: interface contract, translation framing (Python→CEL), incremental build phases, core structure, event output, error handling, pagination, state management, syntax rules, quality checklist",{"type":42,"tag":240,"props":4110,"children":4111},{},[4112,4121],{"type":42,"tag":267,"props":4113,"children":4114},{},[4115],{"type":42,"tag":72,"props":4116,"children":4118},{"className":4117},[],[4119],{"type":47,"value":4120},"references\u002Fcel-taxonomy.md",{"type":42,"tag":267,"props":4122,"children":4123},{},[4124],{"type":47,"value":4125},"Taxonomy classification: pagination and state management classes, least-complexity principle, mapping to skill vocabulary, how to classify from test-api.py",{"type":42,"tag":240,"props":4127,"children":4128},{},[4129,4138],{"type":42,"tag":267,"props":4130,"children":4131},{},[4132],{"type":42,"tag":72,"props":4133,"children":4135},{"className":4134},[],[4136],{"type":47,"value":4137},"references\u002Fcel-complexity-baselines.md",{"type":42,"tag":267,"props":4139,"children":4140},{},[4141],{"type":47,"value":4142},"Per-pattern-class complexity baselines from a ceplx survey of 316 programs, skip threshold, reviewer challenge examples, diagnostic interpretation",{"type":42,"tag":240,"props":4144,"children":4145},{},[4146,4155],{"type":42,"tag":267,"props":4147,"children":4148},{},[4149],{"type":42,"tag":72,"props":4150,"children":4152},{"className":4151},[],[4153],{"type":47,"value":4154},"references\u002Fexpression-builder-subagent-guidance.md",{"type":42,"tag":267,"props":4156,"children":4157},{},[4158,4160,4165,4167,4172],{"type":47,"value":4159},"Subagent operating manual for the ",{"type":42,"tag":199,"props":4161,"children":4162},{},[4163],{"type":47,"value":4164},"cel-expression-builder",{"type":47,"value":4166},": translates test-api.py into a validated ",{"type":42,"tag":72,"props":4168,"children":4170},{"className":4169},[],[4171],{"type":47,"value":355},{"type":47,"value":4173}," file + taxonomy classification. Does not touch templates, manifests, or mocks.",{"type":42,"tag":240,"props":4175,"children":4176},{},[4177,4186],{"type":42,"tag":267,"props":4178,"children":4179},{},[4180],{"type":42,"tag":72,"props":4181,"children":4183},{"className":4182},[],[4184],{"type":47,"value":4185},"references\u002Freviewer-subagent-guidance.md",{"type":42,"tag":267,"props":4187,"children":4188},{},[4189,4190,4195],{"type":47,"value":4159},{"type":42,"tag":199,"props":4191,"children":4192},{},[4193],{"type":47,"value":4194},"cel-expression-reviewer",{"type":47,"value":4196},": checks generated CEL against complexity baselines and source fidelity, produces specific challenges or accepts",{"type":42,"tag":240,"props":4198,"children":4199},{},[4200,4209],{"type":42,"tag":267,"props":4201,"children":4202},{},[4203],{"type":42,"tag":72,"props":4204,"children":4206},{"className":4205},[],[4207],{"type":47,"value":4208},"references\u002Fcel-function-reference.md",{"type":42,"tag":267,"props":4210,"children":4211},{},[4212],{"type":47,"value":4213},"Looking up available CEL functions per extension and their first mito version",{"type":42,"tag":240,"props":4215,"children":4216},{},[4217,4226],{"type":42,"tag":267,"props":4218,"children":4219},{},[4220],{"type":42,"tag":72,"props":4221,"children":4223},{"className":4222},[],[4224],{"type":47,"value":4225},"references\u002Fbuilder-subagent-guidance.md",{"type":42,"tag":267,"props":4227,"children":4228},{},[4229,4230,4235,4237,4242],{"type":47,"value":4159},{"type":42,"tag":199,"props":4231,"children":4232},{},[4233],{"type":47,"value":4234},"cel-program-builder",{"type":47,"value":4236}," orchestrator: scope boundaries, skill-load sequence, the 9-step mock-first \u002F mito-incremental workflow with mock completeness gate, delegation to cel-expression-builder, reporting contract. The orchestrator dispatches subagents by passing this file's ",{"type":42,"tag":199,"props":4238,"children":4239},{},[4240],{"type":47,"value":4241},"path",{"type":47,"value":4243}," in the task prompt; the subagent reads it itself in its own fresh context. Do NOT embed\u002Fpaste its contents into the task prompt.",{"type":42,"tag":56,"props":4245,"children":4246},{},[4247,4249,4258,4260,4267,4268,4275,4276],{"type":47,"value":4248},"See also: ",{"type":42,"tag":4250,"props":4251,"children":4255},"a",{"href":4252,"rel":4253},"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Freference\u002Fbeats\u002Ffilebeat\u002Ffilebeat-input-cel",[4254],"nofollow",[4256],{"type":47,"value":4257},"CEL input docs",{"type":47,"value":4259}," · ",{"type":42,"tag":4250,"props":4261,"children":4264},{"href":4262,"rel":4263},"https:\u002F\u002Fpkg.go.dev\u002Fgithub.com\u002Felastic\u002Fmito\u002Flib",[4254],[4265],{"type":47,"value":4266},"Mito lib docs",{"type":47,"value":4259},{"type":42,"tag":4250,"props":4269,"children":4272},{"href":4270,"rel":4271},"https:\u002F\u002Fgithub.com\u002Felastic\u002Fmito",[4254],[4273],{"type":47,"value":4274},"Mito repo",{"type":47,"value":4259},{"type":42,"tag":4250,"props":4277,"children":4280},{"href":4278,"rel":4279},"https:\u002F\u002Fcel.dev\u002F",[4254],[4281],{"type":47,"value":4282},"CEL language spec",{"type":42,"tag":4284,"props":4285,"children":4286},"style",{},[4287],{"type":47,"value":4288},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":4290,"total":4462},[4291,4310,4327,4342,4361,4373,4383,4398,4410,4425,4436,4449],{"slug":4292,"name":4292,"fn":4293,"description":4294,"org":4295,"tags":4296,"stars":4307,"repoUrl":4308,"updatedAt":4309},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4297,4300,4303,4304],{"name":4298,"slug":4299,"type":15},"Analytics","analytics",{"name":4301,"slug":4302,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":4305,"slug":4306,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":4311,"name":4311,"fn":4312,"description":4313,"org":4314,"tags":4315,"stars":4307,"repoUrl":4308,"updatedAt":4326},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4316,4319,4320,4323],{"name":4317,"slug":4318,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":4321,"slug":4322,"type":15},"Engineering","engineering",{"name":4324,"slug":4325,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":4328,"name":4328,"fn":4329,"description":4330,"org":4331,"tags":4332,"stars":4307,"repoUrl":4308,"updatedAt":4341},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4333,4334,4337,4338],{"name":9,"slug":8,"type":15},{"name":4335,"slug":4336,"type":15},"Elasticsearch","elasticsearch",{"name":4305,"slug":4306,"type":15},{"name":4339,"slug":4340,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":4343,"name":4343,"fn":4344,"description":4345,"org":4346,"tags":4347,"stars":4358,"repoUrl":4359,"updatedAt":4360},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4348,4351,4352,4355],{"name":4349,"slug":4350,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":4353,"slug":4354,"type":15},"Operations","operations",{"name":4356,"slug":4357,"type":15},"Permissions","permissions",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:44.946285",{"slug":4362,"name":4362,"fn":4363,"description":4364,"org":4365,"tags":4366,"stars":4358,"repoUrl":4359,"updatedAt":4372},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4367,4368,4371],{"name":4349,"slug":4350,"type":15},{"name":4369,"slug":4370,"type":15},"Deployment","deployment",{"name":4335,"slug":4336,"type":15},"2026-07-12T07:46:42.353362",{"slug":4374,"name":4374,"fn":4375,"description":4376,"org":4377,"tags":4378,"stars":4358,"repoUrl":4359,"updatedAt":4382},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4379,4380,4381],{"name":4349,"slug":4350,"type":15},{"name":4335,"slug":4336,"type":15},{"name":4353,"slug":4354,"type":15},"2026-07-12T07:46:41.097412",{"slug":4384,"name":4384,"fn":4385,"description":4386,"org":4387,"tags":4388,"stars":4358,"repoUrl":4359,"updatedAt":4397},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4389,4390,4391,4394],{"name":4349,"slug":4350,"type":15},{"name":4335,"slug":4336,"type":15},{"name":4392,"slug":4393,"type":15},"Networking","networking",{"name":4395,"slug":4396,"type":15},"Security","security","2026-07-12T07:46:43.675992",{"slug":4399,"name":4399,"fn":4400,"description":4401,"org":4402,"tags":4403,"stars":4358,"repoUrl":4359,"updatedAt":4409},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4404,4407,4408],{"name":4405,"slug":4406,"type":15},"Authentication","authentication",{"name":4349,"slug":4350,"type":15},{"name":4335,"slug":4336,"type":15},"2026-07-12T07:46:39.783105",{"slug":4411,"name":4411,"fn":4412,"description":4413,"org":4414,"tags":4415,"stars":4358,"repoUrl":4359,"updatedAt":4424},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4416,4419,4420,4423],{"name":4417,"slug":4418,"type":15},"Audit","audit",{"name":4335,"slug":4336,"type":15},{"name":4421,"slug":4422,"type":15},"Logs","logs",{"name":4395,"slug":4396,"type":15},"2026-07-12T07:47:35.092599",{"slug":4426,"name":4426,"fn":4427,"description":4428,"org":4429,"tags":4430,"stars":4358,"repoUrl":4359,"updatedAt":4435},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4431,4432,4433,4434],{"name":4405,"slug":4406,"type":15},{"name":9,"slug":8,"type":15},{"name":4335,"slug":4336,"type":15},{"name":4395,"slug":4396,"type":15},"2026-07-12T07:47:41.474547",{"slug":4437,"name":4437,"fn":4438,"description":4439,"org":4440,"tags":4441,"stars":4358,"repoUrl":4359,"updatedAt":4448},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4442,4443,4444,4447],{"name":9,"slug":8,"type":15},{"name":4335,"slug":4336,"type":15},{"name":4445,"slug":4446,"type":15},"RBAC","rbac",{"name":4395,"slug":4396,"type":15},"2026-07-12T07:47:36.394177",{"slug":4450,"name":4450,"fn":4451,"description":4452,"org":4453,"tags":4454,"stars":4358,"repoUrl":4359,"updatedAt":4461},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4455,4456,4457,4458],{"name":4298,"slug":4299,"type":15},{"name":4301,"slug":4302,"type":15},{"name":4335,"slug":4336,"type":15},{"name":4459,"slug":4460,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86,{"items":4464,"total":1076},[4465,4479,4486,4494,4511,4524,4538],{"slug":3675,"name":3675,"fn":4466,"description":4467,"org":4468,"tags":4469,"stars":23,"repoUrl":24,"updatedAt":4478},"anonymize sensitive log data","Anonymize and sanitize customer-provided log files before they are committed as pipeline test fixtures or sample events. Performs a line-by-line review and replaces all sensitive values inline, preserving log structure and format exactly — never reformats, re-indents, or restructures content. Invoke manually with \u002Fanonymize-logs.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4470,4473,4474,4477],{"name":4471,"slug":4472,"type":15},"Data Cleaning","data-cleaning",{"name":4421,"slug":4422,"type":15},{"name":4475,"slug":4476,"type":15},"Privacy","privacy",{"name":4395,"slug":4396,"type":15},"2026-07-18T05:13:04.420121",{"slug":4,"name":4,"fn":5,"description":6,"org":4480,"tags":4481,"stars":23,"repoUrl":24,"updatedAt":25},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4482,4483,4484,4485],{"name":21,"slug":22,"type":15},{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},{"name":17,"slug":18,"type":15},{"slug":167,"name":167,"fn":4487,"description":4488,"org":4489,"tags":4490,"stars":23,"repoUrl":24,"updatedAt":4493},"create Elastic integration packages","Use when creating a new Elastic integration package, scaffolding data streams, answering package layout or structure questions, or running the end-to-end integration build workflow. Covers package topology, scaffold commands, post-scaffold edits, and full orchestration of CEL\u002Fpipeline\u002Ftest subagents.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4491,4492],{"name":4335,"slug":4336,"type":15},{"name":17,"slug":18,"type":15},"2026-07-12T07:46:56.318866",{"slug":4495,"name":4495,"fn":4496,"description":4497,"org":4498,"tags":4499,"stars":23,"repoUrl":24,"updatedAt":4510},"dashboard-guidelines","create and review Kibana dashboard assets","Use when creating or reviewing Kibana assets in packages, including dashboard export structure, naming, and data stream alignment.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4500,4503,4504,4507],{"name":4501,"slug":4502,"type":15},"Dashboards","dashboards",{"name":4335,"slug":4336,"type":15},{"name":4505,"slug":4506,"type":15},"Kibana","kibana",{"name":4508,"slug":4509,"type":15},"UI Components","ui-components","2026-07-12T07:47:07.702332",{"slug":4512,"name":4512,"fn":4513,"description":4514,"org":4515,"tags":4516,"stars":23,"repoUrl":24,"updatedAt":4523},"dashboard-review","review Elastic dashboard JSON changes","Use when reviewing dashboard JSON changes in a PR or branch. Extracts structured descriptions with kbdash, compares before\u002Fafter, and checks guideline compliance.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4517,4520,4521,4522],{"name":4518,"slug":4519,"type":15},"Code Review","code-review",{"name":4501,"slug":4502,"type":15},{"name":9,"slug":8,"type":15},{"name":4505,"slug":4506,"type":15},"2026-07-12T07:47:06.493988",{"slug":155,"name":155,"fn":4525,"description":4526,"org":4527,"tags":4528,"stars":23,"repoUrl":24,"updatedAt":4537},"define ECS field mappings for integrations","Use when defining field mappings for data streams, populating ecs.yml with ECS field references, selecting ECS categorization values, choosing custom field types, or troubleshooting mapping validation failures.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4529,4532,4535,4536],{"name":4530,"slug":4531,"type":15},"Data Modeling","data-modeling",{"name":4533,"slug":4534,"type":15},"Data Quality","data-quality",{"name":9,"slug":8,"type":15},{"name":17,"slug":18,"type":15},"2026-07-12T07:47:13.472534",{"slug":4539,"name":4539,"fn":4540,"description":4541,"org":4542,"tags":4543,"stars":23,"repoUrl":24,"updatedAt":4550},"elastic-package-cli","develop and validate Elastic integrations","Use when developing or validating Elastic integrations with elastic-package commands such as build, check, lint, format, test, stack, service, install, profiles, and benchmark.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4544,4547,4548,4549],{"name":4545,"slug":4546,"type":15},"CLI","cli",{"name":9,"slug":8,"type":15},{"name":17,"slug":18,"type":15},{"name":4339,"slug":4340,"type":15},"2026-07-12T07:46:57.647395"]