{ "name": "openai", "title": "OpenAI", "version": "2.4.0", "release": "ga", "description": "Collect OpenAI usage metrics and audit logs with Elastic Agent.", "type": "integration", "download": "/epr/openai/openai-2.4.0.zip", "path": "/package/openai/2.4.0", "icons": [ { "src": "/img/openai-logo.svg", "path": "/package/openai/2.4.0/img/openai-logo.svg", "title": "OpenAI logo", "size": "512x138", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^9.4.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/obs-infraobs-integrations" }, "categories": [ "observability", "monitoring", "security" ], "signature_path": "/epr/openai/openai-2.4.0.zip.sig", "format_version": "3.5.7", "readme": "/package/openai/2.4.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/openai-overview.png", "path": "/package/openai/2.4.0/img/openai-overview.png", "title": "OpenAI usage overview", "size": "2341x1652", "type": "image/png" }, { "src": "/img/openai-token.png", "path": "/package/openai/2.4.0/img/openai-token.png", "title": "OpenAI token metrics", "size": "2341x1276", "type": "image/png" }, { "src": "/img/openai-image.png", "path": "/package/openai/2.4.0/img/openai-image.png", "title": "OpenAI image metrics", "size": "2341x680", "type": "image/png" }, { "src": "/img/openai-audio-transcription.png", "path": "/package/openai/2.4.0/img/openai-audio-transcription.png", "title": "OpenAI audio transcription metrics", "size": "2341x680", "type": "image/png" }, { "src": "/img/openai-audio-speech.png", "path": "/package/openai/2.4.0/img/openai-audio-speech.png", "title": "OpenAI audio speech metrics", "size": "2341x680", "type": "image/png" }, { "src": "/img/openai-audit.png", "path": "/package/openai/2.4.0/img/openai-audit.png", "title": "OpenAI Audit logs", "size": "2341x680", "type": "image/png" }, { "src": "/img/openai-rate_limit.png", "path": "/package/openai/2.4.0/img/openai-rate_limit.png", "title": "OpenAI Rate Limit Headroom", "size": "3000x654", "type": "image/png" }, { "src": "/img/openai-rate_limit_org_wide.png", "path": "/package/openai/2.4.0/img/openai-rate_limit_org_wide.png", "title": "OpenAI Rate Limit Headroom Org Wide", "size": "3008x682", "type": "image/png" } ], "assets": [ "/package/openai/2.4.0/LICENSE.txt", "/package/openai/2.4.0/changelog.yml", "/package/openai/2.4.0/manifest.yml", "/package/openai/2.4.0/validation.yml", "/package/openai/2.4.0/docs/README.md", "/package/openai/2.4.0/img/openai-audio-speech.png", "/package/openai/2.4.0/img/openai-audio-transcription.png", "/package/openai/2.4.0/img/openai-audit.png", "/package/openai/2.4.0/img/openai-image.png", "/package/openai/2.4.0/img/openai-logo.svg", "/package/openai/2.4.0/img/openai-overview.png", "/package/openai/2.4.0/img/openai-rate_limit.png", "/package/openai/2.4.0/img/openai-rate_limit_org_wide.png", "/package/openai/2.4.0/img/openai-token.png", "/package/openai/2.4.0/data_stream/audio_speeches/manifest.yml", "/package/openai/2.4.0/data_stream/audio_speeches/sample_event.json", "/package/openai/2.4.0/data_stream/audio_transcriptions/manifest.yml", "/package/openai/2.4.0/data_stream/audio_transcriptions/sample_event.json", "/package/openai/2.4.0/data_stream/audit/manifest.yml", "/package/openai/2.4.0/data_stream/audit/sample_event.json", "/package/openai/2.4.0/data_stream/code_interpreter_sessions/manifest.yml", "/package/openai/2.4.0/data_stream/code_interpreter_sessions/sample_event.json", "/package/openai/2.4.0/data_stream/completions/manifest.yml", "/package/openai/2.4.0/data_stream/completions/sample_event.json", "/package/openai/2.4.0/data_stream/embeddings/manifest.yml", "/package/openai/2.4.0/data_stream/embeddings/sample_event.json", "/package/openai/2.4.0/data_stream/images/manifest.yml", "/package/openai/2.4.0/data_stream/images/sample_event.json", "/package/openai/2.4.0/data_stream/moderations/manifest.yml", "/package/openai/2.4.0/data_stream/moderations/sample_event.json", "/package/openai/2.4.0/data_stream/rate_limits/manifest.yml", "/package/openai/2.4.0/data_stream/rate_limits/sample_event.json", "/package/openai/2.4.0/data_stream/vector_stores/manifest.yml", "/package/openai/2.4.0/data_stream/vector_stores/sample_event.json", "/package/openai/2.4.0/kibana/alerting_rule_template/openai-rate-limit-headroom-low.json", "/package/openai/2.4.0/kibana/dashboard/openai-00aaee40-1432-48c6-94a3-a5388cfb7ab3.json", "/package/openai/2.4.0/kibana/dashboard/openai-651bb059-f606-44fc-b704-2078d0af26da.json", "/package/openai/2.4.0/data_stream/audio_speeches/fields/base-fields.yml", "/package/openai/2.4.0/data_stream/audio_speeches/fields/fields.yml", "/package/openai/2.4.0/data_stream/audio_transcriptions/fields/base-fields.yml", "/package/openai/2.4.0/data_stream/audio_transcriptions/fields/fields.yml", "/package/openai/2.4.0/data_stream/audit/fields/base-fields.yml", "/package/openai/2.4.0/data_stream/audit/fields/beats.yml", "/package/openai/2.4.0/data_stream/audit/fields/ecs.yml", "/package/openai/2.4.0/data_stream/audit/fields/fields.yml", "/package/openai/2.4.0/data_stream/code_interpreter_sessions/fields/base-fields.yml", "/package/openai/2.4.0/data_stream/code_interpreter_sessions/fields/fields.yml", "/package/openai/2.4.0/data_stream/completions/fields/base-fields.yml", "/package/openai/2.4.0/data_stream/completions/fields/fields.yml", "/package/openai/2.4.0/data_stream/embeddings/fields/base-fields.yml", "/package/openai/2.4.0/data_stream/embeddings/fields/fields.yml", "/package/openai/2.4.0/data_stream/images/fields/base-fields.yml", "/package/openai/2.4.0/data_stream/images/fields/fields.yml", "/package/openai/2.4.0/data_stream/moderations/fields/base-fields.yml", "/package/openai/2.4.0/data_stream/moderations/fields/fields.yml", "/package/openai/2.4.0/data_stream/rate_limits/fields/base-fields.yml", "/package/openai/2.4.0/data_stream/rate_limits/fields/fields.yml", "/package/openai/2.4.0/data_stream/vector_stores/fields/base-fields.yml", "/package/openai/2.4.0/data_stream/vector_stores/fields/fields.yml", "/package/openai/2.4.0/data_stream/audio_speeches/agent/stream/cel.yml.hbs", "/package/openai/2.4.0/data_stream/audio_speeches/elasticsearch/ingest_pipeline/default.yml", "/package/openai/2.4.0/data_stream/audio_transcriptions/agent/stream/cel.yml.hbs", "/package/openai/2.4.0/data_stream/audio_transcriptions/elasticsearch/ingest_pipeline/default.yml", "/package/openai/2.4.0/data_stream/audit/agent/stream/cel.yml.hbs", "/package/openai/2.4.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml", "/package/openai/2.4.0/data_stream/code_interpreter_sessions/agent/stream/cel.yml.hbs", "/package/openai/2.4.0/data_stream/code_interpreter_sessions/elasticsearch/ingest_pipeline/default.yml", "/package/openai/2.4.0/data_stream/completions/agent/stream/cel.yml.hbs", "/package/openai/2.4.0/data_stream/completions/elasticsearch/ingest_pipeline/default.yml", "/package/openai/2.4.0/data_stream/embeddings/agent/stream/cel.yml.hbs", "/package/openai/2.4.0/data_stream/embeddings/elasticsearch/ingest_pipeline/default.yml", "/package/openai/2.4.0/data_stream/images/agent/stream/cel.yml.hbs", "/package/openai/2.4.0/data_stream/images/elasticsearch/ingest_pipeline/default.yml", "/package/openai/2.4.0/data_stream/moderations/agent/stream/cel.yml.hbs", "/package/openai/2.4.0/data_stream/moderations/elasticsearch/ingest_pipeline/default.yml", "/package/openai/2.4.0/data_stream/rate_limits/agent/stream/cel.yml.hbs", "/package/openai/2.4.0/data_stream/rate_limits/elasticsearch/ingest_pipeline/default.yml", "/package/openai/2.4.0/data_stream/vector_stores/agent/stream/cel.yml.hbs", "/package/openai/2.4.0/data_stream/vector_stores/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "openai", "title": "OpenAI API usage", "description": "Collect OpenAI API usage events and audit logs.", "inputs": [ { "type": "cel", "vars": [ { "name": "url", "type": "url", "title": "URL", "description": "Base URL of the Open AI API.", "multi": false, "required": true, "show_user": true, "default": "https://api.openai.com" }, { "name": "admin_token", "type": "password", "title": "Admin token", "description": "Admin token for OpenAI API usage collection. See [Admin keys](https://platform.openai.com/settings/organization/admin-keys) for more information.", "multi": false, "required": true, "show_user": true }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "OpenAI API usage and audit logs", "description": "Collect OpenAI API usage events and audit logs." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true, "release": "beta" } } } ], "data_streams": [ { "type": "logs", "dataset": "openai.audio_speeches", "title": "Audio speeches usage", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "api_url", "type": "text", "title": "API URL", "description": "URL for OpenAI audio speeches usage API.", "multi": false, "required": true, "show_user": true, "default": "https://api.openai.com/v1/organization/usage/audio_speeches" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "Initial interval controls the historical data collection window at startup. This parameter determines how far back in time the integration will collect data when first initialized. Default is 24 hours (`24h`). Longer intervals retrieve more historical data but increase API calls. When using smaller bucket width (e.g., 1m), keep this interval shorter to avoid rate limiting. Supported units are h/m/s.", "multi": false, "required": true, "show_user": false, "default": "24h" }, { "name": "bucket_width", "type": "text", "title": "Bucket width", "description": "Bucket width to decide the width of each bucket in response from the OpenAI API. Defaults to 1m. Supported values for this parameter are 1m, 1h and 1d only.", "multi": false, "required": true, "show_user": false, "default": "1m" }, { "name": "finalization_grace", "type": "text", "title": "Finalization grace period", "description": "How long to wait before treating a usage bucket as final. OpenAI finalizes per-minute buckets with a multi-minute delay; a bucket's token and request counts keep climbing for several minutes after its end time. Buckets whose end time is younger than this grace period are skipped and re-fetched on a later poll, so only finalized counts are ingested. Defaults to 0s, which ingests each bucket as soon as its minute closes with no added delay; this is the least disruptive setting but may undercount usage during heavy bursts, because a bucket is read before OpenAI finishes revising it and is not re-read once ingested, so later upward revisions are never reflected. If accurate counts matter more than freshness, set this to 15m so every bucket has time to finalize before it is read. The trade-off is that usage data is then delayed by up to the grace period. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "0s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "openai-audio-speeches" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Audio speeches usage", "description": "Collect audio speeches usage details for the organization.", "enabled": true, "ingestion_method": "API" } ], "package": "openai", "path": "audio_speeches" }, { "type": "logs", "dataset": "openai.audio_transcriptions", "title": "Audio transcriptions usage", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "api_url", "type": "text", "title": "API URL", "description": "URL for OpenAI audio transcriptions usage API.", "multi": false, "required": true, "show_user": true, "default": "https://api.openai.com/v1/organization/usage/audio_transcriptions" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "Initial interval controls the historical data collection window at startup. This parameter determines how far back in time the integration will collect data when first initialized. Default is 24 hours (`24h`). Longer intervals retrieve more historical data but increase API calls. When using smaller bucket width (e.g., 1m), keep this interval shorter to avoid rate limiting. Supported units are h/m/s.", "multi": false, "required": true, "show_user": false, "default": "24h" }, { "name": "bucket_width", "type": "text", "title": "Bucket width", "description": "Bucket width to decide the width of each bucket in response from the OpenAI API. Defaults to 1m. Supported values for this parameter are 1m, 1h and 1d only.", "multi": false, "required": true, "show_user": false, "default": "1m" }, { "name": "finalization_grace", "type": "text", "title": "Finalization grace period", "description": "How long to wait before treating a usage bucket as final. OpenAI finalizes per-minute buckets with a multi-minute delay; a bucket's token and request counts keep climbing for several minutes after its end time. Buckets whose end time is younger than this grace period are skipped and re-fetched on a later poll, so only finalized counts are ingested. Defaults to 0s, which ingests each bucket as soon as its minute closes with no added delay; this is the least disruptive setting but may undercount usage during heavy bursts, because a bucket is read before OpenAI finishes revising it and is not re-read once ingested, so later upward revisions are never reflected. If accurate counts matter more than freshness, set this to 15m so every bucket has time to finalize before it is read. The trade-off is that usage data is then delayed by up to the grace period. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "0s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "openai-audio-transcriptions" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Audio transcriptions usage", "description": "Collect audio transcriptions usage details for the organization.", "enabled": true, "ingestion_method": "API" } ], "package": "openai", "path": "audio_transcriptions" }, { "type": "logs", "dataset": "openai.audit", "title": "Audit Logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the audit data from Open AI on first run. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Open AI API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Open AI API. The maximum supported batch size value is 100.", "multi": false, "required": true, "show_user": false, "default": 100 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "description": "Tags for the data-stream.", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "openai-audit" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve openai.audit fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Audit Logs", "description": "Collect audit logs from Open AI.", "enabled": true, "ingestion_method": "API" } ], "package": "openai", "path": "audit" }, { "type": "logs", "dataset": "openai.code_interpreter_sessions", "title": "Code interpreter sessions usage", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "api_url", "type": "text", "title": "API URL", "description": "URL for OpenAI code interpreter sessions usage API.", "multi": false, "required": true, "show_user": true, "default": "https://api.openai.com/v1/organization/usage/code_interpreter_sessions" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "Initial interval controls the historical data collection window at startup. This parameter determines how far back in time the integration will collect data when first initialized. Default is 24 hours (`24h`). Longer intervals retrieve more historical data but increase API calls. When using smaller bucket width (e.g., 1m), keep this interval shorter to avoid rate limiting. Supported units are h/m/s.", "multi": false, "required": true, "show_user": false, "default": "24h" }, { "name": "bucket_width", "type": "text", "title": "Bucket width", "description": "Bucket width to decide the width of each bucket in response from the OpenAI API. Defaults to 1m. Supported values for this parameter are 1m, 1h and 1d only.", "multi": false, "required": true, "show_user": false, "default": "1m" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "openai-code-interpreter-sessions" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Code interpreter sessions usage", "description": "Collect code interpreter sessions usage details for the organization.", "enabled": true, "ingestion_method": "API" } ], "package": "openai", "path": "code_interpreter_sessions" }, { "type": "logs", "dataset": "openai.completions", "title": "Completions usage", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "api_url", "type": "text", "title": "API URL", "description": "URL for OpenAI completions usage API.", "multi": false, "required": true, "show_user": true, "default": "https://api.openai.com/v1/organization/usage/completions" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "Initial interval controls the historical data collection window at startup. This parameter determines how far back in time the integration will collect data when first initialized. Default is 24 hours (`24h`). Longer intervals retrieve more historical data but increase API calls. When using smaller bucket width (e.g., 1m), keep this interval shorter to avoid rate limiting. Supported units are h/m/s.", "multi": false, "required": true, "show_user": false, "default": "24h" }, { "name": "bucket_width", "type": "text", "title": "Bucket width", "description": "Bucket width to decide the width of each bucket in response from the OpenAI API. Defaults to 1m. Supported values for this parameter are 1m, 1h and 1d only.", "multi": false, "required": true, "show_user": false, "default": "1m" }, { "name": "finalization_grace", "type": "text", "title": "Finalization grace period", "description": "How long to wait before treating a usage bucket as final. OpenAI finalizes per-minute buckets with a multi-minute delay; a bucket's token and request counts keep climbing for several minutes after its end time. Buckets whose end time is younger than this grace period are skipped and re-fetched on a later poll, so only finalized counts are ingested. Defaults to 0s, which ingests each bucket as soon as its minute closes with no added delay; this is the least disruptive setting but may undercount usage during heavy bursts, because a bucket is read before OpenAI finishes revising it and is not re-read once ingested, so later upward revisions are never reflected. If accurate counts matter more than freshness, set this to 15m so every bucket has time to finalize before it is read. The trade-off is that usage data is then delayed by up to the grace period. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "0s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "openai-completions" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Completions usage", "description": "Collect completions usage details for the organization.", "enabled": true, "ingestion_method": "API" } ], "package": "openai", "path": "completions" }, { "type": "logs", "dataset": "openai.embeddings", "title": "Embeddings usage", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "api_url", "type": "text", "title": "API URL", "description": "URL for OpenAI embeddings usage API.", "multi": false, "required": true, "show_user": true, "default": "https://api.openai.com/v1/organization/usage/embeddings" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "Initial interval controls the historical data collection window at startup. This parameter determines how far back in time the integration will collect data when first initialized. Default is 24 hours (`24h`). Longer intervals retrieve more historical data but increase API calls. When using smaller bucket width (e.g., 1m), keep this interval shorter to avoid rate limiting. Supported units are h/m/s.", "multi": false, "required": true, "show_user": false, "default": "24h" }, { "name": "bucket_width", "type": "text", "title": "Bucket width", "description": "Bucket width to decide the width of each bucket in response from the OpenAI API. Defaults to 1m. Supported values for this parameter are 1m, 1h and 1d only.", "multi": false, "required": true, "show_user": false, "default": "1m" }, { "name": "finalization_grace", "type": "text", "title": "Finalization grace period", "description": "How long to wait before treating a usage bucket as final. OpenAI finalizes per-minute buckets with a multi-minute delay; a bucket's token and request counts keep climbing for several minutes after its end time. Buckets whose end time is younger than this grace period are skipped and re-fetched on a later poll, so only finalized counts are ingested. Defaults to 0s, which ingests each bucket as soon as its minute closes with no added delay; this is the least disruptive setting but may undercount usage during heavy bursts, because a bucket is read before OpenAI finishes revising it and is not re-read once ingested, so later upward revisions are never reflected. If accurate counts matter more than freshness, set this to 15m so every bucket has time to finalize before it is read. The trade-off is that usage data is then delayed by up to the grace period. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "0s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "openai-embeddings" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Embeddings usage", "description": "Collect embeddings usage details for the organization.", "enabled": true, "ingestion_method": "API" } ], "package": "openai", "path": "embeddings" }, { "type": "logs", "dataset": "openai.images", "title": "Images usage", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "api_url", "type": "text", "title": "API URL", "description": "URL for OpenAI images usage API.", "multi": false, "required": true, "show_user": true, "default": "https://api.openai.com/v1/organization/usage/images" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "Initial interval controls the historical data collection window at startup. This parameter determines how far back in time the integration will collect data when first initialized. Default is 24 hours (`24h`). Longer intervals retrieve more historical data but increase API calls. When using smaller bucket width (e.g., 1m), keep this interval shorter to avoid rate limiting. Supported units are h/m/s.", "multi": false, "required": true, "show_user": false, "default": "24h" }, { "name": "bucket_width", "type": "text", "title": "Bucket width", "description": "Bucket width to decide the width of each bucket in response from the OpenAI API. Defaults to 1m. Supported values for this parameter are 1m, 1h and 1d only.", "multi": false, "required": true, "show_user": false, "default": "1m" }, { "name": "finalization_grace", "type": "text", "title": "Finalization grace period", "description": "How long to wait before treating a usage bucket as final. OpenAI finalizes per-minute buckets with a multi-minute delay; a bucket's token and request counts keep climbing for several minutes after its end time. Buckets whose end time is younger than this grace period are skipped and re-fetched on a later poll, so only finalized counts are ingested. Defaults to 0s, which ingests each bucket as soon as its minute closes with no added delay; this is the least disruptive setting but may undercount usage during heavy bursts, because a bucket is read before OpenAI finishes revising it and is not re-read once ingested, so later upward revisions are never reflected. If accurate counts matter more than freshness, set this to 15m so every bucket has time to finalize before it is read. The trade-off is that usage data is then delayed by up to the grace period. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "0s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "openai-images" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Images usage", "description": "Collect images usage details for the organization.", "enabled": true, "ingestion_method": "API" } ], "package": "openai", "path": "images" }, { "type": "logs", "dataset": "openai.moderations", "title": "Moderations usage", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "api_url", "type": "text", "title": "API URL", "description": "URL for OpenAI moderations usage API.", "multi": false, "required": true, "show_user": true, "default": "https://api.openai.com/v1/organization/usage/moderations" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "Initial interval controls the historical data collection window at startup. This parameter determines how far back in time the integration will collect data when first initialized. Default is 24 hours (`24h`). Longer intervals retrieve more historical data but increase API calls. When using smaller bucket width (e.g., 1m), keep this interval shorter to avoid rate limiting. Supported units are h/m/s.", "multi": false, "required": true, "show_user": false, "default": "24h" }, { "name": "bucket_width", "type": "text", "title": "Bucket width", "description": "Bucket width to decide the width of each bucket in response from the OpenAI API. Defaults to 1m. Supported values for this parameter are 1m, 1h and 1d only.", "multi": false, "required": true, "show_user": false, "default": "1m" }, { "name": "finalization_grace", "type": "text", "title": "Finalization grace period", "description": "How long to wait before treating a usage bucket as final. OpenAI finalizes per-minute buckets with a multi-minute delay; a bucket's token and request counts keep climbing for several minutes after its end time. Buckets whose end time is younger than this grace period are skipped and re-fetched on a later poll, so only finalized counts are ingested. Defaults to 0s, which ingests each bucket as soon as its minute closes with no added delay; this is the least disruptive setting but may undercount usage during heavy bursts, because a bucket is read before OpenAI finishes revising it and is not re-read once ingested, so later upward revisions are never reflected. If accurate counts matter more than freshness, set this to 15m so every bucket has time to finalize before it is read. The trade-off is that usage data is then delayed by up to the grace period. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "0s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "openai-moderations" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Moderations usage", "description": "Collect moderations usage details for the organization.", "enabled": true, "ingestion_method": "API" } ], "package": "openai", "path": "moderations" }, { "type": "logs", "dataset": "openai.rate_limits", "title": "Rate limits", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "api_url", "type": "text", "title": "API URL", "description": "URL for the OpenAI projects API. Rate limits are collected per project from `{api_url}/{project_id}/rate_limits`.", "multi": false, "required": true, "show_user": true, "default": "https://api.openai.com/v1/organization/projects" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Number of records requested per page from the OpenAI API. The maximum supported value is 100.", "multi": false, "required": true, "show_user": false, "default": 100 }, { "name": "include_archived", "type": "bool", "title": "Include archived projects", "description": "Whether to include archived projects when listing projects.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "openai-rate-limits" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Rate limits", "description": "Collect per-project, per-model rate limits for the organization.", "enabled": true, "ingestion_method": "API" } ], "package": "openai", "path": "rate_limits" }, { "type": "logs", "dataset": "openai.vector_stores", "title": "Vector stores usage", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "api_url", "type": "text", "title": "API URL", "description": "URL for OpenAI vector stores usage API.", "multi": false, "required": true, "show_user": true, "default": "https://api.openai.com/v1/organization/usage/vector_stores" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "Initial interval controls the historical data collection window at startup. This parameter determines how far back in time the integration will collect data when first initialized. Default is 24 hours (`24h`). Longer intervals retrieve more historical data but increase API calls. When using smaller bucket width (e.g., 1m), keep this interval shorter to avoid rate limiting. Supported units are h/m/s.", "multi": false, "required": true, "show_user": false, "default": "24h" }, { "name": "bucket_width", "type": "text", "title": "Bucket width", "description": "Bucket width to decide the width of each bucket in response from the OpenAI API. Defaults to 1m. Supported values for this parameter are 1m, 1h and 1d only.", "multi": false, "required": true, "show_user": false, "default": "1m" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "openai-vector-stores" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Vector stores usage", "description": "Collect vector stores usage details for the organization.", "enabled": true, "ingestion_method": "API" } ], "package": "openai", "path": "vector_stores" } ] }