ConnectionMaster · pull · Jul 1, 2026 · Jul 1, 2026 · Jul 1, 2026 · Jul 1, 2026
diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml
@@ -20125,10 +20125,14 @@ components:
         - CONTAINER
         - CALLOUTVALUE
     Condition:
-      description: Targeting condition details.
+      description: |-
+        Targeting condition details. A condition is either an inline
+        predicate with `operator`, `attribute`, and `value`, or a reference to a
+        saved filter with `saved_filter_id`. The inline fields are omitted for saved-filter
+        references.
       properties:
         attribute:
-          description: The user or request attribute to evaluate.
+          description: The user or request attribute to evaluate. Omitted for saved-filter references.
           example: "country"
           type: string
         created_at:
@@ -20143,23 +20147,26 @@ components:
           type: string
         operator:
           $ref: "#/components/schemas/ConditionOperator"
+        saved_filter_id:
+          description: The ID of the saved filter referenced by this condition, or null for inline conditions.
+          example: "550e8400-e29b-41d4-a716-446655440090"
+          format: uuid
+          nullable: true
+          type: string
         updated_at:
           description: The timestamp when the condition was last updated.
           example: "2024-01-01T12:00:00Z"
           format: date-time
           type: string
         value:
-          description: Values used by the selected operator.
+          description: Values used by the selected operator. Omitted for saved-filter references.
           example: ["US", "CA"]
           items:
             description: Target value for the selected operator.
             type: string
           type: array
       required:
         - id
-        - operator
-        - attribute
-        - value
         - created_at
         - updated_at
       type: object
@@ -20190,25 +20197,32 @@ components:
         - IS_NULL
         - EQUALS
     ConditionRequest:
-      description: Condition request payload for targeting rules.
+      description: |-
+        Condition request payload for targeting rules. A condition is either an inline
+        predicate with `operator`, `attribute`, and `value`, or a reference to a
+        saved filter with `saved_filter_id`. The two shapes are mutually exclusive.
       properties:
         attribute:
-          description: The user or request attribute to evaluate.
+          description: The user or request attribute to evaluate. Required for inline conditions; omit when `saved_filter_id` is set.
           example: "user_tier"
           type: string
         operator:
           $ref: "#/components/schemas/ConditionOperator"
+        saved_filter_id:
+          description: |-
+            The ID of a saved filter to reference as this condition. Mutually exclusive
+            with `operator`, `attribute`, and `value`. When set, the saved filter's
+            targeting rules are evaluated in place of an inline predicate.
+          example: "550e8400-e29b-41d4-a716-446655440090"
+          format: uuid
+          type: string
         value:
-          description: Values used by the selected operator.
+          description: Values used by the selected operator. Required for inline conditions; omit when `saved_filter_id` is set.
           example: ["premium", "enterprise"]
           items:
             description: Target value for the selected operator.
             type: string
           type: array
-      required:
-        - operator
-        - attribute
-        - value
       type: object
     ConfigCatCredentials:
       description: The definition of the `ConfigCatCredentials` object.
@@ -57746,19 +57760,35 @@ components:
         - client_email
       type: object
     LogsArchiveIntegrationS3:
-      description: The S3 Archive's integration destination.
+      description: >-
+        The S3 Archive's integration destination. You must provide one of the following: `access_key_id` alone, or both `account_id` and `role_name` together.
+      oneOf:
+        - $ref: "#/components/schemas/LogsArchiveIntegrationS3AccessKey"
+        - $ref: "#/components/schemas/LogsArchiveIntegrationS3Role"
+    LogsArchiveIntegrationS3AccessKey:
+      description: The S3 Archive's integration destination using an access key.
+      properties:
+        access_key_id:
+          description: The access key ID for the integration.
+          example: AKIAIOSFODNN7EXAMPLE
+          type: string
+      required:
+        - access_key_id
+      type: object
+    LogsArchiveIntegrationS3Role:
+      description: The S3 Archive's integration destination using an IAM role.
       properties:
         account_id:
           description: The account ID for the integration.
           example: "123456789012"
           type: string
         role_name:
-          description: The path of the integration.
+          description: The name of the role to assume for the integration.
           example: role-name
           type: string
       required:
-        - role_name
         - account_id
+        - role_name
       type: object
     LogsArchiveOrder:
       description: A ordered list of archive IDs.
@@ -67693,6 +67723,10 @@ components:
         The `parse_grok` processor extracts structured fields from unstructured log messages using Grok patterns.
 
         **Supported pipeline types:** logs
+      example:
+        id: "parse-grok-processor"
+        include: "service:my-service"
+        type: "parse_grok"
       properties:
         disable_library_rules:
           default: false
@@ -67705,6 +67739,11 @@ components:
           description: Indicates whether the processor is enabled.
           example: true
           type: boolean
+        field:
+          default: "message"
+          description: The log field to parse with the Grok rules.
+          example: "message"
+          type: string
         id:
           description: A unique identifier for this processor.
           example: "parse-grok-processor"
@@ -67714,9 +67753,9 @@ components:
           example: "service:my-service"
           type: string
         rules:
-          description: The list of Grok parsing rules. If multiple matching rules are provided, they are evaluated in order. The first successful match is applied.
+          description: The list of Grok parsing rules selected by either source field or include query.
           items:
-            $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorRule"
+            $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorRuleItem"
           type: array
         type:
           $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorType"
@@ -67728,6 +67767,37 @@ components:
         - enabled
       type: object
       x-pipeline-types: [logs]
+    ObservabilityPipelineParseGrokProcessorIncludeRule:
+      description: |-
+        A Grok parsing rule selected using the `include` query. Each rule defines how to extract structured fields
+        from logs matching a Datadog search query.
+      properties:
+        include:
+          description: A Datadog search query used to determine which logs this Grok rule targets.
+          example: "service:my-service"
+          type: string
+        match_rules:
+          description: |-
+            A list of Grok parsing rules that define how to extract fields from matching logs.
+            Each rule must contain a name and a valid Grok pattern.
+          example:
+            - name: "MyParsingRule"
+              rule: '%{word:user} connected on %{date("MM/dd/yyyy"):date}'
+          items:
+            $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorRuleMatchRule"
+          type: array
+        support_rules:
+          description: A list of Grok helper rules that can be referenced by the parsing rules.
+          example:
+            - name: "user"
+              rule: "%{word:user.name}"
+          items:
+            $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorRuleSupportRule"
+          type: array
+      required:
+        - include
+        - match_rules
+      type: object
     ObservabilityPipelineParseGrokProcessorRule:
       description: |-
         A Grok parsing rule used in the `parse_grok` processor. Each rule defines how to extract structured fields
@@ -67760,6 +67830,11 @@ components:
         - source
         - match_rules
       type: object
+    ObservabilityPipelineParseGrokProcessorRuleItem:
+      description: A single Grok parsing rule, selected by either source field or include query.
+      oneOf:
+        - $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorRule"
+        - $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorIncludeRule"
     ObservabilityPipelineParseGrokProcessorRuleMatchRule:
       description: |-
         Defines a Grok parsing rule, which extracts structured fields from log content using named Grok patterns.
@@ -150968,6 +151043,18 @@ paths:
                         - team:intake
                         - team:app
                     type: archives
+              s3_access_key_id:
+                value:
+                  data:
+                    attributes:
+                      destination:
+                        bucket: my-bucket
+                        integration:
+                          access_key_id: AKIAIOSFODNN7EXAMPLE
+                        type: s3
+                      name: Nginx Archive
+                      query: source:nginx
+                    type: archives
             schema:
               $ref: "#/components/schemas/LogsArchiveCreateRequest"
         description: The definition of the new archive.
@@ -150993,6 +151080,21 @@ paths:
                         state: WORKING
                       id: 00000000-0000-0000-0000-000000000002
                       type: archives
+                s3_access_key_id:
+                  value:
+                    data:
+                      attributes:
+                        destination:
+                          bucket: my-bucket
+                          integration:
+                            access_key_id: AKIAIOSFODNN7EXAMPLE
+                          type: s3
+                        include_tags: false
+                        name: Nginx Archive
+                        query: source:nginx
+                        state: WORKING
+                      id: 00000000-0000-0000-0000-000000000002
+                      type: archives
               schema:
                 $ref: "#/components/schemas/LogsArchive"
           description: OK
@@ -151142,6 +151244,18 @@ paths:
                         - team:intake
                         - team:app
                     type: archives
+              s3_access_key_id:
+                value:
+                  data:
+                    attributes:
+                      destination:
+                        bucket: my-bucket
+                        integration:
+                          access_key_id: AKIAIOSFODNN7EXAMPLE
+                        type: s3
+                      name: Nginx Archive
+                      query: source:nginx
+                    type: archives
             schema:
               $ref: "#/components/schemas/LogsArchiveCreateRequest"
         description: New definition of the archive.
@@ -151167,6 +151281,21 @@ paths:
                         state: WORKING
                       id: 00000000-0000-0000-0000-000000000004
                       type: archives
+                s3_access_key_id:
+                  value:
+                    data:
+                      attributes:
+                        destination:
+                          bucket: my-bucket
+                          integration:
+                            access_key_id: AKIAIOSFODNN7EXAMPLE
+                          type: s3
+                        include_tags: false
+                        name: Nginx Archive
+                        query: source:nginx
+                        state: WORKING
+                      id: 00000000-0000-0000-0000-000000000004
+                      type: archives
               schema:
                 $ref: "#/components/schemas/LogsArchive"
           description: OK

diff --git a/...observability-pipeline-with-parse-grok-processor-include-rules-returns-OK-response.frozen b/...observability-pipeline-with-parse-grok-processor-include-rules-returns-OK-response.frozen
@@ -0,0 +1 @@
+2026-06-29T20:01:05.978Z
diff --git a/...an-observability-pipeline-with-parse-grok-processor-include-rules-returns-OK-response.yml b/...an-observability-pipeline-with-parse-grok-processor-include-rules-returns-OK-response.yml
diff --git a/...-observability-pipeline-with-parse-grok-processor-source-rules-returns-OK-response.frozen b/...-observability-pipeline-with-parse-grok-processor-source-rules-returns-OK-response.frozen
@@ -0,0 +1 @@
+2026-06-29T18:24:15.839Z
diff --git a/...-an-observability-pipeline-with-parse-grok-processor-source-rules-returns-OK-response.yml b/...-an-observability-pipeline-with-parse-grok-processor-source-rules-returns-OK-response.yml
diff --git a/examples/v2/feature-flags/CreateAllocationsForFeatureFlagInEnvironment.rb b/examples/v2/feature-flags/CreateAllocationsForFeatureFlagInEnvironment.rb
@@ -42,6 +42,7 @@
             DatadogAPIClient::V2::ConditionRequest.new({
               attribute: "user_tier",
               operator: DatadogAPIClient::V2::ConditionOperator::ONE_OF,
+              saved_filter_id: "550e8400-e29b-41d4-a716-446655440090",
               value: [
                 "premium",
                 "enterprise",

diff --git a/examples/v2/feature-flags/UpdateAllocationsForFeatureFlagInEnvironment.rb b/examples/v2/feature-flags/UpdateAllocationsForFeatureFlagInEnvironment.rb
@@ -43,6 +43,7 @@
               DatadogAPIClient::V2::ConditionRequest.new({
                 attribute: "user_tier",
                 operator: DatadogAPIClient::V2::ConditionOperator::ONE_OF,
+                saved_filter_id: "550e8400-e29b-41d4-a716-446655440090",
                 value: [
                   "premium",
                   "enterprise",