curl -X POST http://localhost:5080/api/v1/scheduled_pipelines \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/json' \
  -d '{
    "name": "normalize-app",
    "source_stream": "app_raw",
    "target_stream": "app",
    "function_steps": {
      "language": "vrl",
      "signal_type": "logs",
      "steps": [
        {
          "transform_name": "normalize-level",
          "script": ".level = downcase!(string!(.level))"
        }
      ]
    },
    "cron": "every:5m",
    "lookback_secs": 300,
    "enabled": true
  }'