transaction
Collects events together based on some condition to make a single new event
Field Name | Description | Type | Default |
---|---|---|---|
group-by | The field to use to group transactions | field | - |
marker | Field value to mark the new event | array of string | - |
timeout | Signature of timeout event | string or (string,string) | - |
start-end | Determine which events begin and which ones end the transaction | - | - |
group-by
The field to use to group transactions
Type: field
Example
input:
{"first":"John","last":"Doe"}
{"first":"Jane","last":"Doe"}
action:
transaction:
group-by: last
marker:
- marker
output:
{"_marker":"marker","complete":true,"duration":0,"recs":[{"first":"John","last":"Doe"},{"first":"Jane","last":"Doe"}],"group_by":"Doe"}
marker
Field value to mark the new event
if it has one element, then the marker is '_marker' and this is the value if it has two elements, then the first is the name of the marker field and the second is the value
Type: array of string
timeout
Signature of timeout event
This can directly be a timeout value like '300ms' or the special word 'document', (in which case we use the end-of-document markers created by scheduled inputs and the files input.) In this case 'stalled' is implicitly invoked.
Type: string or (string,string)
start-end
Determine which events begin and which ones end the transaction
start and end both give the field name and a pattern the value must match
Example
input:
{"first":"Jane","last":"Doe"}
{"first":"John","last":"Doe"}
{"first":"Jane","last":"Doe"}
{"first":"John","last":"Doe"}
action:
transaction:
start-end:
start:
- first
- Jane
end:
- first
- John
marker:
- marker
output:
{"_marker":"marker","complete":true,"duration":0,"recs":[{"first":"Jane","last":"Doe"},{"first":"John","last":"Doe"}]}
{"_marker":"marker","complete":true,"duration":0,"recs":[{"first":"Jane","last":"Doe"},{"first":"John","last":"Doe"}]}
Field Name | Description | Type | Default |
---|---|---|---|
start | key-value to determine the first event of a transaction | (field,regex) array | - |
[(field,regex) array](#(field,regex) array) | key-value to determine the first event of a transaction | - | - |
start
key-value to determine the first event of a transaction
Type: (field,regex) array
(field,regex) array
key-value to determine the first event of a transaction