transaction

Collects events together based on some condition to make a single new event

group-by

The field to use to group transactions

Type: field

Example

input:

{"first":"John","last":"Doe"}
{"first":"Jane","last":"Doe"}

action:

transaction:
  group-by: last
  marker:
    - marker

output:

{"_marker":"marker","complete":true,"duration":0,"recs":[{"first":"John","last":"Doe"},{"first":"Jane","last":"Doe"}],"group_by":"Doe"}

marker

Field value to mark the new event

if it has one element, then the marker is '_marker' and this is the value if it has two elements, then the first is the name of the marker field and the second is the value

Type: array of string

timeout

Signature of timeout event

Type: (string,string)

start-end

Determine which events begin and which ones end the transaction

start and end both give the field name and a pattern the value must match

Example

input:

{"first":"Jane","last":"Doe"}
{"first":"John","last":"Doe"}
{"first":"Jane","last":"Doe"}
{"first":"John","last":"Doe"}

action:

transaction:
  start-end:
    start:
      - first
      - Jane
    end:
      - first
      - John
  marker:
    - marker

output:

{"_marker":"marker","complete":true,"duration":0,"recs":[{"first":"Jane","last":"Doe"},{"first":"John","last":"Doe"}]}
{"_marker":"marker","complete":true,"duration":0,"recs":[{"first":"Jane","last":"Doe"},{"first":"John","last":"Doe"}]}

start

key-value to determine the first event of a transaction

Type: (field,regex) array

(field,regex) array

key-value to determine the first event of a transaction