transaction

Collects events together based on some condition to make a single new event

group-by

The field to use to group transactions

Type: field

Example

input:

{"first":"John","last":"Doe"}
{"first":"Jane","last":"Doe"}

action:

transaction:
  group-by: last
  marker:
    - marker

output:

{"_marker":"marker","complete":true,"duration":0,"recs":[{"first":"John","last":"Doe"},{"first":"Jane","last":"Doe"}],"group_by":"Doe"}

marker

Field value to mark the new event

if it has one element, then the marker is '_marker' and this is the value if it has two elements, then the first is the name of the marker field and the second is the value

Type: array of string

timeout

Signature of timeout event

This can directly be a timeout value like '300ms' or the special word 'document', (in which case we use the end-of-document markers created by scheduled inputs and the files input.) In this case 'stalled' is implicitly invoked.

Type: string or (string,string)

start-end

Determine which events begin and which ones end the transaction

start and end both give the field name and a pattern the value must match

Example

input:

{"first":"Jane","last":"Doe"}
{"first":"John","last":"Doe"}
{"first":"Jane","last":"Doe"}
{"first":"John","last":"Doe"}

action:

transaction:
  start-end:
    start:
      - first
      - Jane
    end:
      - first
      - John
  marker:
    - marker

output:

{"_marker":"marker","complete":true,"duration":0,"recs":[{"first":"Jane","last":"Doe"},{"first":"John","last":"Doe"}]}
{"_marker":"marker","complete":true,"duration":0,"recs":[{"first":"Jane","last":"Doe"},{"first":"John","last":"Doe"}]}

start

key-value to determine the first event of a transaction

Type: (field,regex) array

(field,regex) array

key-value to determine the first event of a transaction