Additional Commands

Additional Commands

onSuccess [boolean]

The onSuccess command works if the processor parsed successfully. It allows performing further processing. onSuccess should be an array under the config of the .

{
  "steps": [{
  <processor or statement>,
    "onSuccess": [
      {
        <processor or statement>
      }
    ]
  }]
}

###Exmple:

{
  "steps": [
    {
      "grok": {
        "config": {
          "field": "message",
          "patterns": [
            "^%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:logLevel} %{GREEDYDATA:logMessage}$"
          ]
        },
        "onSuccess": [
          {
            "addTag": {
              "config": {
                "tags": [
                  "grok_parsing_works"
                ]
              }
            }
          }
        ]
      }
    }
  ]
}

onFailure [boolean]

The onFailure command works if the processor failed to parse. It allows performing further processing. onFailure should be an array under the config of the .

{
  "steps": [{
  <processor or statement>,
    "onFailure": [
      {
        <processor or statement>
      }
    ]
  }]
}

##Exmple

{
  "steps": [
    {
      "grok": {
        "config": {
          "field": "message",
          "patterns": [
            "^%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:logLevel} %{GREEDYDATA:logMessage}$"
          ]
        },
        "onFailure": [
          {
            "addField": {
              "config": {
                "path": "failed_to_parse_grok",
                "value": "true"
              }
            }
          }
        ]
      }
    }
  ]
}

stopOnFailure [boolean]

• false - (default) The pipeline will continue through the steps even if there is a processor failure.
• true - The pipeline will stop processing at the first processor that has a failure.

{  
  "steps":[  
    {<processor or statement>},
    {<processor or statement>},
    {<processor or statement>}
  ],
  "stopOnFailure":true
}