...
After dragging this unit into the Flow canvas, double-click it to access its configuration options. The following table describes the configuration options of this unit:
Tab | Field | Description | |
|---|---|---|---|
General | Name | Enter a name for the unit. It must start with a letter, and cannot contain spaces. Only letters, numbers, and underscores are allowed. | |
Description | Enter a description detailing the scope of the unit. | ||
Language | Specify the language you will use to write the expression, e.g. Javascript, Groovy, etc. | ||
Fields to add | Event field | The name of an event field with the data you wish to convert to new columns, written in the correct format (expression, type, name, overwrite combination). Alternatively, the name of an input event field containing such a list can be entered below using the plus icon. | |
Fields | Click the plus icon to open the list (expression, type, name, overwrite combination). You can add as many fields as required. You can collapse and expand the fields using the | ||
icons, reorder using the arrows, or delete using the X icon. You can also reorder the fields using drag and drop. | |||
Field name | The name of an output event field where the expression result will be inserted. | ||
Type | The expected type for the expression result. | ||
Expression | An expression written in the specified language. | ||
Overwrite | Whether to overwrite an existing input event field if one with the same name already exists. | ||
Fields to remove | Fields | A list of field names to remove. You can also reorder the fields using drag and drop. | |
Input ports
Port | Description |
|---|---|
in | All events enter through this port. You can refer to event fields using expressions. |
Output ports
Port | Description |
|---|---|
out | Outputs input events modified with new/overwritten/removed fields. New/Overwritten fields are those defined by expressions in the 'Fields to add' tab. Removed fields are those defined in the 'Fields to remove' tab. |
error | Outputs all events that produced an error during evaluation. These events have two additional fields, error, and exception, that describe the error. |
Example
In this example, we want to add a timestamp and timestamp + 10 mins fields to existing events and insert them into a to a new my.app table.
...
Finally, we will link its out output port to a Devo sink unit to send the filtered events to a my.app table.
...
| Info |
|---|
After saving and starting the Flow, you must click the red button of the Tick unit to begin sending events. |
Download this example
You can try this flow by downloading this JSON and uploading it to your domain using the Import option:
...