Switch
- Juan Tomás Alonso Nieto (Deactivated)
Description
The Switch unit is a Processor type unit.
A variation of the Filter unit, this unit can be configured to include as many output ports as required. Each output port defined will have an associated predicate or condition to be met. These conditions and their corresponding output port are called cases. Names must be unique, including standard ports (default, error).
An event enters through the in port. The various predicates are evaluated sequentially, until reaching one that returns a true result. Then, the event is output via the out port associated with the predicate as different cases.
If no predicate is met, the event is sent to the default port.
If there are errors produced during the evaluation, these events are enriched with two additional fields, error and exception, and the event is output through the error port.
Configuration
After dragging this unit into the Flow canvas, double-click it to access its configuration options. The following table describes the configuration options of this unit:
Tab | Field | Description | |
|---|---|---|---|
General | Name | Enter a name for the unit. It must start with a letter, and cannot contain spaces. Only letters, numbers, and underscores are allowed. | |
Description | Enter a description detailing the scope of the unit. | ||
Language | Specify the language you will use to write the expression, e.g. Javascript, Groovy, etc. | ||
Cases | Cases | User-defined cases. Each one defines a condition (when) and a destination (to). All mentioned destinations correspond to newly-created output ports. Click the plus icon to add a case. You can add as many cases as needed. You can collapse and expand the cases using the icon, reorder using the arrows, or delete using the X icon. You can also reorder the fields using drag and drop. | |
When | Enter the predicate (condition) to be evaluated using the language specified. | ||
To | Enter a unique name for the output port for events satisfying the predicate. It must start with a letter, and cannot contain spaces. Only letters, numbers, and underscores are allowed. | ||
Input ports
Port | Description |
|---|---|
in | All events enter through this port. |
Output ports
Port | Description |
|---|---|
User-defined | Output ports configured with their associated predicates. |
default | Outputs events that evaluated as "false". i.e. do not meet case conditions. |
error | Outputs all events that produced an error during evaluation. These events have two additional fields, error, and exception, that describe the error. |
Example
In this example, we want to send events related to multiple user cases in our domain from the siem.logtrust.web.activity table to a new my.app table as well as via email.
To do it, we will use a Devo source unit to get events from the siem.logtrust.web.activity table. Then, we will link it to a Switch unit that will send events containing the email of two required users to two different addresses. Finally, we will link its out output port to a Devo sink unit to send the filtered cases to a my.app table.
In the Switch unit settings, we add the following predicate to remove null values in the username column and send events related to two specific user emails:
Download this example
You can try this flow by downloading this JSON and uploading it to your domain using the Import option:
