transform

type Batch ¶ added in v0.4.0

type Batch struct {
	Processors []config.Config `json:"processors"`
}

Batch transforms data by applying a series of processors to a slice of encapsulated data. Data processing is iterative and each processor is enabled through conditions.

Below is an example that shows how a single JSON object is iteratively modified through this transform:

{"hello":"world"} // input event
{"hello":"world","foo":"bar"} // insert value "bar" into key "foo"
{"hello":"world","foo":"bar","baz":"qux"} // insert value "qux" into key "bar"
{"hello":"world","foo":"bar.qux"} // concat vaues from "foo" and "baz" into key "foo" with separator "."

When loaded with a factory, the transform uses this JSON configuration:

{
	"type": "batch",
	"processors": [
		{
			"type": "hash",
			"settings": {
				"condition": {
					"inspectors": [ ],
					"operator": ""
				},
				"input_key": "@this",
				"output_key": "event.hash"
				"options": {
					"algorithm": "sha256"
				}
			}
		}
	]
}

func (transform *Batch) Transform(ctx context.Context, in <-chan config.Capsule, out chan<- config.Capsule, kill chan struct{}) error

type Transfer ¶

type Transfer struct{}

Transfer transforms data without modification. This transform should be used when data needs to be moved from a source to a sink without processing.

When loaded with a factory, the transform uses this JSON configuration:

{
	"type": "transfer"
}

func (transform *Transfer) Transform(ctx context.Context, in <-chan config.Capsule, out chan<- config.Capsule, kill chan struct{}) error

type Transform ¶

type Transform interface {
	Transform(context.Context, <-chan config.Capsule, chan<- config.Capsule, chan struct{}) error
}

Transform is an interface for transforming data as it moves from a source to a sink. Transforms read capsules from and write capsules to channels, may optionally modify bytes, and are interruptable via an anonymous struct channel.

func Factory(cfg config.Config) (Transform, error)