Description
With the Route processor, you can separate events from a single stream into multiple streams. This allows you to choose the next processor or destination to which an event is sent.
Use
A typical use of this processor would be to route processed log data to different destinations, for example sending one set of log events to storage, and another to Mezmo Log Analysis.
Configuration
The Route processor determines where to send the log data based on a conditional statement applied to a specified field. The format of this conditional statement is: Field (comparison operator) Value. You can add conditions including AND and OR, as well as nested expressions. A Route Processor can contain multiple conditional statements.
The Field can be either:
- An event field path, for example
.transaction.result or .level
- A pipeline state variable using the
state.<variable_name> syntax, for example state.operational_state
State variables in routing conditions work well with Responsive Pipelines. You can route events differently based on the pipeline’s operational state.
The filter terms you enter for Value are treated as case-insensitive by default. Click the button next to the Value field to activate case-sensitivity.
Interactive Demo
The topic Tutorial: Route Data contains an interactive demo for using the Route Processor to combine data from multiple sources and send it along specific Pipeline branches for processing, along with a tutorial for experimenting with demo data.
Exclusivity
The routes are not in a sequential order of operation. Any conditional expression that matches sends a copy of the matching event through to the subsequent step.
If you want to make the routes exclusive, make that you create the conditions to oppose sending events down multiple paths if needed.
Operators and Conditions
Logical conditions are used to determine when a specific event qualifies for sending on to a subsequent step. Each condition uses a source field, operator, and potentially an evaluation to return a true-false result.
Comparison Operators
Contents Operators
Type Operators
String Operators
Example
Route by State Variable
You can route events based on a pipeline state variable. This example shows how to create separate routes for normal and incident operational states:
