Route
Split a stream of events into multiple sub-streams based on user-supplied conditions
Configuration
Example configurations
{
"transforms": {
"my_transform_id": {
"type": "route",
"inputs": [
"my-source-or-transform-id"
]
}
}
}
[transforms.my_transform_id]
type = "route"
inputs = [ "my-source-or-transform-id" ]
---
transforms:
my_transform_id:
type: route
inputs:
- my-source-or-transform-id
{
"transforms": {
"my_transform_id": {
"type": "route",
"inputs": [
"my-source-or-transform-id"
]
}
}
}
[transforms.my_transform_id]
type = "route"
inputs = [ "my-source-or-transform-id" ]
---
transforms:
my_transform_id:
type: route
inputs:
- my-source-or-transform-id
inputs
required [string]A list of upstream source or transform IDs.
Wildcards (*
) are supported.
See configuration for more info.
route
optional objectA table of route identifiers to logical conditions representing the filter of the route.
Each route can then be referenced as an input by other components with the name
<transform_name>.<route_id>
. If an event doesn’t match any route, it is sent to the
<transform_name>._unmatched
output.
Both _unmatched
, as well as _default
, are reserved output names and thus cannot be used
as a route name.
route.*
required conditionAvailable syntaxes
Syntax | Description | Example |
---|---|---|
vrl | A Vector Remap Language (VRL) Boolean expression. | .status_code != 200 && !includes(["info", "debug"], .severity) |
datadog_search | A Datadog Search query string. | *stack |
is_log | Whether the incoming event is a log. |
|
is_metric | Whether the incoming event is a metric. |
|
is_trace | Whether the incoming event is a trace. |
|
Shorthand for VRL
If you opt for the vrl
syntax for this condition, you can set the condition
as a string via the condition
parameter, without needing to specify both a source
and a type
. The
table below shows some examples:
Config format | Example |
---|---|
TOML | condition = ".status == 200" |
YAML | condition: .status == 200 |
JSON | "condition": ".status == 200" |
Condition config examples
Standard VRL
* = { type = "vrl", source = ".status == 500" }
*:
type: "vrl"
source: ".status == 500"
"*": {
"type": "vrl",
"source": ".status == 500"
}
Outputs
<route_id>
<transform_name>.<route_id>
.Telemetry
Metrics
linkcomponent_discarded_events_total
countercomponent_id
instead. The value is the same as component_id
.component_errors_total
countercomponent_id
instead. The value is the same as component_id
.component_received_event_bytes_total
countercomponent_id
instead. The value is the same as component_id
.component_received_events_count
histogramA histogram of the number of events passed in each internal batch in Vector’s internal topology.
Note that this is separate than sink-level batching. It is mostly useful for low level debugging performance issues in Vector due to small internal batches.
component_id
instead. The value is the same as component_id
.component_received_events_total
countercomponent_id
instead. The value is the same as component_id
.component_sent_event_bytes_total
countercomponent_id
instead. The value is the same as component_id
.component_sent_events_total
countercomponent_id
instead. The value is the same as component_id
.utilization
gaugecomponent_id
instead. The value is the same as component_id
.Examples
Split by log level
Given this event...{
"log": {
"level": "info"
}
}
[transforms.my_transform_id]
type = "route"
inputs = [ "my-source-or-transform-id" ]
[transforms.my_transform_id.route]
debug = '.level == "debug"'
info = '.level == "info"'
warn = '.level == "warn"'
error = '.level == "error"'
---
transforms:
my_transform_id:
type: route
inputs:
- my-source-or-transform-id
route:
debug: .level == "debug"
info: .level == "info"
warn: .level == "warn"
error: .level == "error"
{
"transforms": {
"my_transform_id": {
"type": "route",
"inputs": [
"my-source-or-transform-id"
],
"route": {
"debug": ".level == \"debug\"",
"info": ".level == \"info\"",
"warn": ".level == \"warn\"",
"error": ".level == \"error\""
}
}
}
}
{
"level": "info"
}
Split by metric namespace
Given this event...{
"metric": {
"counter": {
"value": 10000
},
"kind": "absolute",
"name": "memory_available_bytes",
"namespace": "host",
"tags": {}
}
}
[transforms.my_transform_id]
type = "route"
inputs = [ "my-source-or-transform-id" ]
[transforms.my_transform_id.route]
app = '.namespace == "app"'
host = '.namespace == "host"'
---
transforms:
my_transform_id:
type: route
inputs:
- my-source-or-transform-id
route:
app: .namespace == "app"
host: .namespace == "host"
{
"transforms": {
"my_transform_id": {
"type": "route",
"inputs": [
"my-source-or-transform-id"
],
"route": {
"app": ".namespace == \"app\"",
"host": ".namespace == \"host\""
}
}
}
}
{
"counter": {
"value": 10000
},
"kind": "absolute",
"name": "memory_available_bytes",
"namespace": "host",
"tags": {}
}