transform

README

transform

Contains interfaces and methods for transforming data as it moves from a source to a sink.

Each transform must use a select statement to read and write data to its channels and check if context was cancelled to prevent goroutine leaks (learn more about goroutine leaks here).

Information for each transform is available in the GoDoc.

Documentation

Index

• type Batch
  • func (transform *Batch) Transform(ctx context.Context, in, out *config.Channel) error
• type Transfer
  • func (transform *Transfer) Transform(ctx context.Context, in, out *config.Channel) error
• type Transformer
  • func Factory(cfg config.Config) (Transformer, error)

Types

type Batch

type Batch struct {
	Processors []config.Config `json:"processors"`
}

Batch transforms data by applying a series of processors to a slice of encapsulated data. Data processing is iterative and each processor is enabled through conditions.

Below is an example that shows how a single JSON object is iteratively modified through this transform:

{"hello":"world"} // input event
{"hello":"world","foo":"bar"} // insert value "bar" into key "foo"
{"hello":"world","foo":"bar","baz":"qux"} // insert value "qux" into key "bar"
{"hello":"world","foo":"bar.qux"} // concat values from "foo" and "baz" into key "foo" with separator "."

When loaded with a factory, the transform uses this JSON configuration:

{
	"type": "batch",
	"processors": [
		{
			"type": "hash",
			"settings": {
				"condition": {
					"inspectors": [ ],
					"operator": ""
				},
				"input_key": "@this",
				"output_key": "event.hash"
				"options": {
					"algorithm": "sha256"
				}
			}
		}
	]
}

func (*Batch) Transform

func (transform *Batch) Transform(ctx context.Context, in, out *config.Channel) error

Transform processes a channel of encapsulated data with the Batch transform.

type Transfer

type Transfer struct{}

Transfer transforms data without modification. This transform should be used when data needs to be moved from a source to a sink without processing.

When loaded with a factory, the transform uses this JSON configuration:

{
	"type": "transfer"
}

func (*Transfer) Transform

func (transform *Transfer) Transform(ctx context.Context, in, out *config.Channel) error

Transform processes a channel of encapsulated data with the Transfer transform.

type Transformer

type Transformer interface {
	Transform(context.Context, *config.Channel, *config.Channel) error
}

Transformer is an interface for transforming data as it moves from a source to a sink. Transformers read capsules from and write capsules to channels, may optionally modify bytes, and are interruptable.

func Factory

func Factory(cfg config.Config) (Transformer, error)

Factory returns a configured Transformer from a config. This is the recommended method for retrieving ready-to-use Transformers.