Break Events

Break grouped events received from a forwarder into multiple events using a valid regular expression as the delimiter.

Function Input

collection<record<R>>

This function takes in collections of records with schema R.

Function Output

collection<record<R>>

This function outputs a collection of records with schema R.

Arguments

Argument	Input	Description	UI example
content	expression<string>	An expression to get the contents of the field to be broken.	get("body")
output	string	Optional. The name of the output field in the new event (defaults to body if it is not specified).	new_name
delimiter	regex	A regex delimiter used to break events.	\n

DSL example

Break events using a new line as a delimiter:

break-events(input, get("body"), /(\n)/);