Break Events

This topic describes how to use the function in the .

Description

The Break Events function breaks grouped events into multiple events using a valid regular expression as the delimiter.

Function Input/Output Schema

Function Input

collection<record<R>>

This function takes in collections of records with schema R.

Function Output

collection<record<R>>

This function outputs collections of records with schema R.

Syntax

The required fields are in bold font.

break_events

content=<field>

delimiter=<regular-expression>

[output=<newfield>]

Required arguments

content

Syntax: <field>

Description: The field whose values will be broken into single events.

delimiter

Syntax: <regular-expression>

Description: A Java regular expression delimiter used to break events.

Optional arguments

output

Syntax: <string>

Description: The name of the output field in the new event.

Default: body

Example

Examples of common use cases follow. These examples assume that you have added the function to your pipeline.

1. SPL2 Example: Break events using a new line as a delimiter.

This example assumes that you are in the SPL View.

...| break_events content=host delimiter= /\n/ output=new_field|...;

2. SPL2 Example: Break body into multiple events using a new line as a delimiter.

This example assumes that you are in the SPL View.

... | break_events output=new_field content=cast(body, "string") delimiter=/\n/ |...;

3. SPL2 Example: Break body into multiple events using a comma as a delimiter.

This example assumes that you are in the SPL View.

... | break_events content=cast(body, "string") delimiter=/,/ |...;