Processor conditions: default case?

[mguiwin (Maxim Gueivandov)]

Hi,

Is there any efficient way to tell FB that if one or multiple conditions are met and corresponding data is processed by corresponding processor(s), everything else goes to another - default - processor?

Example of my current configuration:

output.elasticsearch:
[...]
  pipelines:
  - pipeline: "logs-with-error"
    when.regexp:
      message: '^20[0-9]{2}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2},[0-9]{3} ERROR \('
  - pipeline: "logs-without-error"
    not.regexp:
      message: '^20[0-9]{2}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2},[0-9]{3} ERROR \('

As you can see, I have to declare a not.regexp condition here just to handle the non-matching, default case. That means that the same regexp is executed twice, which is not optimal in termes of performance / ressource usage.

Is there any better way?

Thanks,
MG

[steffens (Steffen Siering)]

The pipeline setting will be default case, if no other cases match. Plus, the matching returns on first matching condition.

for example:

output.elasticsearch:
  pipeline: "logs-without-error"
  pipelines:
  - pipeline: "logs-with-error"
    when.regexp.message: ...

[mguiwin (Maxim Gueivandov)]

Thanks, that works!