Flow¶
An individual flow within a workflow.
| Field | Type | Description |
|---|---|---|
| steps | The steps that make up this flow. | |
| exclusive | Any match on the initial step causes the flow to reset. This is the default if not specified. (Only one of exclusive, or parallel can be set) |
|
| parallel | Multiple "runs" of the flow can occur in parallel. Runs are replaced FIFO if the active runs exceeds max_active_runs. A new run that matches and extracts the same field values on the initial step as an existing active run will replace the existing run. This execution mode is primarily used for flows that correlate on a specific field value. (Only one of parallel, or exclusive can be set) |
Example¶
JSON
{
"exclusive": {},
"steps": [
{
"exit_conditions": [
{
"match_rule": {
"generic_match": {
"base_matcher": {
"log_field": "field_name",
"operator": "EQUAL",
"string_value": "example"
}
},
"match_id": "match-abc",
"sample_rate": 100
}
}
],
"loop_match_id": "match-abc",
"match_rule": {
"generic_match": {
"base_matcher": {
"log_field": "field_name",
"operator": "EQUAL",
"string_value": "example"
}
},
"match_id": "match-abc",
"sample_rate": 100
},
"save_fields": [
{}
]
}
]
}
Flow.ExclusiveFlow¶
No fields
Flow.ParallelFlow¶
| Field | Type | Description |
|---|---|---|
| max_active_runs | optional uint32 | The maximum number of active "runs" for this flow. Defaults to 10 if not specified. |
Example¶
JSON
{
"max_active_runs": 1
}