Step¶
A single step within a flow.
| Field | Type | Description |
|---|---|---|
| match_rule | The step's match rule. This rule must be satisfied to advance to the next step in the flow. | |
| exit_conditions | Zero or more exit conditions for the step. If an exit condition is met, the flow resets to the start of the flow. | |
| loop_match_id | optional string | Describes an optional loop condition that allows looping back to a previous step in the flow. Must point to the match ID in the same step or a step earlier in the flow. Specifying a looping condition is only valid on the last step in the flow unless actions contains a Sankey rule that refers to the match ID of this step as one of the nodes. |
| save_fields | Fields to save when this step is matched. These fields can be referred to by saved_field_id in a subsequent matcher. The ID of each SaveField must be unique within the flow. This is used for correlation matching in which flow completion is dependent on a particular set of field values being consistent across multiple steps in the flow. |
Example¶
JSON
{
"exit_conditions": [
{
"match_rule": {
"generic_match": {
"base_matcher": {
"log_field": "field_name",
"operator": "EQUAL",
"string_value": "example"
}
},
"match_id": "match-abc",
"sample_rate": 100
}
}
],
"loop_match_id": "match-abc",
"match_rule": {
"generic_match": {
"base_matcher": {
"log_field": "field_name",
"operator": "EQUAL",
"string_value": "example"
}
},
"match_id": "match-abc",
"sample_rate": 100
},
"save_fields": [
{}
]
}
Step.ExitCondition¶
A step exit condition. When an exit condition is met, flow execution resets to the start of the flow and will wait to match the initial step again.
| Field | Type | Description |
|---|---|---|
| match_rule | Exits on a match condition. (Only one of match_rule, or timeout can be set) |
|
| timeout | Exits on a timeout condition. (Only one of timeout, or match_rule can be set) |
Example¶
JSON
{
"match_rule": {
"generic_match": {
"base_matcher": {
"log_field": "field_name",
"operator": "EQUAL",
"string_value": "example"
}
},
"match_id": "match-abc",
"sample_rate": 100
}
}
Step.ExitCondition.TimeoutExit¶
| Field | Type | Description |
|---|---|---|
| id | string | The ID of the timeout which can be referred to by actions. Must be unique within the workflow. |
| timeout_rule | The timeout rule. |
Example¶
JSON
{
"id": "abc-123-def",
"timeout_rule": {
"duration": 1,
"duration_unit": "SECONDS"
}
}