Caroline
f64e9dccb4
* Removed content from Data Prepper reference and broke out into separate pages. Signed-off-by: carolxob <[email protected]> * Checking in file to make sure it's the right version. Signed-off-by: carolxob <[email protected]> * Minor update. Signed-off-by: carolxob <[email protected]> * Updated files. Signed-off-by: carolxob <[email protected]> * Adding Sinks file. Signed-off-by: carolxob <[email protected]> * Added file to PR. Signed-off-by: carolxob <[email protected]> * Corrected TOC hierarchy. Signed-off-by: carolxob <[email protected]> * Added images and reorganized files. Signed-off-by: carolxob <[email protected]> * Reconfigured some content based on David's feedback. Signed-off-by: carolxob <[email protected]> * Modified reference page. Signed-off-by: carolxob <[email protected]> * Fixed minor heading issue. Signed-off-by: carolxob <[email protected]> * Minor edits. Signed-off-by: carolxob <[email protected]> * Major edits, files created, moved, and content broken out from main config page. Signed-off-by: carolxob <[email protected]> * Adding key value and processors pages to the PR. Signed-off-by: carolxob <[email protected]> * Basic ToC reorg. Signed-off-by: carolxob <[email protected]> * ToC updates. Signed-off-by: carolxob <[email protected]> * Minor ToC updates. Signed-off-by: carolxob <[email protected]> * Minor update.: Signed-off-by: carolxob <[email protected]> * Minor edits to ToC again. Signed-off-by: carolxob <[email protected]> * Minor updates. Signed-off-by: carolxob <[email protected]> * Minor TOC update Signed-off-by: carolxob <[email protected]> * Minor ToC updates. Signed-off-by: carolxob <[email protected]> * Minor ToC updates. Signed-off-by: carolxob <[email protected]> * Minor ToC updates. Signed-off-by: carolxob <[email protected]> * Minor ToC updates. Signed-off-by: carolxob <[email protected]> * Minor ToC updates. Signed-off-by: carolxob <[email protected]> * Minor ToC changes. Signed-off-by: carolxob <[email protected]> * Minor ToC updates. Signed-off-by: carolxob <[email protected]> * ToC updates. Signed-off-by: carolxob <[email protected]> * Minor ToC updates. Signed-off-by: carolxob <[email protected]> * Minor ToC updates. Signed-off-by: carolxob <[email protected]> * Minor ToC updates. Signed-off-by: carolxob <[email protected]> * Minor ToC updates Signed-off-by: carolxob <[email protected]> * Minor ToC changes. Signed-off-by: carolxob <[email protected]> * Minor ToC changes. Signed-off-by: carolxob <[email protected]> * Minor ToC changes. Signed-off-by: carolxob <[email protected]> * Minor ToC changes. Signed-off-by: carolxob <[email protected]> * Minor ToC changes. Signed-off-by: carolxob <[email protected]> * Minor ToC edits. Signed-off-by: carolxob <[email protected]> * Changed filename. Signed-off-by: carolxob <[email protected]> * Minor ToC updates Signed-off-by: carolxob <[email protected]> * Making small Toc changes. Signed-off-by: carolxob <[email protected]> * Minor ToC updates. Signed-off-by: carolxob <[email protected]> * Added comment blocks for Config and Metrics sections. Signed-off-by: carolxob <[email protected]> * Minor ToC updates to add Sinks and Sources under config guide. Signed-off-by: carolxob <[email protected]> Signed-off-by: carolxob <[email protected]>
1.5 KiB
1.5 KiB
layout, title, parent, grand_parent, nav_order
| layout | title | parent | grand_parent | nav_order |
|---|---|---|---|---|
| default | aggregate | Processors | Configuring Data Prepper | 45 |
aggregate
Overview
Groups events together based on the keys provided and performs a action on each group.
| Option | Required | Type | Description |
|---|---|---|---|
| identification_keys | Yes | List | A unordered list by which to group Events. Events with the same values for these keys are put into the same group. If an event does not contain one of the identification_keys, then the value of that key is considered to be equal to null. At least one identification_key is required. (e.g. ["sourceIp", "destinationIp", "port"]). |
| action | Yes | AggregateAction | The action to be performed for each group. One of the available aggregate actions must be provided or you can create custom aggregate actions. remove_duplicates and put_all are available actions. For more information, see creating custom aggregate actions. |
| group_duration | No | String | The amount of time that a group should exist before it is concluded automatically. Supports ISO_8601 notation strings ("PT20.345S", "PT15M", etc.) as well as simple notation for seconds ("60s") and milliseconds ("1500ms"). Default value is 180s. |