Skip to content

HOWTO emit multiple events from a punchlet

Why do that

Sometimes you will receive multiple events in a unique event log and you will to split these events. You can do it in a punchlet.

What to do

We assume your input Tuple is something like this (json format):

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
{
  "logs": {
    "log": {
      "events": [
        { "id": 0, "event": "a first event" },
        { "id": 1, "event": "a second event" }
      ]
    },
    "local_uuid": "oRLa5ngR7xrtaX",
    "local_host": "127.0.0.1",
    "local_port": 9990,
    "remote_host": "127.0.0.1"
    "remote_port": 9991,
    "local_timestamp": "2016-09-21T10:04:40.646+02:00"
  }
}

And you want to transform it as:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
[
  {
    "logs": {
      "log": {
        "id": 0,
        "event": "a first event"
      },
      "local_uuid": "oRLa5ngR7xrtaXO",
      "local_host": "127.0.0.1",
      "local_port": 9990,
      "remote_host": "127.0.0.1"
      "remote_port": 9991,
      "local_timestamp": "2016-09-21T10:04:40.646+02:00"
    }
  },
  {
    "logs": {
      "log": {
        "id": 1,
        "event": "a second event"
      },
      "local_uuid": "oRLa5ngR7xrtaX1",
      "local_host": "127.0.0.1",
      "local_port": 9990,
      "remote_host": "127.0.0.1"
      "remote_port": 9991,
      "local_timestamp": "2016-09-21T10:04:40.646+02:00"
    }
  }
]

Use the following punchlet:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
{
  Tuple tRoot;
  Tuple events;

  if ([logs][log][events]) {

    events = [logs][log][events];
    [logs][log].remove("events");

    int index = 0;
    for (Tuple t : events.asCollection()) {
      Tuple tEvent;
      tEvent:[logs][log] = t;
      tEvent:[logs][local_host] = [logs][local_host];
      tEvent:[logs][local_port] = [logs][local_port];
      tEvent:[logs][remote_host] = [logs][remote_host];
      tEvent:[logs][remote_port] = [logs][remote_port];
      tEvent:[logs][local_timestamp] = [logs][local_timestamp];
      tEvent:[logs][local_uuid] = [logs][local_uuid] + Integer.toString(index);
      tRoot.append(tEvent);
      index += 1;
    }
  }

  root.remove("logs");
  for (Tuple t : tRoot.asCollection()) {
    root.append(t);
  }
}