HOWTO emit multiple events from a punchlet
Why do that¶
Sometimes you will receive multiple events in a unique event log and you will to split these events. You can do it in a punchlet.
What to do¶
We assume your input Tuple is something like this (json format):
{
"logs": {
"log": {
"events": [
{ "id": 0, "event": "a first event" },
{ "id": 1, "event": "a second event" }
]
},
"local_uuid": "oRLa5ngR7xrtaX",
"local_host": "127.0.0.1",
"local_port": 9990,
"remote_host": "127.0.0.1"
"remote_port": 9991,
"local_timestamp": "2016-09-21T10:04:40.646+02:00"
}
}
And you want to transform it as:
[
{
"logs": {
"log": {
"id": 0,
"event": "a first event"
},
"local_uuid": "oRLa5ngR7xrtaXO",
"local_host": "127.0.0.1",
"local_port": 9990,
"remote_host": "127.0.0.1"
"remote_port": 9991,
"local_timestamp": "2016-09-21T10:04:40.646+02:00"
}
},
{
"logs": {
"log": {
"id": 1,
"event": "a second event"
},
"local_uuid": "oRLa5ngR7xrtaX1",
"local_host": "127.0.0.1",
"local_port": 9990,
"remote_host": "127.0.0.1"
"remote_port": 9991,
"local_timestamp": "2016-09-21T10:04:40.646+02:00"
}
}
]
Use the following punchlet:
{
Tuple tRoot;
Tuple events;
if ([logs][log][events]) {
events = [logs][log][events];
[logs][log].remove("events");
int index = 0;
for (Tuple t : events.asCollection()) {
Tuple tEvent;
tEvent:[logs][log] = t;
tEvent:[logs][local_host] = [logs][local_host];
tEvent:[logs][local_port] = [logs][local_port];
tEvent:[logs][remote_host] = [logs][remote_host];
tEvent:[logs][remote_port] = [logs][remote_port];
tEvent:[logs][local_timestamp] = [logs][local_timestamp];
tEvent:[logs][local_uuid] = [logs][local_uuid] + Integer.toString(index);
tRoot.append(tEvent);
index += 1;
}
}
root.remove("logs");
for (Tuple t : tRoot.asCollection()) {
root.append(t);
}
}