Meta tags:
description=Split a stream of events into multiple sub-streams based on user-supplied conditions;
keywords=route,swimlanes,split,component,transform;

Headings (most frequently used words):

graph, route, vrl, metrics, edge_attributes, types, examples, shorthand, logs, traces, split, by, components, node_attributes, deprecated, configuration, input, outputs, output, telemetry, how, it, works, vector, site, footer, example, configurations, inputs, measure_cpu_usage, reroute_unmatched, available, syntaxes, for, condition, config, route_id, log, level, metric, namespace, routing, to, multiple, state, about, setup, community, download, source, type, standard, datadog, search, warning, component_discarded_events_total, component_errors_total, component_latency_mean_seconds, component_latency_seconds, component_received_event_bytes_total, component_received_events_count, component_received_events_total, component_sent_event_bytes_total, component_sent_events_total, transform_buffer_max_byte_size, transform_buffer_max_event_size, transform_buffer_max_size_bytes, transform_buffer_max_size_events, transform_buffer_utilization, transform_buffer_utilization_level, transform_buffer_utilization_mean, utilization,

Text of the page (most frequently used words):
the (244), vector (93), component (66), optional (63), route (58), type (53), #source (35), #transform (32), this (28), host (26), from (26), foo (23), metrics (23), data (22), transforms (21), event (20), level (20), which (20), vrl (19), inputs (19), logs (19), process (18), originated (18), exists (17), kind (17), instance (17), pid (17), hostname (17), system (17), running (17), events (17), for (16), my_transform_id (16), component_type (16), component_kind (16), component_id (16), and (15), that (15), input (14), log (14), output (14), name (13), graph (13), remap (12), condition (12), aws (12), number (11), file (11), configuration (10), can (10), counter (10), info (10), status (10), components (9), namespace (9), metric (9), error (9), gauge (9), buffer (9), into (9), datadog (8), value (8), examples (8), time (8), uri (8), are (8), each (7), routes (7), single (7), example (7), json (7), toml (7), yaml (7), debug (7), feeds (7), mode (7), true (7), conditions (6), app (6), warn (6), set (6), 500 (6), string (6), reroute_unmatched (6), node (6), edge (6), gcp (6), github (5), you (5), exist (5), histogram (5), internal (5), traces (5), types (5), with (5), transform_name (5), supported (5), language (5), required (5), object (5), prometheus (5), model (5), chat (4), multiple (4), following (4), utilization (4), maximum (4), hold (4), bytes (4), deprecated (4), used (4), origins (4), other (4), spent (4), false (4), see (4), trace (4), available (4), stack (4), datadog_search (4), 200 (4), syntax (4), any (4), unmatched (4), _unmatched (4), not (4), stream (4), docs (4), architecture (4), rss (3), releases (3), download (3), updates (3), assert_eq (3), assert (3), extract_from (3), outputs (3), absolute (3), split (3), seconds (3), using (3), total (3), sanitized (3), pod (3), pod_name (3), pathname (3), peer_path (3), peer_addr (3), connection (3), container (3), container_name (3), tagged (3), like (3), includes (3), both (3), filter (3), below (3), route_id (3), based (3), search (3), whether (3), incoming (3), default (3), instead (3), silently (3), cpu (3), literal (3), width (3), red (3), color (3), graphviz (3), dot (3), attributes (3), edge_attributes (3), does (3), streams (3), reference (3), websocket (3), splunk (3), hec (3), http (3), azure (3), kinesis (3), all (2), reserved (2), going (2), administration (2), deployment (2), installation (2), setup (2), sinks (2), sources (2), sample (2), reduce (2), new (2), stateless (2), across (2), state (2), log_fields (2), insert_at (2), case (2), tests (2), doesnt (2), feed (2), downstream (2), how (2), routing (2), tags (2), memory_available_bytes (2), 10000 (2), produced (2), given (2), would (2), indicate (2), idle (2), simply (2), every (2), mean (2), smoothed (2), over (2), exponentially (2), weighted (2), moving (2), average (2), ewma (2), transform_buffer_max_size_events (2), transform_buffer_max_size_bytes (2), has (2), been (2), favor (2), specific (2), emitted (2), accepted (2), either (2), cumulatively (2), issues (2), due (2), queued (2), executing (2), itself (2), elapsed (2), fractional (2), spends (2), stage (2), errors (2), discarded (2), telemetry (2), namespacing (2), more (2), referenced (2), table (2), configurations (2), may (2), shorthand (2), config (2), some (2), syntaxes (2), list (2), doesn (2), match (2), sent (2), identifiers (2), ids (2), cases (2), discard (2), further (2), them (2), bool (2), enable (2), poll (2), when (2), attribute (2), node_attributes (2), they (2), added (2), provided (2), add (2), resulting (2), label (2), exclusive (2), sub (2), open (2), home (2), api (2), pipeline (2), server (2), statsd (2), socket (2), sematext (2), redis (2), pulsar (2), remote (2), write (2), opentelemetry (2), nats (2), mqtt (2), formerly (2), kafka (2), influxdb (2), humio (2), greptimedb (2), pubsub (2), stackdriver (2), cloud (2), storage (2), monitoring (2), sqs (2), firehose (2), cloudwatch (2), amqp (2), windows (2), kubernetes (2), docker (2), agent (2), end (2), concurrency (2), linux (2), observability (2), pipelines (2), support (2), blog (2), guides (2), sidebar, 2026, inc, rights, community, prod, cookies, privacy, team, contact, about, site, footer, next, previous, thank, joining, our, newsletter, sign, receive, emails, latest, content, page, meaning, its, behavior, consistent, bar, some_source, worth, noting, create, two, three, works, ratio, load, completely, waiting, never, updated, transform_buffer_utilization_mean, current, transform_buffer_utilization_level, transform_buffer_utilization, transform_buffer_max_event_size, transform_buffer_max_byte_size, component_sent_events_total, component_sent_event_bytes_total, component_received_events_total, note, separate, than, sink, batching, mostly, useful, low, debugging, performance, small, batches, passed, batch, topology, component_received_events_count, component_received_event_bytes_total, component_latency_seconds, component_latency_mean_seconds, within, occurred, error_type, encountered, component_errors_total, were, intentionally, intentional, dropped, component_discarded_events_total, link, fields, shown, will, different, enabled, details, warning, summary, distribution, lists, possible, aware, differ, specified, codec, standard, format, opt, via, parameter, without, needing, specify, shows, is_trace, is_metric, is_log, query, status_code, severity, boolean, expression, description, supply, text, depends, individual, then, otherwise, _default, names, thus, cannot, map, logical, represents, applied, these, disable, normally, defined, processing, want, reroutes, named, discarding, defaults, only, where, attribution, needed, adds, call, future, clock_gettime, task, timed, thread, clock, accumulated, nanoseconds, reported, component_cpu_usage_ns_total, usage, measure_cpu_usage, prefix, array, wildcards, upstream, example_input, collection, related, edges, linked, configure, generated, command, extra, advanced, minimal, also, splits, view, egress, stable, user, supplied, versioning, security, meta, glossary, environment, variables, cli, secrets, template, schema, unit, tls, global, options, webhdfs, exporter, postgres, papertrail, relic, mezmo, logdna, loki, keep, honeycomb, chronicle, unstructured, elasticsearch, doris, databricks, zerobus, databend, console, clickhouse, blackhole, monitor, ingestion, blob, axiom, sns, appsignal, window, throttle, tag, cardinality, limit, lua, incremental, delay, dedupe, ec2, metadata, aggregate, syslog, stdin, static, scrape, pushgateway, postgresql, okta, nginx, mongodb, logstash, journald, client, heroku, logplex, fluent, descriptor, exec, eventstoredb, dnstap, demo, ecs, apache, expressions, functions, pgo, optimization, validating, management, acknowledgements, guarantees, adaptive, buffering, runtime, sizing, capacity, planning, rollout, high, availability, hardening, architecting, unified, aggregator, architectures, production, topologies, roles, installer, archives, manual, ubuntu, rhel, raspbian, nixos, macos, debian, centos, arch, amazon, operating, systems, platforms, yum, rpm, pacman, nix, msi, homebrew, helm, dpkg, apt, package, managers, quickstart, concepts, introduction, navbar, dropdown, menu, toggle, dark, documentation,

Text of the page (random words):
ew open issues for this component on github splits a stream of events into multiple sub streams based on a set of conditions also see the exclusive route transform for routing an event to a single stream configuration example configurations minimal advanced yaml toml json transforms my_transform_id type route inputs my source or transform id transforms my_transform_id type route inputs my source or transform id transforms my_transform_id type route inputs my source or transform id transforms my_transform_id type route inputs my source or transform id reroute_unmatched true route foo does not exist source exists foo type vrl foo exists source exists foo type vrl transforms my_transform_id type route inputs my source or transform id reroute_unmatched true transforms my_transform_id route foo does not exist source exists foo type vrl transforms my_transform_id route foo exists source exists foo type vrl transforms my_transform_id type route inputs my source or transform id reroute_unmatched true route foo does not exist source exists foo type vrl foo exists source exists foo type vrl graph optional object extra graph configuration configure output for component when generated with graph command graph edge_attributes optional object edge attributes to add to the edges linked to this component s node in resulting graph they are added to the edge as provided graph edge_attributes required object a collection of graph edge attributes in graphviz dot language related to a single input component graph edge_attributes required string literal a single graph edge attribute in graphviz dot language examples color red label example edge width 5 0 examples example_input color red label example edge width 5 0 graph node_attributes optional object node attributes to add to this component s node in resulting graph they are added to the node as provided graph node_attributes required string literal a single graph node attribute in graphviz dot language examples color red name example node width 5 0 inputs required string a list of upstream source or transform ids wildcards are supported see configuration for more info array string literal examples my source or transform id prefix measure_cpu_usage optional bool enable cpu usage metrics for this transform when set to true each poll of the transform task is timed using the os thread cpu clock and the accumulated nanoseconds are reported as the component_cpu_usage_ns_total counter tagged with component_id component_kind and component_type defaults to false enable only for transforms where cpu attribution is needed as it adds a clock_gettime call on every future poll default false reroute_unmatched optional bool reroutes unmatched events to a named output instead of silently discarding them normally if an event doesn t match any defined route it is sent to the transform_name _unmatched output for further processing in some cases you may want to simply discard unmatched events and not process them any further in these cases reroute_unmatched can be set to false to disable the transform_name _unmatched output and instead silently discard any unmatched events default true route optional object a map from route identifiers to logical conditions each condition represents a filter which is applied to each event the following identifiers are reserved output names and thus cannot be used as route ids _unmatched _default each route can then be referenced as an input by other components with the name transform_name route_id if an event doesn t match any route and if reroute_unmatched is set to true the default it is sent to the transform_name _unmatched output otherwise the unmatched event is instead silently discarded route required condition an individual route source the text of the condition the syntax of the condition depends on the value of type type the type of condition to supply see available syntaxes below for a list of available types for this transform available syntaxes syntax description example vrl a vector remap language vrl boolean expression status_code 200 includes info debug severity datadog_search a datadog search query string stack is_log whether the incoming event is a log is_metric whether the incoming event is a metric is_trace whether the incoming event is a trace shorthand for vrl if you opt for the vrl syntax for this condition you can set the condition as a string via the condition parameter without needing to specify both a source and a type the table below shows some examples config format example yaml condition status 200 toml condition status 200 json condition status 200 condition config examples standard vrl yaml toml json type vrl source status 500 type vrl source status 500 type vrl source status 500 datadog search yaml toml json type datadog_search source stack type datadog_search source stack type datadog_search source stack vrl shorthand yaml toml json status 500 status 500 status 500 input types the following table lists all telemetry data types supported by the component across possible configurations be aware that the available data types may differ based on the specified codec configuration logs log events are supported metrics the following metrics are supported counter distribution gauge histogram set summary traces trace events are supported outputs route_id each route can be referenced as an input by other components with the name transform_name route_id output types metrics the input metric event traces the input trace event logs warning the fields shown below will be different if log namespacing is enabled see log namespacing for more details the input log event telemetry metrics link component_discarded_events_total counter the number of events dropped by this component component_id the vector component id component_kind the vector component kind component_type the vector component type host optional the hostname of the system vector is running on intentional true if the events were discarded intentionally like a filter transform or false if due to an error pid optional the process id of the vector instance component_errors_total counter the total number of errors encountered by this component component_id the vector component id component_kind the vector component kind component_type the vector component type error_type the type of the error host optional the hostname of the system vector is running on pid optional the process id of the vector instance stage the stage within the component at which the error occurred component_latency_mean_seconds gauge the mean elapsed time in fractional seconds that an event spends in a single transform this includes both the time spent queued in the transform s input buffer and the time spent executing the transform itself this value is smoothed over time using an exponentially weighted moving average ewma host optional the hostname of the system vector is running on pid optional the process id of the vector instance component_latency_seconds histogram the elapsed time in fractional seconds that an event spends in a single transform this includes both the time spent queued in the transform s input buffer and the time spent executing the transform itself host optional the hostname of the system vector is running on pid optional the process id of the vector instance component_received_event_bytes_total counter the number of event bytes accepted by this component either from tagged origins like file and uri or cumulatively from other origins component_id the vector component id component_kind the vector component kind component_type the vector component type container_name optional the name of the container from which the data originated file optional the file from which the data originated host optional the hostname of the system vector is running on mode optional the connection mode used by the component peer_addr optional the ip from which the data originated peer_path optional the pathname from which the data originated pid optional the process id of the vector instance pod_name optional the name of the pod from which the data originated uri optional the sanitized uri from which the data originated component_received_events_count histogram a histogram of the number of events passed in each internal batch in vector s internal topology note that this is separate than sink level batching it is mostly useful for low level debugging performance issues in vector due to small internal batches component_id the vector component id component_kind the vector component kind component_type the vector component type container_name optional the name of the container from which the data originated file optional the file from which the data originated host optional the hostname of the system vector is running on mode optional the connection mode used by the component peer_addr optional the ip from which the data originated peer_path optional the pathname from which the data originated pid optional the process id of the vector instance pod_name optional the name of the pod from which the data originated uri optional the sanitized uri from which the data originated component_received_events_total counter the number of events accepted by this component either from tagged origins like file and uri or cumulatively from other origins component_id the vector component id component_kind the vector component kind component_type the vector component type container_name optional the name of the container from which the data originated file optional the file from which the data originated host optional the hostname of the system vector is running on mode optional the connection mode used by the component peer_addr optional the ip from which the data originated peer_path optional the pathname from which the data originated pid optional the process id of the vector instance pod_name optional the name of the pod from which the data originated uri optional the sanitized uri from which the data originated component_sent_event_bytes_total counter the total number of event bytes emitted by this component component_id the vector component id component_kind the vector component kind component_type the vector component type host optional the hostname of the system vector is running on output optional the specific output of the component pid optional the process id of the vector instance component_sent_events_total counter the total number of events emitted by this component component_id the vector component id component_kind the vector component kind component_type the vector component type host optional the hostname of the system vector is running on output optional the specific output of the component pid optional the process id of the vector instance transform_buffer_max_byte_size gauge the maximum number of bytes the buffer that feeds into a transform can hold deprecated this metric has been deprecated in favor of transform_buffer_max_size_bytes component_id the vector component id component_kind the vector component kind component_type the vector component type host optional the hostname of the system vector is running on pid optional the process id of the vector instance transform_buffer_max_event_size gauge the maximum number of events the buffer that feeds into a transform can hold deprecated this metric has been deprecated in favor of transform_buffer_max_size_events component_id the vector component id component_kind the vector component kind component_type the vector component type host optional the hostname of the system vector is running on pid optional the process id of the vector instance transform_buffer_max_size_bytes gauge the maximum number of bytes the buffer that feeds into a transform can hold component_id the vector component id component_kind the vector component kind component_type the vector component type host optional the hostname of the system vector is running on pid optional the process id of the vector instance transform_buffer_max_size_events gauge the maximum number of events the buffer that feeds into a transform can hold component_id the vector component id component_kind the vector component kind component_type the vector component type host optional the hostname of the system vector is running on pid optional the process id of the vector instance transform_buffer_utilization histogram the utilization level of the buffer that feeds into a transform component_id the vector component id component_kind the vector component kind component_type the vector component type host optional the hostname of the system vector is running on pid optional the process id of the vector instance transform_buffer_utilization_level gauge the current utilization level of the buffer that feeds into a transform component_id the vector component id component_kind the vector component kind component_type the vector component type host optional the hostname of the system vector is running on pid optional the process id of the vector instance transform_buffer_utilization_mean gauge the mean utilization level of the buffer that feeds into a transform this value is smoothed over time using an exponentially weighted moving average ewma component_id the vector component id component_kind the vector component kind component_type the vector component type host optional the hostname of the system vector is running on pid optional the process id of the vector instance utilization gauge a ratio from 0 to 1 of the load on a component a value of 0 would indicate a completely idle component that is simply waiting for input a value of 1 would indicate a that is never idle this value is updated every 5 seconds component_id the vector component id component_kind the vector component kind component_type the vector component type host optional the hostname of the system vector is running on pid optional the process id of the vector instance examples split by log level given this event log level info and this configuration yaml toml json transforms my_transform_id type route inputs my source or transform id route debug level debug info level info warn level warn error level error transforms my_transform_id type route inputs my source or transform id transforms my_transform_id route debug level debug info level info warn level warn error level error transforms my_transform_id type route inputs my source or transform id route debug level debug info level info warn level warn error level error this vector event is produced level info split by metric namespace given this event metric counter value 10000 kind absolute name memory_available_bytes namespace host tags and this configuration yaml toml json transforms my_transform_id type route inputs my source or transform id route app namespace app host namespace host transforms my_transform_id type route inputs my source or transform id transforms my_transform_id route app namespace app host namespace host transforms my_transform_id type route inputs my source or transform id route app namespace app host namesp...