Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Version 1 Next »

Every flow must start with a source filter. There are 2 available options:

  1. Flow Source - Using an existing flow, multiselect or All data.

Field Label

Allowed Inputs

Default value

Description

IDS

Multiselect, existing Flow Id or AllData.

previous Flow Id or AllData if previous flow not present

A list of sources to join in the flow
Can have multiple selected

This component must always be single and first in the flow

2. Source and Data filter - Using a simple query to filter only matching events.

Field Label

Allowed Inputs

Default value

Description

QUERY

Simple query.

simple examples:

  1. error

  2. username=assaf

  3. log.somelogname

  4. * in log.somelogname

Empty

Use simple query to filter only matching events.

  • No labels