Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add template pipeline to split processed streams into two distinct streamAppenders for store #49

Open
burnalting opened this issue Oct 11, 2021 · 0 comments

Comments

@burnalting
Copy link

burnalting commented Oct 11, 2021

Quite often we are presented with event sources where a portion of the information has limited time value whereas the rest has value for a reasonable time.

The typical use case for this is where a event source has events that only related to non person entities only (e.g. root on Linux, Administrator on Windows) and others to entities (i.e real users).

It is proposed we have a template pipeline that supports this concept such that, after an intial tranlsation, a 'split' is performed based on other translations (e.g. NPE users accepts on one side, no NPE users accepted on the other side of the split).

The pipleline would look like

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant