Can you use __hecToken as a filter condition for the breaker?
Shawn Cannon
Posts: 131 ✭✭
I am trying to create an event breaker to add to a HEC source. Can you use __hecToken as a filter condition for the breaker or does the breaker happen before that internal field gets added?
0
Answers
-
I dont need this breaker to apply to all the data coming into this HEC source
0 -
see diagram here for the order: https://docs.cribl.io/stream/event-processing-order#
0 -
short answer: breaker comes before the metadata fields
0 -
ok so i can use _raw.includes ?
0 -
or _raw.indexOf ?
0 -
yes
0 -
Thanks!
0 -
In my experience i was able to use __hecToken as filter condition
0
