Live Workshop: Integrate Google SecOps with Bindplane - Join Us on January 29th at 11 AM ET!Sign Up Now

Unroll

Description

The Unroll processor operates on log entries that contain a list/array in their body field. It expands the data into multiple log entries, with each item in the list becoming a separate entry while preserving the original attributes, resource attributes, and timestamp.

warning

The unroll processor may cause UI rendering slowdowns when processing log entries that expand into a large number of entries.

Use

The Unroll processor expands log entries that contain multiple logical entries within a single record.

Supported Types

MetricsLogsTracesBindPlane Agent
v1.66.0+

Configuration

note

The unroll processor has no configurable options and only processes log entries with a list/array in their body field.

Example Configuration(s)

Unrolling a,b,c into 3 separate log records

This example demonstrates how the unroll processor handles a log entry with body: ['a','b','c']. When applied, the processor creates three separate log records from the original entry.

Web Interface

observIQ docs - Unroll - plain