Live Workshop: Integrate Google SecOps with Bindplane - Join Us on January 29th at 11 AM ET!Sign Up Now

Processor Bundles

What are Processor Bundles?

Processor bundles are a logical grouping of processors, designed to streamline common tasks where users often create multiple processors. Each bundle can encapsulate a sequence of processors designed to perform complex transformations or standardize telemetry data efficiently. The bundled processors will be added and applied to the configuration in the order they appear in the bundle. Bundles can be saved to the library in order to be used in multiple locations in the pipeline.

Creating a Processor Bundle

Processor bundles can be created by clicking on the Add processor button, and then clicking on the Add processor bundle button.

observIQ docs - Processors Bundles - image 1

You will then be directed to the bundle processors menu. This menu is a similar layout to the top-level processors menu, where you can create and edit processors, as well as view processor recommendations.

observIQ docs - Processors Bundles - image 2

From there, you can add multiple processors to the bundle. For this example, we are adding a sequence of processors that are often used together to parse logs with JSON data in the body:Parse JSON, Parse Timestamp, Parse Severity Fields, and Delete Fields.

observIQ docs - Processors Bundles - image 3

Once the processor bundle has been added, you can view the sub-processors by expanding the dropdown for the bundle.

observIQ docs - Processors Bundles - image 4

If you would like to reuse this processor bundle in multiple places, you can save the bundle to the library.

observIQ docs - Processors Bundles - image 3

Summary

Processor bundles are a convenient way to group multiple processors that are frequently used together, making it easier to manage and apply consistent processing across your configurations. They help reduce duplication of processors in different pipelines, which ensures efficiency and consistency throughout your telemetry workflows.