String Counter
Description
This processor monitors a string field and counts how often the value of the string changes. Hereby, a change is characterized by the value of the field before and the value after the change, combined forming a pair. The processor keeps track of the counter for each pair.
Required input
A string field is required in the data stream and can be selected with the field mapping.
String Field
The string field to be monitored.
Configuration
(no further configuration required)
Output
The following three fields are appended to the event:
- [counter] numerical field with the current count value for the given value pair
- [change_from] the value of the string before the change
- [change_to] the value of the string after the change
The event is emitted whenever the value of the string field changes.