Skip to main content

Final

Control Flow Cribl Compatible

Synopsis​

Terminates the processing of a pipeline gracefully without raising errors.

Schema​

final:
  - description: <text>
  - if: <script>
  - ignore_failure: <boolean>
  - on_failure: <processor[]>
  - on_success: <processor[]>
  - tag: <string>

Configuration​

FieldRequiredDefaultDescription
descriptionN-Explanatory note for documentation
ifN-Condition determining when to finalize processing
ignore_failureNfalseIf true, condition evaluation errors are ignored
on_failureN-See Handling Failures
on_successN-See Handling Success
tagN-Identifier for the finalization point

Details​

This processor is particularly useful for:

  • Creating breakpoints
  • Implementing conditional termination
  • Optimizing execution by early termination
  • Preventing further pipelines from running

Typical uses:

  • Early Exit on Success

    processors:
      - append:
          field: tags
          value: processed
      - final:
          if: "ctx.tags.contains('processed')"

  • Prevent Duplicate Processing

    processors:
      - set:
          field: processed_by
          value: pipeline_a
      - final:
          description: "Prevent other pipelines from processing"

  • Conditional Pipeline Branch

    processors:
      - final:
          if: "ctx.environment == 'production'"
          description: "Skip test processors in production"
      - set:
          field: test_field
          value: test_value

It is good practice to use detailed description fields to document the finalization points. Also, consider adding cleanup tasks using on_success, test conditional finalization thoroughly, and use tags for tracking finalization points in logs.

warning

Once final is used, no further processors in any pipeline will execute. Use with caution in multi-pipeline setups, and consider using if to prevent unintended early termination.

Examples​

Basic​

Stopping processing after the field update...

processors:
  - set:
      field: status
      value: completed
  - final:
      description: "Stop after status update"
  - set:  # This processor won't run
      field: other_field
      value: skipped

prevents further processing:

{
  "status": "completed"
}

Conditionals​

Finalizing based on packet count...

{
  "source": {
    "packets": 10
  }
}
final:
  - if: "ctx.source.packets == 10"
  - description: "Stop processing for 10-packet sources"

stops the process when the condition is met:

Pipeline processing finalized

Success​

Executing cleanup on finalization...

final:
  - description: "Clean finalization"
  - on_success:
      - set:
          field: processing_status
          value: completed
      - remove:
          field: temporary_data

terminates the pipeline gracefully:

{
  "processing_status": "completed"
}