Skip to main content

Discard

Flow Control

Synopsis

Removes staged routes from the pipeline processing flow, either targeting a specific destination or discarding all staged routes at once.

Schema

- discard:
destination: <string>
target: <string>

Configuration

FieldRequiredDefaultDescription
destinationNDestination route to remove from staged routes. Supports templating. If empty, discards all staged routes.
targetNAlias for destination field.

Details

The discard processor removes routes from the StagedRoutes map before they are committed to actual routing. This enables conditional route discarding based on data content or processing logic.

When destination is specified, the processor removes only that destination from staged routes. If the destination does not exist in staged routes, the processor returns an error unless ignore_failure is set to true.

When destination is not specified, the processor clears all staged routes from the map, preventing any staged routes from being committed.

The destination field supports template syntax, allowing dynamic destination selection based on log entry field values.

The processor fails silently when no staged routes exist, returning no error regardless of the destination value.

Examples

Discard Specific Destination

Staging multiple routes to different destinations...

- reroute:
destination: sentinel
table: Syslog
staging: true
- reroute:
destination: azdx
table: CommonSecurityLog
staging: true

Discarding only the sentinel route while preserving azdx...

- discard:
destination: sentinel

Discard All Staged Routes

Staging routes for sentinel, azdx, and lake destinations...

- reroute:
destination: sentinel
staging: true
- reroute:
destination: azdx
staging: true
- reroute:
destination: lake
staging: true

Clearing all staged routes at once...

- discard:
description: "Remove all staged routes"

Conditional Discard

Log entry with discard decision field...

{
"message": "login attempt",
"should_discard": true
}
- reroute:
destination: sentinel
staging: true
- discard:
destination: sentinel
if: "should_discard == true"

Route discarded when condition evaluates to true...

# StagedRoutes: {}
# Routes: {}

Templated Destination

Using log field value to determine which route to discard...

{
"message": "event data",
"target_destination": "sentinel"
}
- reroute:
destination: sentinel
staging: true
- discard:
destination: "{{{target_destination}}}"

Template resolves to sentinel and removes that staged route...

# StagedRoutes: {}

Ignore Missing Destination

Attempting to discard non-existent destination with failure ignored...

- reroute:
destination: sentinel
staging: true
- discard:
destination: nonexistent
ignore_failure: true

Processor continues despite error, preserving original staged route...

# StagedRoutes: { sentinel: "..." }

Multiple Discard Operations

Complex staging scenario with selective discard and commit...

- reroute:
destination: sentinel
staging: true
- reroute:
destination: azdx
staging: true
- reroute:
destination: lake
staging: true
- discard:
destination: sentinel
- commit:
destination: azdx
- discard:
description: "Remove remaining staged routes"

Final state shows only azdx committed, all others discarded...

# StagedRoutes: {}
# Routes: { azdx: ["table_name"] }