From 291b460c0a5fa8cc9476f64677f32388a57caf06 Mon Sep 17 00:00:00 2001 From: Taylor Gray Date: Mon, 20 Jul 2026 11:51:22 -0500 Subject: [PATCH] docs: Add split_when parameter to split_event processor Document the new split_when conditional parameter for the split_event processor. Includes configuration table entry and usage example. Related: opensearch-project/data-prepper#6992 Signed-off-by: Taylor Gray --- .../configuration/processors/split-event.md | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/_data-prepper/pipelines/configuration/processors/split-event.md b/_data-prepper/pipelines/configuration/processors/split-event.md index aedb4af2cfb..0918aecd181 100644 --- a/_data-prepper/pipelines/configuration/processors/split-event.md +++ b/_data-prepper/pipelines/configuration/processors/split-event.md @@ -19,6 +19,7 @@ The following table describes the configuration options for the `split_event` pr | `field` | String | The event field to be split. | | `delimiter_regex`| String | The regular expression used as the delimiter for splitting the field. | | `delimiter` | String | The delimiter used for splitting the field. If not specified, the default delimiter is used. | +| `split_when` | String | A [conditional expression]({{site.url}}{{site.baseurl}}/data-prepper/pipelines/expression-syntax/) that determines whether the processor will be run on the event. If the condition evaluates to `false`, the event passes through unchanged. Default is `null` (all events are processed). | # Usage @@ -50,3 +51,23 @@ The input will be split into multiple events based on the `query` field, with th {"query" : "source", "some_other_field" : "abc" } ``` +## Conditional splitting with split_when + +You can use `split_when` to conditionally apply the split based on event content. This is useful in multi-tenant pipelines where only certain events should be split. + +```yaml +split-event-pipeline: + source: + http: + processor: + - split_event: + field: body + delimiter: "\n" + split_when: 'contains(/body, "\n")' + sink: + - stdout: +``` +{% include copy.html %} + +In this example, the `split_event` processor only splits events where the `body` field contains a newline character. Events without newlines pass through unchanged. +