Job Actions

Jobs transform events after the input has parsed them and before the output delivers them. Each action rewrites, augments, or validates the event stream in place, so choosing the right sequence keeps pipelines fast and predictable. This page summarises the tools available in the visual editor and links to the detailed DSL reference for every action.

Action categories

Category	When to use	DSL entry points
Field editing	Clean up schemas, copy values, or flatten nested objects.	add, copy, rename, remove, flatten
Parsing & extraction	Turn raw text into structured fields or expand documents into events.	extract, csv, json, xml, key-value, expand, expand-events
Enrichment & derivation	Attach lookup data, hashes, counters, or timestamps.	enrich, time, script
Flow control	Route, validate, or stop events when conditions are not met.	filter, assert, abort, message
Delivery helpers	Package events for downstream systems or split batches.	csv, expand-events, message

Field editing essentials

• add creates or overwrites fields using literals, context placeholders ({{ }}), or runtime expansions (${ }}). Use it to tag events with deployment metadata or computed values.
• copy and rename leverage JSON Pointer paths to duplicate or retitle existing keys. copy preserves the original field; rename moves it.
• remove deletes fields and can be configured to error if the key is missing, which is helpful when enforcing schemas.
• flatten pulls nested objects up one level, converting { "a": { "b": 1 } } into { "a.b": 1 } for systems that expect flat records.

Parsing and extraction

Start with the action that matches the input format and then chain field edits as needed:

• extract applies regular expressions with capture groups. Use it when log lines need to be tokenised or rewritten. Set output-pattern to rebuild strings with placeholders.
• csv, json, and xml parse structured payloads embedded in a single event. Each action emits fields typed according to schema hints and can promote arrays into multiple events when paired with expand-events.
• key-value targets delimited pairs such as foo=bar baz=qux, letting you configure separators without writing custom scripts.

Enriching events

• enrich joins against CSV or SQLite assets that ship with the job. The runtime reloads the file when it changes, so you can update lookup tables without redeploying code.
• time normalises timestamps, converts time zones, and labels records that fall within specific schedules.
• script runs Lua snippets with built-in helpers (uuid(), count(), md5(), cond(), encryption utilities). Treat it as a last resort for logic that is too specialised for declarative actions.

Validating and routing

• filter keeps or discards events based on expressions. Use it to drop null records, enforce allow-lists, or branch pipelines when paired with worker channels.
• assert halts the run when a condition fails. It is ideal for catching schema regressions early in staging environments.
• abort stops the job immediately with a message. Use sparingly for fatal conditions such as malformed configuration.
• message emits structured control-plane messages that other jobs can subscribe to via the internal-messages input.

Testing transformations

Use Run & Trace after each significant change to inspect intermediate events. The trace view shows the payload entering and leaving every action, making it easy to confirm that field names, types, and counts match expectations. When actions rely on variable expansion, supply sample context values in the editor before running traces.

For the full parameter list, jump to the DSL action reference.