Transaction

Transaction (transaction)

Sessionize related events using start/end markers and optional summary fields.

Transform json

Minimal example

actions:
  - transaction: {}

JSON

{
  "actions": [
    {
      "transaction": {}
    }
  ]
}

Contents

• Minimal example

• Fields

• General

• Detection

• Output

• Behaviour

• Timeouts

• Input

• Summary

• Schema

Fields

Field	Type	Required	Description
description General	string		Describe this step.
condition General	lua-expression (string)		Only run this action when the Lua condition evaluates to true. Examples: 2 * count()
start Detection	string		Field/pattern (e.g. “type:start”) that opens a transaction.
end Detection	string		Field/pattern that closes a transaction.
marker Output	string		Marker placed on emitted transaction envelopes.
common-fields Output	string[]		Common fields copied from each record to the transaction envelope.
use-document-marker Behaviour	boolean (bool)		Treat document boundaries as transaction markers.
combined-output Output	boolean (bool)		Emit a single combined event for the session instead of individual events.
combined-payload Output	boolean (bool)		When true, attach the payload array under _payload.
timeout-field Timeouts	string		Marker emitted when upstream stalled events close an open transaction.
group-by Input	field (string)		Group sessions independently by this field. Examples: data_field
session-summary Summary	Session Summary		Optional session summary output (counts, durations, numeric stats).
idle-timeout Timeouts	duration (string)		Idle timeout that auto-closes sessions without explicit end markers (e.g. “5m”).

General

Show fields

Field	Type	Required	Description
description	string		Describe this step.
condition	lua-expression (string)		Only run this action when the Lua condition evaluates to true. Examples: 2 * count()

Detection

Show fields

Field	Type	Required	Description
start	string		Field/pattern (e.g. “type:start”) that opens a transaction.
end	string		Field/pattern that closes a transaction.

Output

Show fields

Field	Type	Required	Description
marker	string		Marker placed on emitted transaction envelopes.
common-fields	string[]		Common fields copied from each record to the transaction envelope.
combined-output	boolean (bool)		Emit a single combined event for the session instead of individual events.
combined-payload	boolean (bool)		When true, attach the payload array under _payload.

Behaviour

Show fields

Field	Type	Required	Description
use-document-marker	boolean (bool)		Treat document boundaries as transaction markers.

Timeouts

Show fields

Field	Type	Required	Description
timeout-field	string		Marker emitted when upstream stalled events close an open transaction.
idle-timeout	duration (string)		Idle timeout that auto-closes sessions without explicit end markers (e.g. “5m”).

Input

Show fields

Field	Type	Required	Description
group-by	field (string)		Group sessions independently by this field. Examples: data_field

Summary

Show fields

Field	Type	Required	Description
session-summary	Session Summary		Optional session summary output (counts, durations, numeric stats).

Schema

• Session Summary - Numeric Fields Fields
• Session Summary Fields
• Session Summary - Numeric Fields - Ops Options

Session Summary - Numeric Fields Fields

Field	Type	Required	Description
field	field (string)	✅	Field to analyse across the session. Examples: data_field
ops	Ops[]		Operations to compute for the numeric field. Allowed values: min, max, sum, mean, stddev
prefix	string		Optional prefix applied to emitted metric fields.

Session Summary Fields

Field	Type	Required	Description
event-count-field	field (string)		Output field containing the number of events in the session. Examples: data_field
duration-field	field (string)		Output field containing the session duration in milliseconds. Examples: data_field
numeric-fields	Numeric Fields[]		Numeric fields to summarise with the configured operations.

Session Summary - Numeric Fields - Ops Options

Value	Description
min	Min
max	Max
sum	Sum
mean	Mean
stddev	Stddev