Chain​

The Chain Function does one thing: It chains data processing from a Pipeline or Pack to another Pipeline or Pack. This can be useful for sequential processing, or just to separate groups of related Functions into discrete Pipeline or Pack units that make intuitive sense.

Control Flow​

The chained Pipeline or Pack will, upon completion, normally return control to the parent Pipeline/Pack containing the Chain Function. However, if the chained Pipeline/Pack contains any Function with the Final flag enabled, processing will stop there. In this case, back in the parent Pipeline/Pack, no Function below Chain will execute.

Cycle Detection and Throughput​

The Chain Function includes guardrails against circular references. In v.4.3 and later, Cribl Stream detects cycles when you configure your Pipeline. This early detection (compared to earlier versions’ runtime detection) means that:

• If you try to save a Pipeline with a cyclical reference, Cribl Stream will throw an error.
• If an existing Pipeline’s configuration contains a cycle, Cribl Stream will disable the final Chain Function involved in the cycle.

Despite these safeguards, Cribl recommends that you keep chained configurations simple and understandable by all your users. Also, keep in mind that inserting a Chain Function can impose a slight performance hit, compared to including all processing in the original Pipeline or Pack.

Pipeline Versus Pack Scope​

You will see different scope restrictions when using Chain in a Pipeline versus in a Pack:

• In a Pipeline, the Processor drop-down displays both Pipelines and Packs as targets to chain to.
• In a Pack, the Processor drop-down offers only Pipelines contained within that Pack.

Usage​

Filter: Filter expression (JS) that selects data to feed through the Function. Defaults to true, meaning it evaluates all events.

Description: Optionally, add a simple description of this Function’s purpose. Defaults to empty.

Final: If toggled to Yes, stops feeding data to the downstream Functions. Defaults to No. (Note that this will not prevent data from flowing to the Function’s defined Processor.)

Processor: Use this drop-down to select a configured Pipeline or Pack through which to forward events.

Example​

This shows a simple preview of a pipeline-1 Pipeline, which chains to a pipeinpipe Pipeline. Notice that each event’s added cribl_pipe field lists all Pipelines/Packs through which the event was chained.