Break

Flow Control

Synopsis

Halts the remaining processors in the current pipeline chain and forwards the log entry to its target without further processing, similar to a break statement in programming languages.

Schema

- break:
    description: <text>
    if: <script>
    tag: <string>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
description	N		Explanatory note
if	N		Condition to run
tag	N		Identifier
disabled	N	false	When true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration

note

This processor does not accept on_success, on_failure or ignore_failure. Its whole job is to signal a control-flow decision to the pipeline runner, and it returns that signal directly — there is no success or failure outcome for a handler to run against. if, tag and disabled work normally.

Details

The break processor stops execution of all remaining processors in the current pipeline chain. The log entry is not dropped — it is forwarded to its configured target as-is, with all field values set up to the point of the break.

This processor has no required fields. When used without an if condition, it unconditionally halts further processing. The most common usage is with an if expression to conditionally exit the pipeline when specific criteria are met.

The break processor is classified as a finalizer: once triggered, the pipeline engine stops processing the current processor list and returns the log entry for delivery.

Examples

Unconditional Break

Halting all further processing unconditionally...	{ "source": {"ip": "192.168.1.1"}, "event": {"action": "login"} } - set: field: processed value: true - break: description: "Stop processing here" - set: field: should_not_appear value: true
Processing stops at break; log entry is forwarded with only the fields set before break...	{ "source": {"ip": "192.168.1.1"}, "event": {"action": "login"}, "processed": true }

Conditional Break

Stopping processing when packet count matches condition...	{ "source": {"packets": 10}, "network": {"protocol": "tcp"} } - set: field: initial_check value: true - break: if: "ctx.source.packets == 10" description: "Exit early for 10-packet events" - geoip: field: source.ip target: source.geo - threat_intel: field: source.ip
Pipeline halts when condition is met; expensive enrichment processors are skipped...	{ "source": {"packets": 10}, "network": {"protocol": "tcp"}, "initial_check": true }

Marking an Event Before Breaking

Set the marker in its own step ahead of the break, guarded by the same condition. break has no on_success hook to hang it off...	{ "event": {"type": "heartbeat"}, "host": {"name": "monitor-01"} } - set: if: "ctx.event.type == 'heartbeat'" field: pipeline.skipped value: true - break: if: "ctx.event.type == 'heartbeat'" description: "Skip enrichment for heartbeat events" - enrich: field: host.name target: host.details
Heartbeat events exit early with the skip marker set; non-heartbeat events proceed to enrichment...	{ "event": {"type": "heartbeat"}, "host": {"name": "monitor-01"}, "pipeline": {"skipped": true} }