Skip to main content

Continue

Control Flow Pipeline

Synopsis​

Skips the remaining processors for the current item in a foreach loop and immediately proceeds to the next item, similar to continue in programming languages.

Schema​

- continue:
    description: <text>
    if: <script>
    tag: <string>

Configuration​

The following fields are used to define the processor:

FieldRequiredDefaultDescription
descriptionN-Explanatory note
ifN-Condition to run
tagN-Identifier
disabledNfalseWhen true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration
note

This processor does not accept on_success, on_failure or ignore_failure. Its whole job is to signal a control-flow decision to the pipeline runner, and it returns that signal directly — there is no success or failure outcome for a handler to run against. if, tag and disabled work normally.

Details​

The continue processor skips to the next iteration when used inside a foreach processor. It behaves like a continue statement in programming languages, allowing you to skip processing for certain items while continuing with the rest of the collection.

Behavior:

  • Inside a foreach processor: Skips remaining processors for the current item and moves to the next item
  • Outside a foreach context: Acts as an early exit from the current processing scope

The processor moves to the next iteration immediately once its condition passes. It runs no handlers of its own, so any marking or logging step has to be placed ahead of it inside the loop body.

Continue vs Return

continue skips to the next iteration within a loop, while return exits the entire block. Use continue for selective item processing and return for complete exit logic.

Primary Use Case

The continue processor is most valuable inside foreach loops where you need to filter or skip certain items without affecting the processing of other items in the collection.

Examples​

Skip Items in Foreach Loop​

Processing only specific items in a collection...

- foreach:
    field: items
    processors:
      - continue:
          if: "ctx._item.status == 'ignored'"
          description: "Skip ignored items"
      - set:
          field: ctx._item.processed
          value: true
      - enrich:
          field: ctx._item.id
          target: ctx._item.details

skips ignored items, processes others:

{
  "items": [
    {"id": 1, "status": "active", "processed": true},
    {"id": 2, "status": "ignored"},
    {"id": 3, "status": "active", "processed": true}
  ]
}

Conditional Item Processing​

Skipping items based on validation...

- foreach:
    field: transactions
    processors:
      - set:
          if: "ctx._item.amount < 100"
          field: ctx._item.processed_tier
          value: "skipped"
      - continue:
          if: "ctx._item.amount < 100"
          description: "Skip small transactions"
      - set:
          field: ctx._item.requires_review
          value: true
      - complex_validation:
          field: ctx._item

processes only transactions over threshold:

{
  "transactions": [
    {"amount": 50, "processed_tier": "skipped"},
    {"amount": 500, "requires_review": true}
  ]
}

Error Recovery in Loop​

Continuing on item-level errors...

- foreach:
    field: users
    processors:
      - enrich:
          field: ctx._item.user_id
          target: ctx._item.profile
          on_failure:
            - set:
                field: ctx._item.enrichment_failed
                value: true
            - continue:
                description: "Skip enrichment for this user"
      - validate:
          field: ctx._item.profile
          exists: true

continues processing other users on enrichment failure:

{
  "users": [
    {"user_id": "123", "profile": {...}},
    {"user_id": "456", "enrichment_failed": true},
    {"user_id": "789", "profile": {...}}
  ]
}

Filter and Transform Collection​

Selectively transforming items...

- foreach:
    field: events
    processors:
      - continue:
          if: "ctx._item.type != 'security'"
          description: "Process only security events"
      - set:
          field: ctx._item.priority
          value: "high"
      - threat_analysis:
          field: ctx._item.indicators
      - set:
          field: ctx._item.analyzed
          value: true

applies security processing only to relevant events:

{
  "events": [
    {"type": "info"},
    {"type": "security", "priority": "high", "analyzed": true},
    {"type": "debug"}
  ]
}