Skip to main content

Final

Control Flow Pipeline

Synopsis​

Completes all pipeline processing for the current event, indicating that the data is finalized and no further processing is needed.

Schema​

- final:
    description: <text>
    if: <script>
    tag: <string>

Configuration​

The following fields are used to define the processor:

FieldRequiredDefaultDescription
descriptionN-Explanatory note for documentation
ifN-Condition determining when to finalize processing
tagN-Identifier for the finalization point
disabledNfalseWhen true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration
note

This processor does not accept on_success, on_failure or ignore_failure. Its whole job is to signal a control-flow decision to the pipeline runner, and it returns that signal directly — there is no success or failure outcome for a handler to run against. if, tag and disabled work normally.

Details​

The final processor marks the event as complete and stops all further pipeline processing. It signals that the data has reached its final state and requires no additional transformation or enrichment.

Key Characteristics:

  • Stops all subsequent processors in the current pipeline
  • Prevents execution of any additional pipelines configured for the event
  • The event continues to its configured destinations with its current state
  • Useful for creating explicit completion points in complex pipeline flows

Typical uses:

  • Early Exit on Success

    - append:
        field: tags
        value: processed
    - final:
        if: "ctx.tags.contains('processed')"

  • Prevent Duplicate Processing

    - set:
        field: processed_by
        value: pipeline_a
    - final:
        description: "Prevent other pipelines from processing"

  • Conditional Pipeline Branch

    - final:
        if: "ctx.environment == 'production'"
        description: "Skip test processors in production"
    - set:
        field: test_field
        value: test_value
Final vs Return vs Continue

All these processors control pipeline flow: final stops all pipeline processing, return exits the current block, and continue skips to the next iteration. Use final for graceful pipeline termination with clear semantic intent.

Use description to document the finalization points, test conditional finalization thoroughly, and use tag to track them in logs. Cleanup work belongs in the processors before final, since nothing after it runs.

warning

Once final is used, no further processors in any pipeline will execute. The event will be sent to its configured destinations with its current state. Use with caution in multi-pipeline setups, and consider using if to prevent unintended early termination.

Examples​

Basic​

Stopping processing after the field update...

- set:
    field: status
    value: completed
- final:
    description: "Stop after status update"
- set:  # This processor won't run
    field: other_field
    value: skipped

prevents further processing:

{
  "status": "completed"
}

Conditionals​

Finalizing based on packet count...

{
  "source": {
    "packets": 10
  }
}
- final:
    if: "ctx.source.packets == 10"
    description: "Stop processing for 10-packet sources"

stops the process when the condition is met:

Pipeline processing finalized

Cleanup Before Finalizing​

final runs no handlers, so cleanup goes in the steps before it...

- set:
    field: processing_status
    value: completed
- remove:
    field: temporary_data
- final:
    description: "Clean finalization"

leaving the event in its finished state:

{
  "processing_status": "completed"
}