A stream task is a named Fluent Bit stream-processor definition. It uses a SQL-like expression to read event attributes from a tagged input or a named stream and emit the query result. Define it in a separate streams configuration file, then load that file through the main configuration. section 8.3 section 8.6
A task definition has three essential parts:
- `[STREAM_TASK]` starts a referenceable task definition. section 8.3
- `name` assigns the identifier used for the expression. section 8.3
- `exec` supplies a semicolon-terminated SQL-like query, such as `SELECT rand_value FROM TAG:'random-num';`. section 8.3
Listing 8.1 Query stream processor definition: query.conf
[STREAM_TASK] #1 name selectTask #2 exec SELECT rand_value FROM TAG:'random-num'; #3
This minimal task selects the `rand_value` attribute from events tagged `random-num`. A main configuration can load it with `streams_file`; with ordinary output sent to `null`, the SELECT result is the visible processor output. section 8.3
Use `TAG:'tag-name'` when selecting by tag; quotes accommodate unusual tag characters and tags can use wildcards. Use `STREAM:input.instance` when selecting a specific input stream; stream names do not use quotes and do not support wildcards. Multiple tasks can independently select a record tag and value, calculate `sum(rand_value)`, or filter with `WHERE rand_value > 0`. section 8.3 section 8.6
Switching a task from a tag to a stream
To bind a query to the first random input instance rather than every matching tag, replace `FROM TAG:'random-num'` with `FROM STREAM:random.0`. The resulting task can select values, calculate sums, or count values with a `WHERE` condition. Stream-based tasks can also provide streams to which downstream processors attach. section 8.6
