Maintained with ☕️ by
IcePanel logo

Unroll Processor for Data Processing Pipelines Google SecOps data processing pipelines now support the Unroll processor (event breaking)

Share

Services

## Feature Feature **Unroll Processor for Data Processing Pipelines** Google SecOps data processing pipelines now support the **Unroll processor** (event breaking). This processor allows you to split log entries containing arrays or slices of events into multiple individual log events prior to parsing and ingestion. Key details: * **Event Breaking Capability:** Automatically expands log arrays into discrete log events. * **Pre-parsing Requirement:** The Unroll processor requires structured data inputs. Raw string payloads must first be parsed using a Transform processor (e.g., `set(body, ParseJSON(body))`) positioned prior to the Unroll processor in the pipeline execution sequence. For details on configuring data processing pipelines and processors, see [Set up and manage data processing pipelines](https://cloud.google.com/chronicle/docs/ingestion/data-processing-pipeline#configure-processors).