This makes an extra copy of the event, thus the next step in the pipeline will see both events. This is mostly useful in the parser pipeline.
If you are using this function to copy an event to another repository, the
ALLOW_CHANGE_REPO_ON_EVENTS environment variable must be
set to true.
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
type | string | true | The value for #type for the copy. |
Examples
We store the event both with the timestamp from the event, but also as a
separate stream based on arrival time. This assumes the event has a type
that is not arrivaltime.
humio
copyEvent("arrivaltime") | case { #type=arrivaltime | @timestamp:=now() ; * | parseTimestamp(field=ts) }