I have a log source which formats log events as a single "event" which contains an array of JSON objects. I'd like to treat each item in the array as its own event, similar to the unwind transformation from MongoDB. Does Panther provide any way to do this during ingest?
Panther is not able to separate multiple logs from a single payload array.
If you need to separate log events for processing in Panther, we currently advise to use a preprocessor, like Cribbl, Fluentd, or a custom scripted solution.