This was why i suggested to have a custom processor for handling data. this way you don't need to use bloblang, just use a few lines of yaml config.. This is also why i created the alarm plugin since creating all the conditions using bloblang could be cumbersome if you are not so into coding..