Field path notation reference

Throughout Vector’s configuration you’ll notice that certain options take field paths as values. In order to reference nested or array values, you can use Vector’s field path notation. This notation is not anything special, it simply uses . and [<index>] to access nested and array values, respectively.

Example

Let’s take this log event:

{
  "timestamp": "2020-02-14T01:22:23.223Z",
  "application_id": 1,
  "message": "Hello world",
  "field.with.dot": "value",
  "ec2": {
    "instance_id": "abcd1234",
    "tags": ["tag1: value1", "tag2: value1"]
  }
}

We can access the values like so:

Syntax

Root-level values

Root-level values can be accessed by supplying the name of the field, as shown in the example above:

field_name

Nested values

Nested values can be accessed by separating ancestor fields using the . character:

grandparent.parent.child

Array Values

Array values can be accessed using [<index>] syntax. This accesses the first value since it has an index of 0:

field_name[0]

This accesses the first value of the nested child field:

parent.child[0]

Escaping

The special characters ., [, and ] can be escaped with a \:

field\.with\.dots

The above name is treated literally.

The \ character, if used literally, must be escaped with a \ as well.