Add Fields Transform

The Vector add_fields transform adds fields to log events.

Warnings

Configuration

[transforms.my_transform_id]
# General
type = "add_fields" # required
inputs = ["my-source-or-transform-id", "prefix-*"] # required
overwrite = true # optional, default
# Fields
fields.string_field = "string value" # example
fields.env_var_field = "${ENV_VAR}" # example
fields.templated_field = "{{ my_other_field }}" # example
fields.int_field = 1 # example
fields.float_field = 1.2 # example
fields.bool_field = true # example
fields.timestamp_field = 1979-05-27T00:32:00Z # example
fields.parent.child_field = "child_value" # example
fields.list_field = ["first", "second", "third"] # example
  • commonrequiredtable

    fields

    A table of key/value pairs representing the keys to be added to the event.

    • commonrequired*

      *

      The name of the field to add. Accepts all supported configuration types. Use . for adding nested fields.

    • commonoptionalbool

      overwrite

      By default, fields will be overridden. Set this to false to avoid overwriting values.

      • Default: true

    Telemetry

    This component provides the following metrics that can be retrieved through the internal_metrics source. See the metrics section in the monitoring page for more info.

    • counter

      processing_errors_total

      The total number of processing errors encountered by this component. This metric includes the following tags:

      • component_kind - The Vector component kind.

      • component_name - The Vector component ID.

      • component_type - The Vector component type.

      • error_type - The type of the error

      • instance - The Vector instance identified by host and port.

      • job - The name of the job producing Vector metrics.

    • counter

      events_in_total

      The total number of events accepted by this component. This metric includes the following tags:

      • component_kind - The Vector component kind.

      • component_name - The Vector component ID.

      • component_type - The Vector component type.

      • instance - The Vector instance identified by host and port.

      • job - The name of the job producing Vector metrics.

    • counter

      processed_events_total

      The total number of events processed by this component. This metric includes the following tags:

      • component_kind - The Vector component kind.

      • component_name - The Vector component ID.

      • component_type - The Vector component type.

      • file - The file that produced the error

      • instance - The Vector instance identified by host and port.

      • job - The name of the job producing Vector metrics.

    • counter

      events_out_total

      The total number of events emitted by this component. This metric includes the following tags:

      • component_kind - The Vector component kind.

      • component_name - The Vector component ID.

      • component_type - The Vector component type.

      • instance - The Vector instance identified by host and port.

      • job - The name of the job producing Vector metrics.

    • counter

      processed_bytes_total

      The total number of bytes processed by the component. This metric includes the following tags:

      • component_kind - The Vector component kind.

      • component_name - The Vector component ID.

      • component_type - The Vector component type.

      • instance - The Vector instance identified by host and port.

      • job - The name of the job producing Vector metrics.

    How It Works

    Conflicts

    Key Conflicts

    Keys specified in this transform will replace existing keys.

    Nested Key Conflicts

    Nested keys are added in a deep fashion. They will not replace any ancestor objects. For example, given the following log event:

    {
    "parent": {
    "child1": "value1"
    }
    }

    And the following configuration:

    [transforms.add_nested_field]
    type = "add_fields"
    fields.parent.child2 = "value2"

    Will result in the following event:

    {
    "parent": {
    "child1": "value1",
    "child2": "value2"
    }
    }

    Notice that parent.child1 field was preserved.

    State

    This component is stateless, meaning its behavior is consistent across each input.