Add Fields Transform

The Vector add_fields transform adds fields to log events.

Warnings

Configuration

[transforms.my_transform_id]
# General
type = "add_fields" # required
inputs = ["my-source-or-transform-id", "prefix-*"] # required
overwrite = true # optional, default
# Fields
fields.string_field = "string value" # example
fields.env_var_field = "${ENV_VAR}" # example
fields.templated_field = "{{ my_other_field }}" # example
fields.int_field = 1 # example
fields.float_field = 1.2 # example
fields.bool_field = true # example
fields.timestamp_field = 1979-05-27T00:32:00Z # example
fields.parent.child_field = "child_value" # example
fields.list_field = ["first", "second", "third"] # example
  • commonrequiredtable

    fields

    A table of key/value pairs representing the keys to be added to the event.

    • commonrequired*

      *

      The name of the field to add. Accepts all supported configuration types. Use . for adding nested fields.

    • commonoptionalbool

      overwrite

      By default, fields will be overridden. Set this to false to avoid overwriting values.

      • Default: true

    Telemetry

    This component provides the following metrics that can be retrieved through the internal_metrics source. See the metrics section in the monitoring page for more info.

    • counter

      processing_errors_total

      The total number of processing errors encountered by this component. This metric includes the following tags:

      • component_kind - The Vector component kind.

      • component_name - The Vector component ID.

      • component_type - The Vector component type.

      • error_type - The type of the error

      • instance - The Vector instance identified by host and port.

      • job - The name of the job producing Vector metrics.

    • counter

      events_in_total

      The number of events accepted by this component either from tagged origin like file and uri, or cumulatively from other origins. This metric includes the following tags:

      • component_kind - The Vector component kind.

      • component_name - The Vector component ID.

      • component_type - The Vector component type.

      • container_name - The name of the container from which the event originates.

      • file - The file from which the event originates.

      • instance - The Vector instance identified by host and port.

      • job - The name of the job producing Vector metrics.

      • mode - The connection mode used by the component.

      • peer_addr - The IP from which the event originates.

      • peer_path - The pathname from which the event originates.

      • pod_name - The name of the pod from which the event originates.

      • uri - The sanitized uri from which the event originates.

    • counter

      processed_events_total

      The total number of events processed by this component. This metric includes the following tags:

      • component_kind - The Vector component kind.

      • component_name - The Vector component ID.

      • component_type - The Vector component type.

      • file - The file that produced the error

      • instance - The Vector instance identified by host and port.

      • job - The name of the job producing Vector metrics.

    • counter

      events_out_total

      The total number of events emitted by this component. This metric includes the following tags:

      • component_kind - The Vector component kind.

      • component_name - The Vector component ID.

      • component_type - The Vector component type.

      • instance - The Vector instance identified by host and port.

      • job - The name of the job producing Vector metrics.

    • counter

      processed_bytes_total

      The number of bytes processed by the component. This metric includes the following tags:

      • component_kind - The Vector component kind.

      • component_name - The Vector component ID.

      • component_type - The Vector component type.

      • container_name - The name of the container from which the bytes originate.

      • file - The file from which the bytes originate.

      • instance - The Vector instance identified by host and port.

      • job - The name of the job producing Vector metrics.

      • mode - The connection mode used by the component.

      • peer_addr - The IP from which the bytes originate.

      • peer_path - The pathname from which the bytes originate.

      • pod_name - The name of the pod from which the bytes originate.

      • uri - The sanitized uri from which the bytes originate.

    How It Works

    Conflicts

    Key Conflicts

    Keys specified in this transform will replace existing keys.

    Nested Key Conflicts

    Nested keys are added in a deep fashion. They will not replace any ancestor objects. For example, given the following log event:

    {
    "parent": {
    "child1": "value1"
    }
    }

    And the following configuration:

    [transforms.add_nested_field]
    type = "add_fields"
    fields.parent.child2 = "value2"

    Will result in the following event:

    {
    "parent": {
    "child1": "value1",
    "child2": "value2"
    }
    }

    Notice that parent.child1 field was preserved.

    State

    This component is stateless, meaning its behavior is consistent across each input.