Add Fields Transform

The Vector add_fields transform adds fields to log events.

Configuration

• Common
• Advanced

• vector.toml
• vector.yaml
• vector.json

[transforms.my_transform_id]
  # General
  type = "add_fields" # required
  inputs = ["my-source-or-transform-id"] # required
  overwrite = true # optional, default

  # Fields
  fields.string_field = "string value" # example
  fields.env_var_field = "${ENV_VAR}" # example
  fields.templated_field = "{{ my_other_field }}" # example
  fields.int_field = 1 # example
  fields.float_field = 1.2 # example
  fields.bool_field = true # example
  fields.timestamp_field = 1979-05-27T00:32:00Z # example
  fields.parent.child_field = "child_value" # example
  fields.list_field = ["first", "second", "third"] # example

• commonrequiredtable

  fields

  A table of key/value pairs representing the keys to be added to the event.

  • commonrequired*

    *

    The name of the field to add. Accepts all supported types. Use . for adding nested fields.
• commonoptionalbool

  overwrite

  By default, fields will be overridden. Set this to false to avoid overwriting values.

  • Default: true
  • View examples

Telemetry

This component provides the following metrics that can be retrieved through the internal_metrics source. See the metrics section in the monitoring page for more info.

• counter

  processed_events_total

  The total number of events processed by this component. This metric includes the following tags:

  • component_kind - The Vector component kind.

  • component_name - The Vector component ID.

  • component_type - The Vector component type.

  • file - The file that produced the error

  • instance - The Vector instance identified by host and port.

  • job - The name of the job producing Vector metrics.

• counter

  processed_bytes_total

  The total number of bytes processed by the component. This metric includes the following tags:

  • component_kind - The Vector component kind.

  • component_name - The Vector component ID.

  • component_type - The Vector component type.

  • instance - The Vector instance identified by host and port.

  • job - The name of the job producing Vector metrics.

How It Works

Conflicts

Key Conflicts

Keys specified in this transform will replace existing keys.

Nested Key Conflicts

Nested keys are added in a deep fashion. They will not replace any ancestor objects. For example, given the following log event:

{
  "parent": {
    "child1": "value1"
  }
}

And the following configuration:

[transforms.add_nested_field]
  type = "add_fields"
  fields.parent.child2 = "value2"

Will result in the following event:

{
  "parent": {
    "child1": "value1",
    "child2": "value2"
  }
}

Notice that parent.child1 field was preserved.

Types

All supported configuration value types are accepted. This includes primitive types (string, int, float, boolean) and special types, such as arrays and nested fields.