schema

Add Fields Transform

The Vector add_fields transform accepts and outputs log events, allowing you to add one or more log fields.

Configuration

vector.toml
[transforms.my_transform_id]
  # General
  type = "add_fields" # required
  inputs = ["my-source-or-transform-id"] # required
  overwrite = true # optional, default


  # Fields
  fields.string_field = "string value" # example
  fields.env_var_field = "${ENV_VAR}" # example
  fields.templated_field = "{{ my_other_field }}" # example
  fields.int_field = 1 # example
  fields.float_field = 1.2 # example
  fields.bool_field = true # example
  fields.timestamp_field = 1979-05-27T00:32:00Z # example
  fields.parent.child_field = "child_value" # example
  fields.list_field = ["first", "second", "third"] # example
2 items
  • tablecommonrequired

    fields

    A table of key/value pairs representing the keys to be added to the event.

    • *commonrequired

      [field-name]

      The name of the field to add. Accepts all supported types. Use . for adding nested fields.

      • No default
      • View examples
  • boolcommonoptional

    overwrite

    By default, fields will be overridden. Set this to false to avoid overwriting values.

    • Default: true
    • View examples

How It Works

Complex Processing

If you encounter limitations with the add_fields transform then we recommend using a runtime transform. These transforms are designed for complex processing and give you the power of full programming runtime.

Conflicts

Key Conflicts

Keys specified in this transform will replace existing keys.

Nested Key Conflicts

Nested keys are added in a deep fashion. They will not replace any ancestor objects. For example, given the following log event:

{
  "parent": {
    "child1": "value1"
  }
}

And the following configuration:

[transforms.add_nested_field]
  type = "add_fields"
  fields.parent.child2 = "value2"

Will result in the following event:

{
  "parent": {
    "child1": "value1",
    "child2": "value2"
  }
}

Notice that parent.child1 field was preserved.

Environment Variables

Environment variables are supported through all of Vector's configuration. Simply add ${MY_ENV_VAR} in your Vector configuration file and the variable will be replaced before being evaluated.

You can learn more in the Environment Variables section.

Types

All supported configuration value types are accepted. This includes primitive types (string, int, float, boolean) and special types, such as arrays and nested fields.

Support
Contents
Resources