Add Fields Transform

The Vector add_fields transform accepts and outputs log events, allowing you to add one or more log fields.


# General
type = "add_fields" # required
inputs = ["my-source-or-transform-id"] # required
overwrite = true # optional, default
# Fields
fields.string_field = "string value" # example
fields.env_var_field = "${ENV_VAR}" # example
fields.templated_field = "{{ my_other_field }}" # example
fields.int_field = 1 # example
fields.float_field = 1.2 # example
fields.bool_field = true # example
fields.timestamp_field = 1979-05-27T00:32:00Z # example
fields.parent.child_field = "child_value" # example
fields.list_field = ["first", "second", "third"] # example
  • tablecommonrequired


    A table of key/value pairs representing the keys to be added to the event.

    • *commonrequired


      The name of the field to add. Accepts all supported types. Use . for adding nested fields.

      • No default
      • View examples
  • boolcommonoptional


    By default, fields will be overridden. Set this to false to avoid overwriting values.

    • Default: true
    • View examples

How It Works

Complex Processing

If you encounter limitations with the add_fields transform then we recommend using a runtime transform. These transforms are designed for complex processing and give you the power of full programming runtime.


Key Conflicts

Keys specified in this transform will replace existing keys.

Nested Key Conflicts

Nested keys are added in a deep fashion. They will not replace any ancestor objects. For example, given the following log event:

"parent": {
"child1": "value1"

And the following configuration:

type = "add_fields"
fields.parent.child2 = "value2"

Will result in the following event:

"parent": {
"child1": "value1",
"child2": "value2"

Notice that parent.child1 field was preserved.

Environment Variables

Environment variables are supported through all of Vector's configuration. Simply add ${MY_ENV_VAR} in your Vector configuration file and the variable will be replaced before being evaluated.

You can learn more in the Environment Variables section.


All supported configuration value types are accepted. This includes primitive types (string, int, float, boolean) and special types, such as arrays and nested fields.