Add Fields Transform

The Vector add_fields transform shapes logs

Configuration

[transforms.my_transform_id]
# General
type = "add_fields" # required
inputs = ["my-source-or-transform-id"] # required
overwrite = true # optional, default
# Fields
fields.string_field = "string value" # example
fields.env_var_field = "${ENV_VAR}" # example
fields.templated_field = "{{ my_other_field }}" # example
fields.int_field = 1 # example
fields.float_field = 1.2 # example
fields.bool_field = true # example
fields.timestamp_field = 1979-05-27T00:32:00Z # example
fields.parent.child_field = "child_value" # example
fields.list_field = ["first", "second", "third"] # example
  • commonrequiredtable

    fields

    A table of key/value pairs representing the keys to be added to the event.

    • commonrequired*

      *

      The name of the field to add. Accepts all supported types. Use . for adding nested fields.

    • commonoptionalbool

      overwrite

      By default, fields will be overridden. Set this to false to avoid overwriting values.

      • Default: true
      • View examples

    Output

    Telemetry

    This component provides the following metrics that can be retrieved through the internal_metrics source. See the metrics section in the monitoring page for more info.

    • counter

      processed_events_total

      The total number of events processed by this component. This metric includes the following tags:

      • component_kind - The Vector component kind.

      • component_name - The Vector component ID.

      • component_type - The Vector component type.

      • file - The file that produced the error

      • instance - The Vector instance identified by host and port.

      • job - The name of the job producing Vector metrics.

    • counter

      processed_bytes_total

      The total number of bytes processed by the component. This metric includes the following tags:

      • component_kind - The Vector component kind.

      • component_name - The Vector component ID.

      • component_type - The Vector component type.

      • instance - The Vector instance identified by host and port.

      • job - The name of the job producing Vector metrics.

    How It Works

    Conflicts

    Key Conflicts

    Keys specified in this transform will replace existing keys.

    Nested Key Conflicts

    Nested keys are added in a deep fashion. They will not replace any ancestor objects. For example, given the following log event:

    {
    "parent": {
    "child1": "value1"
    }
    }

    And the following configuration:

    [transforms.add_nested_field]
    type = "add_fields"
    fields.parent.child2 = "value2"

    Will result in the following event:

    {
    "parent": {
    "child1": "value1",
    "child2": "value2"
    }
    }

    Notice that parent.child1 field was preserved.

    Types

    All supported configuration value types are accepted. This includes primitive types (string, int, float, boolean) and special types, such as arrays and nested fields.