Add Fields Transform
The Vector add_fields
transform
adds fields to log events.
Configuration
- Common
- Advanced
- vector.toml
- vector.yaml
- vector.json
[transforms.my_transform_id]# Generaltype = "add_fields" # requiredinputs = ["my-source-or-transform-id"] # requiredoverwrite = true # optional, default# Fieldsfields.string_field = "string value" # examplefields.env_var_field = "${ENV_VAR}" # examplefields.templated_field = "{{ my_other_field }}" # examplefields.int_field = 1 # examplefields.float_field = 1.2 # examplefields.bool_field = true # examplefields.timestamp_field = 1979-05-27T00:32:00Z # examplefields.parent.child_field = "child_value" # examplefields.list_field = ["first", "second", "third"] # example
- requiredtable
fields
A table of key/value pairs representing the keys to be added to the event.
- required*
*
The name of the field to add. Accepts all supported types. Use
.
for adding nested fields.
- optionalbool
overwrite
By default, fields will be overridden. Set this to
false
to avoid overwriting values.- Default:
true
- View examples
- Default:
Telemetry
This component provides the following metrics that can be retrieved through
the internal_metrics
source. See the
metrics section in the
monitoring page for more info.
- counter
processed_events_total
The total number of events processed by this component. This metric includes the following tags:
component_kind
- The Vector component kind.component_name
- The Vector component ID.component_type
- The Vector component type.file
- The file that produced the errorinstance
- The Vector instance identified by host and port.job
- The name of the job producing Vector metrics.
- counter
processed_bytes_total
The total number of bytes processed by the component. This metric includes the following tags:
component_kind
- The Vector component kind.component_name
- The Vector component ID.component_type
- The Vector component type.instance
- The Vector instance identified by host and port.job
- The name of the job producing Vector metrics.
How It Works
Conflicts
Key Conflicts
Keys specified in this transform will replace existing keys.
Nested Key Conflicts
Nested keys are added in a deep fashion. They will not replace any ancestor
objects. For example, given the following log
event:
{"parent": {"child1": "value1"}}
And the following configuration:
[transforms.add_nested_field]type = "add_fields"fields.parent.child2 = "value2"
Will result in the following event:
{"parent": {"child1": "value1","child2": "value2"}}
Notice that parent.child1
field was preserved.
Types
All supported configuration value types are
accepted. This includes primitive types (string
, int
, float
, boolean
)
and special types, such as arrays and
nested fields.