Concat Transform

The Vector concat transform slices log string fields and joins them into a single field.

Configuration

• Common
• Advanced

• vector.toml
• vector.yaml
• vector.json

[transforms.my_transform_id]
  type = "concat" # required
  inputs = ["my-source-or-transform-id"] # required
  items = ["first[..3]", "second[-5..]", "third[3..6]"] # required
  target = "root_field_name" # required

• commonrequired[string]

  items

  A list of substring definitons in the format of source_field[start..end]. For both start and end negative values are counted from the end of the string.

  • View examples
• optionalstring

  joiner

  The string that is used to join all items.

  • Default: " "
  • View examples
• commonrequiredstring

  target

  The name for the new label.

  • View examples

Telemetry

This component provides the following metrics that can be retrieved through the internal_metrics source. See the metrics section in the monitoring page for more info.

• counter

  processed_events_total

  The total number of events processed by this component. This metric includes the following tags:

  • component_kind - The Vector component kind.

  • component_name - The Vector component ID.

  • component_type - The Vector component type.

  • file - The file that produced the error

  • instance - The Vector instance identified by host and port.

  • job - The name of the job producing Vector metrics.

• counter

  processed_bytes_total

  The total number of bytes processed by the component. This metric includes the following tags:

  • component_kind - The Vector component kind.

  • component_name - The Vector component ID.

  • component_type - The Vector component type.

  • instance - The Vector instance identified by host and port.

  • job - The name of the job producing Vector metrics.

Examples

Given the following Vector event:

{
  "log": {
    "message": "Hello world",
    "month": "12",
    "day": "25",
    "year": "2020"
  }
}

And the following configuration:

[transforms.concat]
type = "concat"
items = ["month", "day", "year"]
target = "date"
joiner = "/"

The following Vector log event will be output:

{
  "message": "Hello world",
  "date": "12/25/2020",
  "month": "12",
  "day": "25",
  "year": "2020"
}