schema

Concat Transform

The Vector concat transform accepts and outputs log events, allowing you to concat (substrings) of other fields to a new one.

Configuration

vector.toml
[transforms.my_transform_id]
  type = "concat" # required
  inputs = ["my-source-or-transform-id"] # required
  items = ["first[..3]", "second[-5..]", "third[3..6]"] # required
  target = "root_field_name" # required
3 items
  • [string]commonrequired

    items

    A list of substring definitons in the format of source_field[start..end]. For both start and end negative values are counted from the end of the string.

    • No default
    • View examples
  • stringoptional

    joiner

    The string that is used to join all items.

    • Default: " "
    • View examples
  • stringcommonrequired

    target

    The name for the new label. See Field Notation Syntax for more info.

    • No default
    • View examples

Examples

Given the following input log event:

{
  "message": "Hello world",
  "month": "12",
  "day": "25",
  "year": "2020"
}

And the following example configuration:

[transforms.concat_date]
  type = "concat"
  items = ["month", "day", "year"]
  target = "date"
  joiner = "/"

A log event will be output with the following structure:

{
  "message": "Hello world",
  "date": "12/25/2020", // <-- new field
  "month": "12",
  "day": "25",
  "year": "2020"
}

How It Works

Complex Processing

If you encounter limitations with the concat transform then we recommend using a runtime transform. These transforms are designed for complex processing and give you the power of full programming runtime.

Environment Variables

Environment variables are supported through all of Vector's configuration. Simply add ${MY_ENV_VAR} in your Vector configuration file and the variable will be replaced before being evaluated.

You can learn more in the Environment Variables section.

Field Notation Syntax

The target options support Vector's field notation syntax, enabling access to root-level, nested, and array field values. For example:

vector.toml
[transforms.my_concat_transform_id]
  # ...
  target = "root_field_name"
  target = "parent.child"
  target = "array[0]"
  # ...

You can learn more about Vector's field notation in the field notation reference.

Support
Contents
Resources