Concat Transform

The Vector concat transform accepts log events and allows you to concat (substrings) of other fields to a new one.

Configuration

vector.toml
[transforms.my_transform_id]
# REQUIRED
type = "concat" # must be: "concat"
inputs = ["my-source-id"] # example
items = ["fist[..3]", "second[-5..]", "third[3..6]"] # example
target = "dest_field_name" # example
# OPTIONAL
joiner = " " # default

Options

3 items
common[string]required

items

A list of substring definitons in the format of source_field[start..end]. For both start and end negative values are counted from the end of the string.

No default
View examples
commonstringrequired

joiner

The string that is used to join all items.

Default: " "
View examples
commonstringrequired

target

The name for the new label.

No default
View examples

Output

The concat transform accepts log events and allows you to concat (substrings) of other fields to a new one. For example:

Given the following input log event:

{
"message": "Hello world",
"month": "12",
"day": "25",
"year": "2020"
}

And the following example configuration:

[transforms.concat_date]
type = "concat"
items = ["month", "day", "year"]
target = "date"
joiner = "/"

A log event will be output with the following structure:

{
"message": "Hello world",
"date": "12/25/2020", // <-- new field
"month": "12",
"day": "25",
"year": "2020"
}

How It Works

Environment Variables

Environment variables are supported through all of Vector's configuration. Simply add ${MY_ENV_VAR} in your Vector configuration file and the variable will be replaced before being evaluated.

You can learn more in the Environment Variables section.