Concat Transform

The Vector concat transform accepts log events and allows you to concat (substrings) of other fields to a new one.

Configuration

vector.toml

[transforms.my_transform_id]
  # REQUIRED
  type = "concat" # must be: "concat"
  inputs = ["my-source-id"] # example
  items = ["fist[..3]", "second[-5..]", "third[3..6]"] # example
  target = "dest_field_name" # example
  # OPTIONAL
  joiner = " " # default

Options

3 items

common onlyrequired only

common[string]required

items

A list of substring definitons in the format of source_field[start..end]. For both start and end negative values are counted from the end of the string.

No default

View examples

commonstringrequired

joiner

The string that is used to join all items.

Default: " "

View examples

commonstringrequired

target

The name for the new label.

No default

View examples

Output

The concat transform accepts log events and allows you to concat (substrings) of other fields to a new one. For example:

Given the following input log event:

{
  "message": "Hello world",
  "month": "12",
  "day": "25",
  "year": "2020"
}

And the following example configuration:

[transforms.concat_date]
  type = "concat"
  items = ["month", "day", "year"]
  target = "date"
  joiner = "/"

A log event will be output with the following structure:

{
  "message": "Hello world",
  "date": "12/25/2020", // <-- new field
  "month": "12",
  "day": "25",
  "year": "2020"
}

How It Works

Environment Variables

Environment variables are supported through all of Vector's configuration. Simply add ${MY_ENV_VAR} in your Vector configuration file and the variable will be replaced before being evaluated.

You can learn more in the Environment Variables section.