Concat Transform

The Vector concat transform accepts and outputs log events allowing you to concat (substrings) of other fields to a new one.

Configuration

vector.toml
[transforms.my_transform_id]
# REQUIRED
type = "concat" # must be: "concat"
inputs = ["my-source-id"] # example
items = ["first[..3]", "second[-5..]", "third[3..6]"] # example
target = "dest_field_name" # example
# OPTIONAL
joiner = " " # default

Options

3 items
[string]commonrequired

items

A list of substring definitons in the format of source_field[start..end]. For both start and end negative values are counted from the end of the string.

No default
View examples
stringcommonrequired

joiner

The string that is used to join all items.

Default: " "
View examples
stringcommonrequired

target

The name for the new label.

No default
View examples

Output

The concat transform accepts and outputs log events allowing you to concat (substrings) of other fields to a new one. For example:

Given the following input log event:

{
"message": "Hello world",
"month": "12",
"day": "25",
"year": "2020"
}

And the following example configuration:

[transforms.concat_date]
type = "concat"
items = ["month", "day", "year"]
target = "date"
joiner = "/"

A log event will be output with the following structure:

{
"message": "Hello world",
"date": "12/25/2020", // <-- new field
"month": "12",
"day": "25",
"year": "2020"
}

How It Works

Environment Variables

Environment variables are supported through all of Vector's configuration. Simply add ${MY_ENV_VAR} in your Vector configuration file and the variable will be replaced before being evaluated.

You can learn more in the Environment Variables section.