lua transform
The lua
transform accepts log
events and allows you to transform events with a full embedded Lua engine.
Configuration
[transforms.my_transform_id]# REQUIREDtype = "lua" # example, must be: "lua"inputs = ["my-source-id"] # examplesource = """require("script") # a `script.lua` file must be in your[`search_dirs`](#search_dirs)if event["host"] == nil thenlocal f = io.popen ("/bin/hostname")local hostname = f:read("*a") or ""f:close()hostname = string.gsub(hostname, "\n$", "")event["host"] = hostnameend"""# OPTIONALsearch_dirs = ["/etc/vector/lua"] # example, no default
Options
search_dirs
A list of directories search when loading a Lua file via the require
function. See Search Directories for more info.
source
The inline Lua source to evaluate. See Global Variables for more info.
Output
- Add Fields
- Remove Fields
- Drop Event
How It Works
Dropping Events
To drop events, simply set the event
variable to nil
. For example:
if event["message"].match(str, "debug") thenevent = nilend
Environment Variables
Environment variables are supported through all of Vector's configuration.
Simply add ${MY_ENV_VAR}
in your Vector configuration file and the variable
will be replaced before being evaluated.
You can learn more in the Environment Variables section.
Global Variables
When evaluating the providedsource
, Vector will provide a single global
variable representing the event:
Name | Type | Description |
---|---|---|
event | table | The current [log event]. Depending on prior processing the structure of your event will vary. Generally though, it will follow the default event schema. |
Note, a Lua table
is an associative array. You can read more about
Lua types in the Lua docs.
Iterate over fields
To iterate over all fields of an event
use the pairs
method. For example:
# Remove all fields where the value is "-"for f,v in pairs(event) doif v == "-" thenevent[f] = nilendend
Nested Fields
As described in the Data Model document, Vector flatten
events, representing nested field with a .
delimiter. Therefore, adding,
accessing, or removing nested fields is as simple as added a .
in your key
name:
# Add nested fieldevent["parent.child"] = "nested value"# Remove nested fieldevent["parent.child"] = nil
Search Directories
Vector provides asearch_dirs
option that allows you to specify absolute
paths that will searched when using the Lua require
function.