program

Remap Transform

The Vector remap transform transforms events using the Timber Remap Language, a fast, safe, self-documenting data mapping language.

Configuration

[transforms.my_transform_id]
  type = "remap" # required
  inputs = ["my-source-or-transform-id"] # required
  source = '''
  . = parse_json(.message)
  .status = to_int(.status)
  .duration = parse_duration(.duration, "s")
  .new_field = .old_field
  del(.old_field)
  '''
  • commonrequiredstring

    source

    The remap source/instruction set to execute for each event

    • View examples

Telemetry

This component provides the following metrics that can be retrieved through the internal_metrics source. See the metrics section in the monitoring page for more info.

  • counter

    processing_errors_total

    The total number of processing errors encountered by this component. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • error_type - The type of the error

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

  • counter

    processed_events_total

    The total number of events processed by this component. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • file - The file that produced the error

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

  • counter

    processed_bytes_total

    The total number of bytes processed by the component. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

Examples

Add, Rename, & Remove Fields

Given the following Vector event:

{
  "log": {
    "old_name": "old value"
  }
}

And the following configuration:

[transforms.remap]
type = "remap"
source = '''
.new_field = "new value"
.new_name = .old_name
del(.old_name)
'''

The following Vector log event will be output:

{
  "new_field": "new value",
  "new_name": "old value"
}

How It Works

Remap Language

The remap language is a restrictive, fast, and safe language we designed specifically for mapping data. It avoids the need to chain together many fundamental transforms to accomplish rudimentary reshaping of data.

The intent is to offer the same robustness of full language runtime without paying the performance or safety penalty.

Learn more about Vector's remap syntax in the docs.

Support
Contents
Resources