Rename Fields Transform

The Vector rename_fields transform accepts and outputs log events allowing you to rename one or more log fields.

Configuration

• Common
• Advanced

vector.toml

[transforms.my_transform_id]
  # General
  type = "rename_fields" # required
  inputs = ["my-source-id"] # required

  # Fields
  fields.old_field_name = "new_field_name" # example
  fields.parent.old_child_name = "parent.new_child_name" # example

2 items

commonrequired

• tablecommonrequired

  fields

  A table of old-key/new-key pairs representing the keys to be moved in the event.

  • *commonrequired

    [field-name]

    Old-key/New-key pair reprsenting the key to be moved.

    • No default
    • View examples
• booloptional

  drop_empty

  If set to true, after renaming fields, remove any parent objects of the old field that are now empty.

  • Default: false
  • View examples

Examples

Given the following log event:

{
  // ...
  "old_field": "root_value",
  "old_nested": {
    "nested": "nested_value"
  }
  // ...
}

And a Vector configuration like:

vector.toml

[transforms.my_transform]
  type = "rename_fields"
  inputs = [...]

  fields.old_field = "new_field"
  fields.old_nested.nested = "new_nested.nested",

Will result in the following log event:

{
  // ...
  "new_field": "root_value",
  "new_nested": {
    "nested": "nested_value"
  }
  // ...
}

How It Works

Complex Processing

If you encounter limitations with the rename_fields transform then we recommend using a runtime transform. These transforms are designed for complex processing and give you the power of full programming runtime.

Conflicts

Key Conflicts

Keys specified in this transform will replace existing keys.

Please note. Vector makes no guarantee on the order of execution. If two rename operations must be performed in a specific order, it is recommended to split them up across two separate rename transforms.

Nested Key Conflicts

Keys are renamed in a deep fashion. They will not replace any ancestor objects. For example, given the following log event:

{
  "root": "value2",
  "parent": {
    "child1": "value1"
  }
}

And the following configuration:

[transforms.rename_nested_field]
  type = "rename_fields"
  fields.root = "parent.child2"

Will result in the following log event:

{
  "parent": {
    "child1": "value1",
    "child2": "value2"
  }
}

Notice that parent.child1 field was preserved.

Environment Variables

Environment variables are supported through all of Vector's configuration. Simply add ${MY_ENV_VAR} in your Vector configuration file and the variable will be replaced before being evaluated.

You can learn more in the Environment Variables section.