Rename Fields Transform

The Vector rename_fields transform shapes logs

Configuration

[transforms.my_transform_id]
# General
type = "rename_fields" # required
inputs = ["my-source-or-transform-id"] # required
# Fields
fields.old_field_name = "new_field_name" # example
fields.parent.old_child_name = "parent.new_child_name" # example
  • optionalbool

    drop_empty

    If set to true, after renaming fields, remove any parent objects of the old field that are now empty.

    • Default: false
    • View examples
  • commonrequiredtable

    fields

    A table of old-key/new-key pairs representing the keys to be moved in the event.

Output

Telemetry

This component provides the following metrics that can be retrieved through the internal_metrics source. See the metrics section in the monitoring page for more info.

  • counter

    processed_events_total

    The total number of events processed by this component. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • file - The file that produced the error

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

  • counter

    processed_bytes_total

    The total number of bytes processed by the component. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

How It Works

Conflicts

Key Conflicts

Keys specified in this transform will replace existing keys.

Nested Key Conflicts

Keys are renamed in a deep fashion. They will not replace any ancestor objects. For example, given the following log event:

{
"root": "value2",
"parent": {
"child1": "value1"
}
}

And the following configuration:

[transforms.rename_nested_field]
type = "rename_fields"
fields.root = "parent.child2"

Will result in the following log event:

{
"parent": {
"child1": "value1",
"child2": "value2"
}
}

Notice that parent.child1 field was preserved.