Rename Fields Transform

The Vector rename_fields transform shapes logs

Configuration

• Common
• Advanced

• vector.toml
• vector.yaml
• vector.json

[transforms.my_transform_id]
  # General
  type = "rename_fields" # required
  inputs = ["my-source-or-transform-id"] # required

  # Fields
  fields.old_field_name = "new_field_name" # example
  fields.parent.old_child_name = "parent.new_child_name" # example

• optionalbool

  drop_empty

  If set to true, after renaming fields, remove any parent objects of the old field that are now empty.

  • Default: false
  • View examples
• commonrequiredtable

  fields

  A table of old-key/new-key pairs representing the keys to be moved in the event.

Output

Telemetry

This component provides the following metrics that can be retrieved through the internal_metrics source. See the metrics section in the monitoring page for more info.

• counter

  processed_events_total

  The total number of events processed by this component. This metric includes the following tags:

  • component_kind - The Vector component kind.

  • component_name - The Vector component ID.

  • component_type - The Vector component type.

  • file - The file that produced the error

  • instance - The Vector instance identified by host and port.

  • job - The name of the job producing Vector metrics.

• counter

  processed_bytes_total

  The total number of bytes processed by the component. This metric includes the following tags:

  • component_kind - The Vector component kind.

  • component_name - The Vector component ID.

  • component_type - The Vector component type.

  • instance - The Vector instance identified by host and port.

  • job - The name of the job producing Vector metrics.

How It Works

Conflicts

Key Conflicts

Keys specified in this transform will replace existing keys.

Vector makes no guarantee on the order of execution. If two rename operations must be performed in a specific order, it is recommended to split them up across two separate rename transforms.

Nested Key Conflicts

Keys are renamed in a deep fashion. They will not replace any ancestor objects. For example, given the following log event:

{
  "root": "value2",
  "parent": {
    "child1": "value1"
  }
}

And the following configuration:

[transforms.rename_nested_field]
  type = "rename_fields"
  fields.root = "parent.child2"

Will result in the following log event:

{
  "parent": {
    "child1": "value1",
    "child2": "value2"
  }
}

Notice that parent.child1 field was preserved.