Rename Fields Transform

The Vector rename_fields transform accepts and outputs log events allowing you to rename one or more log fields.

Configuration

vector.toml
[transforms.my_transform_id]
# General
type = "rename_fields" # required
inputs = ["my-source-id"] # required
# Fields
fields.old_field_name = "new_field_name" # example
fields.parent.old_child_name = "parent.new_child_name" # example
2 items
booloptional

drop_empty

If set to true, after renaming fields, remove any parent objects of the old field that are now empty.

No default
View examples
tablecommonrequired

fields

A table of old-key/new-key pairs representing the keys to be moved in the event.

*commonrequired

[field-name]

Old-key/New-key pair reprsenting the key to be moved.

No default
View examples

Output

The rename_fields transform accepts and outputs log events allowing you to rename one or more log fields. For example:

Given the following log event:

{
// ...
"old_field": "root_value",
"old_nested": {
"nested": "nested_value"
}
// ...
}

And a Vector configuration like:

vector.toml
[transforms.my_transform]
type = "rename_fields"
inputs = [...]
fields.old_field = "new_field"
fields.old_nested.nested = "new_nested.nested",

Will result in the following log event:

{
// ...
"new_field": "root_value",
"new_nested": {
"nested": "nested_value"
}
// ...
}

How It Works

Complex Processing

If you encounter limitations with the rename_fields transform then we recommend using a runtime transform. These transforms are designed for complex processing and give you the power of full programming runtime.

Conflicts

Key Conflicts

Keys specified in this transform will replace existing keys.

Nested Key Conflicts

Keys are renamed in a deep fashion. They will not replace any ancestor objects. For example, given the following log event:

{
"root": "value2",
"parent": {
"child1": "value1"
}
}

And the following configuration:

[transforms.rename_nested_field]
type = "rename_fields"
fields.root = "parent.child2"

Will result in the following log event:

{
"parent": {
"child1": "value1",
"child2": "value2"
}
}

Notice that parent.child1 field was preserved.

Environment Variables

Environment variables are supported through all of Vector's configuration. Simply add ${MY_ENV_VAR} in your Vector configuration file and the variable will be replaced before being evaluated.

You can learn more in the Environment Variables section.