README.md

Move plugin

It moves fields to the target field in a certain mode.

In allow mode, the specified fields will be moved; in block mode, the unspecified fields will be moved.

Examples

pipelines:
  example_pipeline:
    ...
    actions:
    - type: move
      mode: allow
      target: other
      fields:
        - log.stream
        - zone
    ...

The original event:

{
  "service": "test",
  "log": {
    "level": "error",
    "message": "error occurred",
    "ts": "2023-10-30T13:35:33.638720813Z",
    "stream": "stderr"
  },
  "zone": "z501"
}

The resulting event:

{
  "service": "test",
  "log": {
    "level": "error",
    "message": "error occurred",
    "ts": "2023-10-30T13:35:33.638720813Z"
  },
  "other": {
    "stream": "stderr",
    "zone": "z501"
  }
}

---

pipelines:
  example_pipeline:
    ...
    actions:
    - type: move
      mode: block
      target: other
      fields:
        - log
    ...

The original event:

{
  "service": "test",
  "log": {
    "level": "error",
    "message": "error occurred",
    "ts": "2023-10-30T13:35:33.638720813Z",
    "stream": "stderr"
  },
  "zone": "z501",
  "other": {
    "user": "ivanivanov"
  }
}

The resulting event:

{
  "log": {
    "level": "error",
    "message": "error occurred",
    "ts": "2023-10-30T13:35:33.638720813Z"
  },
  "other": {
    "user": "ivanivanov",
    "service": "test",
    "zone": "z501"
  }
}

Config params

fields []cfg.FieldSelector required

The list of the fields to move.

In block mode, the maximum fields depth is 1.

mode string required

The mode of the moving. Available modes are one of: allow|block.

target cfg.FieldSelector required

The target field of the moving.

If the target field is existing non-object field, it will be overwritten as object field.

In block mode, the maximum target depth is 1.

Generated using insane-doc