Link Search Menu Expand Document Documentation Menu

add_entries

The add_entries processor adds entries to an event.

Configuration

You can configure the add_entries processor with the following options.

Option Required Description
entries Yes A list of entries to add to an event.
key No The key of the new entry to be added. Some examples of keys include my_key, myKey, and object/sub_Key. The key can also be a format expression, for example, ${/key1} to use the value of field key1 as the key.
metadata_key No The key for the new metadata attribute. The argument must be a literal string key and not a JSON Pointer. Either one string key or metadata_key is required.
value No The value of the new entry to be added, which can be used with any of the following data types: strings, Booleans, numbers, null, nested objects, and arrays.
format No A format string to use as the value of the new entry, for example, ${key1}-${key2}, where key1 and key2 are existing keys in the event. Required if neither value nor value_expression is specified.
value_expression No An expression string to use as the value of the new entry. For example, /key is an existing key in the event with a type of either a number, a string, or a Boolean. Expressions can also contain functions returning number/string/integer. For example, length(/key) will return the length of the key in the event when the key is a string. For more information about keys, see Expression syntax.
add_when No A conditional expression, such as /some-key == "test"', that will be evaluated to determine whether the processor will be run on the event.
overwrite_if_key_exists No When set to true, the existing value is overwritten if key already exists in the event. The default value is false.
append_if_key_exists No When set to true, the existing value will be appended if a key already exists in the event. An array will be created if the existing value is not an array. Default is false.

Usage

The following examples show how the add_entries processor can be used in different cases.

Example: Add entries with simple values

The following example shows you how to configure the processor to add entries with simple values:

... 
  processor:
    - add_entries:
        entries:
          - key: "name"
            value: "John"
          - key: "age"
            value: 20
...

When the input event contains the following data:

{"message": "hello"}

The processed event will contain the following data:

{"message": "hello", "name": "John", "age": 20}

Example: Add entries using format strings

The following example shows you how to configure the processor to add entries with values from other fields:

... 
  processor:
    - add_entries:
        entries:
          - key: "date"
            format: "${month}-${day}"
...

When the input event contains the following data:

{"month": "Dec", "day": 1}

The processed event will contain the following data:

{"month": "Dec", "day": 1, "date": "Dec-1"}

Example: Add entries using value expressions

The following example shows you how to configure the processor to use the value_expression option:

... 
  processor:
    - add_entries:
        entries:
          - key: "length"
            value_expression: "length(/message)"
...

When the input event contains the following data:

{"message": "hello"}

The processed event will contain the following data:

{"message": "hello", "length": 5}

Example: Add metadata

The following example shows you how to configure the processor to add metadata to events:

... 
  processor:
    - add_entries:
        entries:
          - metadata_key: "length"
            value_expression: "length(/message)"
...

When the input event contains the following data:

{"message": "hello"}

The processed event will have the same data, with the metadata, {"length": 5}, attached. You can subsequently use expressions like getMetadata("length") in the pipeline. For more information, see getMetadata function.

Example: Add a dynamic key

The following example shows you how to configure the processor to add metadata to events using a dynamic key:

... 
  processor:
    - add_entries:
        entries:
          - key: "${/param_name}"
            value_expression: "/param_value"
...

When the input event contains the following data:

{"param_name": "cpu", "param_value": 50}

The processed event will contain the following data:

{"param_name": "cpu", "param_value": 50, "cpu": 50}

Example: Overwrite existing entries

The following example shows you how to configure the processor to overwrite existing entries:

... 
  processor:
    - add_entries:
        entries:
          - key: "message"
            value: "bye"
            overwrite_if_key_exists: true
...

When the input event contains the following data:

{"message": "hello"}

The processed event will contain the following data:

{"message": "bye"}

If overwrite_if_key_exists is not set to true, then the input event will not be changed after processing.

Example: Append values to existing entries

The following example shows you how to configure the processor to append values to existing entries:

... 
  processor:
    - add_entries:
        entries:
          - key: "message"
            value: "world"
            append_if_key_exists: true
...

When the input event contains the following data:

{"message": "hello"}

The processed event will contain the following data:

{"message": ["hello", "world"]}