Link Search Menu Expand Document Documentation Menu
Documentation

map_to_list

The map_to_list processor converts a map of key-value pairs to a list of objects. Each object contains the key and value in separate fields.

Configuration

The following table describes the configuration options for the map_to_list processor.

Option Required Type Description
source Yes String The source map used to perform the mapping operation. When set to an empty string (""), it will use the root of the event as the source.
target Yes String The target for the generated list.
key_name No String The name of the field in which to store the original key. Default is key.
value_name No String The name of the field in which to store the original value. Default is value.
exclude_keys No List The keys in the source map that will be excluded from processing. Default is an empty list ([]).
remove_processed_fields No Boolean When true, the processor will remove the processed fields from the source map. Default is false.
convert_field_to_list No Boolean If true, the processor will convert the fields from the source map into lists and place them in fields in the target list. Default is false.
map_to_list_when No String A conditional expression, such as /some-key == "test"', that will be evaluated to determine whether the processor will be run on the event. Default is null. All events will be processed unless otherwise stated.
tags_on_failure No List A list of tags to add to the event metadata when the event fails to process.

Usage

The following examples show how the map_to_list processor can be used in your pipeline.

Example: Minimum configuration

The following example shows the map_to_list processor with only the required parameters, source and target, configured:

...
  processor:
    - map_to_list:
        source: "my-map"
        target: "my-list"
...

When the input event contains the following data:

{
  "my-map": {
    "key1": "value1",
    "key2": "value2",
    "key3": "value3"
  }
}

The processed event will contain the following output:

{
  "my-list": [
    {
      "key": "key1",
      "value": "value1"
    },
    {
      "key": "key2",
      "value": "value2"
    },
    {
      "key": "key3",
      "value": "value3"
    }
  ],
  "my-map": {
    "key1": "value1",
    "key2": "value2",
    "key3": "value3"
  }
}

Example: Custom key name and value name

The following example shows how to configure a custom key name and value name:

...
  processor:
    - map_to_list:
        source: "my-map"
        target: "my-list"
        key_name: "name"
        value_name: "data"
...

When the input event contains the following data:

{
  "my-map": {
    "key1": "value1",
    "key2": "value2",
    "key3": "value3"
  }
}

The processed event will contain the following output:

{
  "my-list": [
    {
      "name": "key1",
      "data": "value1"
    },
    {
      "name": "key2",
      "data": "value2"
    },
    {
      "name": "key3",
      "data": "value3"
    }
  ],
  "my-map": {
    "key1": "value1",
    "key2": "value2",
    "key3": "value3"
  }
}

Example: Exclude specific keys from processing and remove any processed fields

The following example shows how to exclude specific keys and remove any processed fields from the output:

...
  processor:
    - map_to_list:
        source: "my-map"
        target: "my-list"
        exclude_keys: ["key1"]
        remove_processed_fields: true
...

When the input event contains the following data:

{
  "my-map": {
    "key1": "value1",
    "key2": "value2",
    "key3": "value3"
  }
}

The processed event will remove the “key2” and “key3” fields, but the “my-map” object, “key1”, will remain, as shown in the following output:

{
  "my-list": [
    {
      "key": "key2",
      "value": "value2"
    },
    {
      "key": "key3",
      "value": "value3"
    }
  ],
  "my-map": {
    "key1": "value1"
  }
}

Example: Use convert_field_to_list

The following example shows how to use the convert_field_to_list option in the processor:

...
  processor:
    - map_to_list:
        source: "my-map"
        target: "my-list"
        convert_field_to_list: true
...

When the input event contains the following data:

{
  "my-map": {
    "key1": "value1",
    "key2": "value2",
    "key3": "value3"
  }
}

The processed event will convert all fields into lists, as shown in the following output:

{
  "my-list": [
    ["key1", "value1"],
    ["key2", "value2"],
    ["key3", "value3"]
  ],
  "my-map": {
    "key1": "value1",
    "key2": "value2",
    "key3": "value3"
  }
}

Example: Use the event root as the source

The following example shows how you can use an event’s root as the source by setting the source setting to an empty string (""):

...
  processor:
    - map_to_list:
        source: ""
        target: "my-list"
...

When the input event contains the following data:

{
  "key1": "value1",
  "key2": "value2",
  "key3": "value3"
}

The processed event will contain the following output:

{
  "my-list": [
    {
      "key": "key1",
      "value": "value1"
    },
    {
      "key": "key2",
      "value": "value2"
    },
    {
      "key": "key3",
      "value": "value3"
    }
  ],
  "key1": "value1",
  "key2": "value2",
  "key3": "value3"
}
350 characters left

Have a question? .

Want to contribute? or .