Functionbeat will reach End of Support on October 18, 2023. You should consider moving your deployments to the more versatile and efficient Elastic Serverless Forwarder.

› › ›

Copy fields

edit

Copy fields

edit

The copy_fields processor takes the value of a field and copies it to a new field.

You cannot use this processor to replace an existing field. If the target field already exists, you must drop or rename the field before using copy_fields.

fields: List of from and to pairs to copy from and to. It’s supported to use @metadata. prefix for from and to and copy values not just in/from/to the event fields but also in/from/to the event metadata.
fail_on_error: (Optional) If set to true and an error occurs, the changes are reverted and the original is returned. If set to false, processing continues if an error occurs. Default is true.
ignore_missing: (Optional) Indicates whether to ignore events that lack the source field. The default is false, which will fail processing of an event if a field is missing.

For example, this configuration:

processors:
  - copy_fields:
      fields:
        - from: message
          to: event.original
      fail_on_error: false
      ignore_missing: true

Copies the original message field to event.original:

{
  "message": "my-interesting-message",
  "event": {
      "original": "my-interesting-message"
  }
}

« Convert Decode Base64 fields »