Functionbeat will reach End of Support on October 18, 2023. You should consider
moving your deployments to the more versatile and efficient Elastic Serverless
Forwarder.
Add fields
editAdd fields
editThe add_fields
processor adds additional fields to the event. Fields can be
scalar values, arrays, dictionaries, or any nested combination of these.
The add_fields
processor will overwrite the target field if it already exists.
By default the fields that you specify will be grouped under the fields
sub-dictionary in the event. To group the fields under a different
sub-dictionary, use the target
setting. To store the fields as
top-level fields, set target: ''
.
-
target
-
(Optional) Sub-dictionary to put all fields into. Defaults to
fields
. Setting this to@metadata
will add values to the event metadata instead of fields. -
fields
- Fields to be added.
For example, this configuration:
processors: - add_fields: target: project fields: name: myproject id: '574734885120952459'
Adds these fields to any event:
{ "project": { "name": "myproject", "id": "574734885120952459" } }
This configuration will alter the event metadata:
processors: - add_fields: target: '@metadata' fields: op_type: "index"
When the event is ingested (e.g. by Elastisearch) the document will have op_type: "index"
set as a metadata field.