This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.

« Add Docker metadata Add Host metadata »

› › ›

Add fields

edit

Add fields

edit

The add_fields processor adds additional fields to the event. Fields can be scalar values, arrays, dictionaries, or any nested combination of these. The add_fields processor will overwrite the target field if it already exists. By default the fields that you specify will be grouped under the fields sub-dictionary in the event. To group the fields under a different sub-dictionary, use the target setting. To store the fields as top-level fields, set target: ''.

target: (Optional) Sub-dictionary to put all fields into. Defaults to fields. Setting this to @metadata will add values to the event metadata instead of fields.
fields: Fields to be added.

For example, this configuration:

processors:
  - add_fields:
      target: project
      fields:
        name: myproject
        id: '574734885120952459'

Adds these fields to any event:

{
  "project": {
    "name": "myproject",
    "id": "574734885120952459"
  }
}

This configuration will alter the event metadata:

processors:
  - add_fields:
      target: '@metadata'
      fields:
        op_type: "index"

When the event is ingested (e.g. by Elastisearch) the document will have op_type: "index" set as a metadata field.

« Add Docker metadata Add Host metadata »