Copy fields
editCopy fields
editThe copy_fields
processor takes the value of a field and copies it to a new
field.
You cannot use this processor to replace an existing field. If the target
field already exists, you must drop or rename
the field before using copy_fields
.
-
fields
-
List of
from
andto
pairs to copy from and to. It’s supported to use@metadata.
prefix forfrom
andto
and copy values not just in/from/to the event fields but also in/from/to the event metadata. -
fail_on_error
-
(Optional) If set to
true
and an error occurs, the changes are reverted and the original is returned. If set tofalse
, processing continues if an error occurs. Default istrue
. -
ignore_missing
-
(Optional) Indicates whether to ignore events that lack the source
field. The default is
false
, which will fail processing of an event if a field is missing.
For example, this configuration:
processors: - copy_fields: fields: - from: message to: event.original fail_on_error: false ignore_missing: true
Copies the original message
field to event.original
:
{ "message": "my-interesting-message", "event": { "original": "my-interesting-message" } }