This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.

« Convert field type Decode Base64 fields »

› ›

Copy fields

edit

Copy fields

edit

The copy_fields processor takes the value of a field and copies it to a new field.

You cannot use this processor to replace an existing field. If the target field already exists, you must drop or rename the field before using copy_fields.

Example

edit

This configuration:

  - copy_fields:
      fields:
        - from: message
          to: event.original
      fail_on_error: false
      ignore_missing: true

Copies the original message field to event.original:

{
  "message": "my-interesting-message",
  "event": {
      "original": "my-interesting-message"
  }
}

Configuration settings

edit

Elastic Agent processors execute before ingest pipelines, which means that your processor configurations cannot refer to fields that are created by ingest pipelines or Logstash. For more limitations, refer to What are some limitations of using processors?

Name	Required	Default	Description
`fields`	Yes		List of `from` and `to` pairs to copy from and to. You can use the `@metadata.` prefix to copy values from or to event metadata.
`fail_on_error`	No	`true`	Whether to fail if an error occurs. If `true` and an error occurs, any changes are reverted, and the original is returned. If `false`, processing continues even if an error occurs.
`ignore_missing`	No	`false`	Whether to ignore events that lack the source field. If `false`, the processing of an event will fail if a field is missing.

« Convert field type Decode Base64 fields »