processor-add_fields.asciidoc

Add fields

add_fields

The add_fields processor adds fields to the event. Fields can be scalar values, arrays, dictionaries, or any nested combination of these. The add_fields processor overwrites the target field if it already exists. By default, the fields that you specify are grouped under the fields sub-dictionary in the event. To group the fields under a different sub-dictionary, use the target setting. To store the fields as top-level fields, set target: ''.

Examples

This configuration:

  - add_fields:
      target: project
      fields:
        name: myproject
        id: '574734885120952459'

Adds these fields to any event:

{
  "project": {
    "name": "myproject",
    "id": "574734885120952459"
  }
}

This configuration alters the event metadata:

  - add_fields:
      target: '@metadata'
      fields:
        op_type: "index"

When the event is ingested by {es}, the document will have op_type: "index" set as a metadata field.

Configuration settings

processors.asciidoc

Name	Required	Default	Description
target	No	fields	Sub-dictionary to put all fields into. Set target to @metadata to add values to the event metadata instead of fields.
fields	Yes		Fields to be added.