transform output square brackets

[RFskynet]

Hi. Please tell me, can I wrap the output-transform in square brackets? This is the format my application requires.
Example:
invalid
{
"json": "json 1"
}

That's right, that's the only way
[{
"json": "json 1"
}]
Thanks!

[pront]

You can use a remap like so. BTW wrapping the top level output in an array [{/* ... */}] has different semantics vs {}.

[RFskynet]

Thank you. But for some reason it doesn't work in my case. Returns the same thing.

1. Example:
   . = [.] not work
   before
   { "message": "Hello VRL", "foo": "delete me", "http_status": "200" }
   after
   { "message": "Hello VRL", "foo": "delete me", "http_status": "200" }

If .test = [.] it works like this
{"test": [
{
"foo": "delete me",
"http_status": "200",
"message": "Hello VRL"
}
]
}

2. could you give me more information about this

BTW wrapping the top level output in an array [{/* ... */}] has different semantics vs {}

[pront]

1. Can you share a VRL playground link?
2. See mapping one log into multiple

[RFskynet]

1. аналогично вашему example

My config:

[sources.files]
type = "file"
include = [ "/etc/vector/log1.log" ]

[transforms.vector-transform]
inputs = ["files"]
type = "remap"
source = """
. = [.]
"""
[sinks.file_output]
type = "file"
inputs = ["vector-transform"]
path = "/etc/vector/log2.log"
encoding.codec = "text"

Input log1.log -> {"annotations":{"summary":"test"}}
Output log2.log without square brackets -> {"annotations":{"summary":"test"}}

[jszwedko]

Correct, if an array is emitted by a remap transform than each element is then emitted as a separate event per mapping one log into multiple.

I think here you may want to actually do the encoding in remap to avoid this. Something like:

[sources.files]
type = "file"
include = [ "/etc/vector/log1.log" ]

[transforms.vector-transform]
inputs = ["files"]
type = "remap"
source = """
. = {"message": encode_json([.])}
"""
[sinks.file_output]
type = "file"
inputs = ["vector-transform"]
path = "/etc/vector/log2.log"
encoding.codec = "text"

Using the text codec should result in only the message field being output.