add

Add new fields to an event

Example

input:

{"one":1}

action:

add:
  output-fields:
    - two: 2
    - three: 3

output:

{"one":1,"two":2.0,"three":3.0}
Field NameDescriptionTypeDefault
overwriteforce values in already-existing fields to be replacedboolfalse
template-result-fieldA way of creating arbitrary documents for passing to outputfield-

add output-fields

Fields where values are stored

Type: array of (field,value) pairs

Example: Plain values

input:

{}

action:

add:
  output-fields:
    - one: 1
    - two: 2
    - three: 3

output:

{"one":1.0,"two":2.0,"three":3.0}

Example: Complex values

input:

{}

action:

add:
  output-fields:
    - one: 1
    - two: 2
    - three-four: [3,4]
    - five-six:
        five: 5
        six: 6

output:

{"one":1.0,"two":2.0,"three-four":[3.0,4.0],"five-six":{"five":5.0,"six":6.0}}

Example: Field expansions

input:

{"one":1,"two":2}

action:

add:
  output-fields:
    - another-one: ${one}
    - another-two: yet another ${two}

output:

{"one":1,"two":2,"another-one":"1","another-two":"yet another 2"}

Example: Field expansions, with nested fields

input:

{"one-two":[1,2],"three-four":{"three":3,"four":4.0}}

action:

add:
  output-fields:
    - one: ${one-two.0}
    - two: ${one-two.1}
    - three: ${three-four.three}
    - four: ${three-four.four}

output:

{"one-two":[1,2],"three-four":{"three":3,"four":4.0},"one":"1","two":"2","three":"3","four":"4.0"}

Example: Field names can contain field references

input:

{"one":1}

action:

add:
  output-fields:
    - another-${one}: ${one}

output:

{"one":1,"another-1":"1"}

add template

Template substitution, for more complex output

The template must result in a valid JSON document, which will be merged with the input event

Type: expanded-text

Example

input:

{"one":1}

action:

add:
  template: |
    {
      "another-one": ${one},
      "tags": ["yoyo",${one}]
    }
output: '{"one":1,"another-one":1,"tags":["yoyo",1]}'

add template-file

Template substitution from provided file, for more complex output

Like template, except using a file. Easier to edit well-formed JSON templates

Type: expanded-text

Example

file: some-file

{
  "another-one": ${one},
  "tags": ["yoyo",${one}]
}

input:

{"one":1}

action:

add:
  template-file: some-file

output:

{"one":1,"another-one":1,"tags":["yoyo",1]}

overwrite

force values in already-existing fields to be replaced

Type: bool

Example

input:

{"one":1}

action:

add:
  overwrite: true
  output-fields:
  - one: 0
  - two: 1

output:

{"one":0,"two":1.0}

template-result-field

A way of creating arbitrary documents for passing to output

Only applies to template or template-file. The template does not have to be valid JSON. (In this example, it is YAML)

Type: field

Example

input:

{"one":1,"two":2}

action:

add:
  template-result-field: results
  template: |
      results:
          one: ${one}
          two: ${two}

output:

{"one":1,"two":2,"results":"results:\n    one: 1\n    two: 2\n"}