Move fields

The move_fields processor moves event fields from one object into another. It can also rearrange fields or add a prefix to fields.

The processor extracts fields from from, then uses fields and exclude as filters to choose which fields to move into the to field.

For example, given the following event:

{
  "app": {
    "method": "a",
    "elapsed_time": 100,
    "user_id": 100,
    "message": "i'm a message"
  }
}

To move method and elapsed_time into another object, use this configuration:

processors:
  - move_fields:
      from: "app"
      fields: ["method", "elapsed_time"],
      to: "rpc."

Your final event will be:

{
  "app": {
    "user_id": 100,
    "message": "i'm a message",
    "rpc": {
      "method": "a",
      "elapsed_time": 100
    }
  }
}

To add a prefix to the whole event:

{
  "app": { "method": "a"},
  "cost": 100
}

Use this configuration:

processors:
  - move_fields:
      to: "my_prefix_"

Your final event will be:

{
  "my_prefix_app": { "method": "a"},
  "my_prefix_cost": 100
}

Table 3. Move-fields options

Name	Required	Default	Description
`from`	no		Which field you want extract. This field and any nested fields will be moved into `to` unless they are filtered out. If empty, indicates event root.
`fields`	no		Which fields to extract from `from` and move to `to`. An empty list indicates all fields.
`ignore_missing`	no	false	Ignore "not found" errors when extracting fields.
`exclude`	no		A list of fields to exclude and not move.
`to`	yes		These fields extract from `from` destination field prefix the `to` will base on fields root.

processors:
  - move_fields:
      from: "app"
      fields: [ "method", "elapsed_time" ]
      to: "rpc."