This functionality is experimental and may be changed or removed completely in a
future release. Elastic will take a best effort approach to fix any issues, but
experimental features are not subject to the support SLA of official GA
features.
Add fields
editAdd fields
editThe add_fields processor adds additional fields to the event. Fields can be
scalar values, arrays, dictionaries, or any nested combination of these. By
default the fields that you specify will be grouped under the fields
sub-dictionary in the event. To group the fields under a different
sub-dictionary, use the target setting. To store the fields as
top-level fields, set target: ''.
-
target -
(Optional) Sub-dictionary to put all fields into. Defaults to
fields. -
fields - Fields to be added.
For example, this configuration:
processors:
- add_fields:
target: project
fields:
name: myproject
id: '574734885120952459'
Adds these fields to any event:
{
"project": {
"name": "myproject",
"id": "574734885120952459"
}
}