Copy fields

Stack

The copy_fields processor takes the value of a field and copies it to a new field.

You cannot use this processor to replace an existing field. If the target field already exists, you must drop or rename the field before using copy_fields.

fields

List of from and to pairs to copy from and to. It’s supported to use @metadata. prefix for from and to and copy values not just in/from/to the event fields but also in/from/to the event metadata.

fail_on_error

(Optional) If set to true and an error occurs, the changes are reverted and the original is returned. If set to false, processing continues if an error occurs. Default is true.

ignore_missing

(Optional) Indicates whether to ignore events that lack the source field. The default is false, which will fail processing of an event if a field is missing.

For example, this configuration:

processors:
  - copy_fields:
      fields:
        - from: message
          to: event.original
      fail_on_error: false
      ignore_missing: true
		

Copies the original message field to event.original:

{
  "message": "my-interesting-message",
  "event": {
      "original": "my-interesting-message"
  }
}