Move fields

The move_fields processor moves event fields from one object into another. It can also rearrange fields or add a prefix to fields.

The processor extracts fields from from, then uses fields and exclude as filters to choose which fields to move into the to field.

For example, given the following event:

{
  "app": {
    "method": "a",
    "elapsed_time": 100,
    "user_id": 100,
    "message": "i'm a message"
  }
}
		

To move method and elapsed_time into another object, use this configuration:

processors:
  - move_fields:
      from: "app"
      fields: ["method", "elapsed_time"],
      to: "rpc."
		

Your final event will be:

{
  "app": {
    "user_id": 100,
    "message": "i'm a message",
    "rpc": {
      "method": "a",
      "elapsed_time": 100
    }
  }
}
		

To add a prefix to the whole event:

{
  "app": { "method": "a"},
  "cost": 100
}
		

Use this configuration:

processors:
  - move_fields:
      to: "my_prefix_"
		

Your final event will be:

{
  "my_prefix_app": { "method": "a"},
  "my_prefix_cost": 100
}