Skip to content

Latest commit

 

History

History

addfield

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
README.md
README.md
 
 
filteraddfield.go
filteraddfield.go
 
 
filteraddfield_test.go
filteraddfield_test.go
 
 

README.md

#gogstash add_field

Synopsis

filter:
  - type: add_field
    # (required) field to set
    key: field_to_set
    # (required) value
    value: value
    # (optional) set to true if existing field should be overwritten, default is false
    overwrite: true

This filter allows you to manually set a field to a value. There are a few points to have in mind:

  1. The field "message" will always be overwritten if you set that as the key.
  2. Other fields, if they exist, will not be overwritten unless you set overwrite: true.
  3. Value is formatted, meaning that
    1. a value of %{VALUE} will be replaced with the contents of VALUE if it exist. VALUE should then be another field defined from another filter or codec.
    2. %{+2006-01-02} will be replaced with the current time.
    3. %{+@2006-01-02} will be replaced with the event time.