-
Notifications
You must be signed in to change notification settings - Fork 24
Add Field Processor
Ral G edited this page Jan 23, 2022
·
10 revisions
Using this processor you can add a field to the document, this field can have data from other fields using the Template feature - in this case check that the fields exists first. It can also be used to "replace" a field value or just as a new field with a static value.
- path (the path to the field to add, doted fqdn) (required)
- value (required)
{
"steps": [
{
"addField": {
"config": {
"path": "field",
"value": "value"
}
}
}
]
}
{
"steps": [
{
"if": {
"condition": {
"and": [
{
"exists": {
"field": "Date"
}
},
{
"exists": {
"field": "time"
}
}
]
},
"then": [
{
"addField": {
"config": {
"path": "timestamp",
"value": "{{Date}} {{time}}"
}
}
}
]
}
}
]
}
- Home
-
Pipelines
-
Processors
- Add Field Processor
- Add Tag Processor
- AhoCorasick Processor
- Anonymize Processor
- Append List Processor
- Arrays Intersect Processor
- Base64 Decode Processor
- Convert Processor
- CSV Processor
- Date Processor
- Drop Processor
- External Mapping Source Processor
- GeoIP Processor
- Grok Processor
- JSON Processor
- Key Value Processor
- LowerCase Processor
- Math Processor
- Remove Field Processor
- Remove Tag Processor
- Rename Field Processor
- Split Processor
- Strip Processor
- Substitue Processor
- Substring Processor
- Translate Processor
- UpperCase Processor
- User Agent Processor
- URL Decode Processor
- XML Processor
- DeDot Processor
- Doc Size Processor
- If statement
- Additional Commands
-
Processors