Copy fields
edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.
Copy fields
editThe copy_fields processor takes the value of a field and copies it to a new
field.
You cannot use this processor to replace an existing field. If the target
field already exists, you must drop or rename
the field before using copy_fields.
-
fields -
List of
fromandtopairs to copy from and to. It’s supported to use@metadata.prefix forfromandtoand copy values not just in/from/to the event fields but also in/from/to the event metadata. -
fail_on_error -
(Optional) If set to
trueand an error occurs, the changes are reverted and the original is returned. If set tofalse, processing continues if an error occurs. Default istrue. -
ignore_missing -
(Optional) Indicates whether to ignore events that lack the source
field. The default is
false, which will fail processing of an event if a field is missing.
For example, this configuration:
processors:
- copy_fields:
fields:
- from: message
to: event.original
fail_on_error: false
ignore_missing: true
Copies the original message field to event.original:
{
"message": "my-interesting-message",
"event": {
"original": "my-interesting-message"
}
}