Add fields

The add_fields processor adds additional fields to the event. Fields can be scalar values, arrays, dictionaries, or any nested combination of these. The add_fields processor will overwrite the target field if it already exists. By default the fields that you specify will be grouped under the fields sub-dictionary in the event. To group the fields under a different sub-dictionary, use the target setting. To store the fields as top-level fields, set target: ''.

target

(Optional) Sub-dictionary to put all fields into. Defaults to fields. Setting this to @metadata will add values to the event metadata instead of fields.

fields

Fields to be added.

For example, this configuration:

processors:
  - add_fields:
      target: project
      fields:
        name: myproject
        id: '574734885120952459'

Adds these fields to any event:

{
  "project": {
    "name": "myproject",
    "id": "574734885120952459"
  }
}

This configuration will alter the event metadata:

processors:
  - add_fields:
      target: '@metadata'
      fields:
        op_type: "index"

When the event is ingested (e.g. by Elastisearch) the document will have op_type: "index" set as a metadata field.