IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Convert Decode Base64 fields »
Elastic Docs ›Auditbeat Reference [7.10] ›Configure Auditbeat ›Filter and enhance data with processors

Copy fields

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Copy fields

edit

The copy_fields processor copies a field to another one.

fields
List of from and to pairs to copy from and to.
fail_on_error
(Optional) If set to true, in case of an error the changes to the event are reverted, and the original event is returned. If set to false, processing continues also if an error happens. Default is true.
ignore_missing
(Optional) Whether to ignore events that lack the source field. The default is false, which will fail processing of an event if a field is missing.

For example, this configuration:

processors:
  - copy_fields:
      fields:
        - from: message
          to: event.original
      fail_on_error: false
      ignore_missing: true

Copies the original message field to event.original:

{
  "message": "my-interesting-message",
  "event": {
      "original": "my-interesting-message"
  }
}
« Convert Decode Base64 fields »