This functionality is experimental and may be changed or removed completely in a
future release. Elastic will take a best effort approach to fix any issues, but
experimental features are not subject to the support SLA of official GA
features.
Copy fields
edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.
Copy fields
editThe copy_fields processor copies a field to another one.
-
fields -
List of
fromandtopairs to copy from and to. -
fail_on_error -
(Optional) If set to true, in case of an error the changes to
the event are reverted, and the original event is returned. If set to
false, processing continues also if an error happens. Default istrue. -
ignore_missing -
(Optional) Whether to ignore events that lack the source
field. The default is
false, which will fail processing of an event if a field is missing.
For example, this configuration:
processors:
- copy_fields:
fields:
- from: message
to: event.original
fail_on_error: false
ignore_missing: true
Copies the original message field to event.original:
{
"message": "my-interesting-message",
"event": {
"original": "my-interesting-message"
}
}