diff --git a/libbeat/docs/processors-list.asciidoc b/libbeat/docs/processors-list.asciidoc index 9be8a28fa987..54c77eb285e5 100644 --- a/libbeat/docs/processors-list.asciidoc +++ b/libbeat/docs/processors-list.asciidoc @@ -38,6 +38,9 @@ endif::[] ifndef::no_convert_processor[] * <> endif::[] +ifndef::no_copy_fields_processor[] +* <> +endif::[] ifndef::no_decode_base64_field_processor[] * <> endif::[] @@ -86,6 +89,9 @@ endif::[] ifndef::no_timestamp_processor[] * <> endif::[] +ifndef::no_truncate_fields_processor[] +* <> +endif::[] //# end::processors-list[] //# tag::processors-include[] diff --git a/libbeat/processors/actions/docs/copy_fields.asciidoc b/libbeat/processors/actions/docs/copy_fields.asciidoc new file mode 100644 index 000000000000..da41eb9ee559 --- /dev/null +++ b/libbeat/processors/actions/docs/copy_fields.asciidoc @@ -0,0 +1,38 @@ +[[copy-fields]] +=== Copy fields + +The `copy_fields` processor copies a field to another one. + +`fields`:: List of `from` and `to` pairs to copy from and to. +`fail_on_error`:: (Optional) If set to true, in case of an error the changes to +the event are reverted, and the original event is returned. If set to `false`, +processing continues also if an error happens. Default is `true`. +`ignore_missing`:: (Optional) Whether to ignore events which lack the source + field. The default is `false`, which will fail processing of + an event if a field is missing. + +For example, this configuration: + +[source,yaml] +------------------------------------------------------------------------------ +processors: +- copy_fields: + fields: + - from: message + to: event.original + fail_on_error: false + ignore_missing: true +------------------------------------------------------------------------------ + +Copies the original `message` field to `event.original`: + +[source,json] +------------------------------------------------------------------------------- +{ + "message": "my-interesting-message", + "event": { + "original": "my-interesting-message" + } +} +------------------------------------------------------------------------------- + diff --git a/libbeat/processors/actions/docs/truncate_fields.asciidoc b/libbeat/processors/actions/docs/truncate_fields.asciidoc new file mode 100644 index 000000000000..d6716c5dc380 --- /dev/null +++ b/libbeat/processors/actions/docs/truncate_fields.asciidoc @@ -0,0 +1,29 @@ +[[truncate-fields]] +=== Truncate fields + +The `truncate_fields` truncates a field to a given size if bigger. If the size of the field is smaller than +the limit, the field is left as is. + +`fields`:: List of `from` and `to` pairs to copy from and to. +`max_bytes`:: Maximum number of bytes in a field. Mutually exclusive with `max_characters`. +`max_characters`:: Maximum number of characters in a field. Mutually exclusive with `max_bytes`. +`fail_on_error`:: (Optional) If set to true, in case of an error the changes to +the event are reverted, and the original event is returned. If set to `false`, +processing continues also if an error happens. Default is `true`. +`ignore_missing`:: (Optional) Whether to ignore events which lack the source + field. The default is `false`, which will fail processing of + an event if a field is missing. + +For example, this configuration truncates the field named `message` to 5 characters: + +[source,yaml] +------------------------------------------------------------------------------ +processors: +- truncate_fields: + fields: + - message + max_characters: 5 + fail_on_error: false + ignore_missing: true +------------------------------------------------------------------------------ +