From 9606e2b4c7e536a7c25d176b19df1bee597cfade Mon Sep 17 00:00:00 2001 From: Haakon Gjersvik Eriksen Date: Wed, 13 Dec 2017 11:39:52 +0100 Subject: [PATCH] Add documentation and example for nested tags Finding out how to access nested tags was a real struggle, so I would like to include it in the documentation. --- filter_plugins/filter_record_transformer.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/filter_plugins/filter_record_transformer.md b/filter_plugins/filter_record_transformer.md index 5423fad..c129ccf 100644 --- a/filter_plugins/filter_record_transformer.md +++ b/filter_plugins/filter_record_transformer.md @@ -78,6 +78,18 @@ For NEW_VALUE, a special syntax `${}` allows the user to generate a new field dy - `tag_suffix[N]` refers to the last N parts of the tag. It works like the usual zero-based array accessor. - `tag` refers to the whole tag. +For accessing nested tags, you need to set the `enable_ruby` directive, and then the sub-tags are available by specifying tags after each other. For example, if you use the kubernetes metadata plugin, you can get the app name like this: + + + + type record_transformer + ruby_enable + + app_name ${record["kubernetes"]["labels"]["app"]} + + + + ### enable_ruby (optional) When set to true, the full Ruby syntax is enabled in the `${...}` expression. The default value is false. @@ -97,4 +109,4 @@ A comma-delimited list of keys to delete. ## Learn More - [Filter Plugin Overview](filter-plugin-overview) -- [grep Filter Plugin](filter_grep) \ No newline at end of file +- [grep Filter Plugin](filter_grep)