Move

Transform

Synopsis

Moves fields from one location to another within the document structure.

Schema

- move:
    target_field: <ident>
    fields: <string[]>
    exclude: <string[]>
    with_prefix: <string>
    with_suffix: <string>
    index_name: <string>
    move_to_root: <boolean>
    override: <boolean>
    ignore_missing: <boolean>
    description: <text>
    if: <script>
    ignore_failure: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
target_field	Y	-	Destination field for moved fields
fields	N	["*"]	List of patterns to match fields for moving
exclude	N	-	List of patterns to exclude from moving
with_prefix	N	-	String prepended to each moved field's name
with_suffix	N	-	String appended to each moved field's name
index_name	N	-	Name of the sort index to keep in step when fields are renamed. See below
move_to_root	N	false	Move matched fields to document root
override	N	false	Allow overwriting existing target fields
ignore_missing	N	false	Continue silently if source fields don't exist
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	See Handling Failures
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier
disabled	N	false	When true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration

Details

Renaming while moving

with_prefix and with_suffix wrap each moved field's name: the new name is with_prefix + name + with_suffix. Both are applied to every field the patterns match, so one processor can move a group and re-label it in a single step rather than moving and then renaming.

index_name names a sort index maintained under _vmetric.sort_index.<index_name>. When set, the index entries are rewritten to follow the renamed fields, so an ordering established earlier survives the move. Leave it unset when no sort index is involved.

The processor supports moving nested fields, pattern matching, and exclusions. It can move fields to a specific target field or to the root level of the document.

The processor is particularly useful for modifying and tidying document hierarchies, flattening nested objects, and isolating specific fields.

Fields are removed from their original location after moving. When move_to_root is set to true, target_field is ignored.

note

Pattern matching uses filepath.Match syntax, e.g. * for any characters, so patterns ending with .* handle immediate children differently.

warning

Moving fields to root level can overwrite existing fields. Be careful with pattern matching to avoid unintended moves.

Also, when moving nested structures, field conflicts can occur. Consider using exclude patterns to protect critical fields.

Examples

Basic

Moving fields to a target location...	{ "event": { "category": "authentication", "type": "start" }, "other_field": "value" } - move: target_field: metadata fields: ["event*"]
restructures the document:	{ "metadata": { "event": { "category": "authentication", "type": "start" } }, "other_field": "value" }

Moving to Root

Flattening nested structures...	{ "event": { "category": { "name": "process", "type": "system" } } } - move: move_to_root: true fields: ["event.category.*"]
brings fields to the top level:	{ "name": "process", "type": "system" }

Exclusions

Moving selected fields while excluding others...	{ "event": { "category": "process", "type": "start", "pid": 1234 }, "device": { "name": "server01" } } - move: target_field: metadata fields: ["*"] exclude: ["device*"]
preserves excluded fields:	{ "metadata": { "event": { "category": "process", "type": "start", "pid": 1234 } }, "device": { "name": "server01" } }

Immediate Children

Children fields...	{ "event": { "category": "process", "details": { "pid": 1234 } } } - move: move_to_root: true fields: ["event.*"]
are moved up one level:	{ "category": "process", "details": { "pid": 1234 } }

Target Fields

Replacing existing fields...	{ "event": { "category": "process" }, "metadata": { "existing": "value" } } - move: target_field: metadata fields: ["event*"] override: true
allows for field replacement:	{ "metadata": { "event": { "category": "process" } } }