Set

Mutate Elastic Compatible

Synopsis

Sets a field and associates it with a specified value.

Schema

- set:
    field: <ident>
    value: <any>
    copy_from: <ident>
    override: <boolean>
    media_type: <enum>
    deep_copy: <boolean>
    fields: <SetField[]>
    description: <text>
    if: <script>
    ignore_empty_value: <boolean>
    ignore_missing: <boolean>
    ignore_failure: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	Y*	-	Field to update. Use this for a single field; use fields to set several in one processor
value	N	-	Value to set. Cannot be used if copy_from is specified
copy_from	N	-	Field whose value will be copied to field. Cannot be used if value is specified
override	N	true	If false, do not update fields that already have a non-null value
deep_copy	N	false	If true, perform deep copy of nested objects
fields	Y*	-	Array of field/value pairs for setting multiple fields at once. Read only when field is absent
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_empty_value	N	false	If true, quietly exit if specified field does not exist or its value is null/empty
ignore_missing	N	false	If true, continue silently if source field doesn't exist
ignore_failure	N	false	See Handling Failures
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier
disabled	N	false	When true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration

* = Give either field or fields. ProcessBase takes the field branch whenever field is non-empty and only then falls through to fields, so setting both silently ignores fields.

Details

The processor can either set a literal value or copy a value from another field. If the field already exists, its value will be replaced unless override is set to false.

note

Either value or copy_from must be specified, but not both. When using copy_from, the source field must exist unless ignore_empty_value is set to true.

warning

When using templates, ensure that they reference valid fields as missing fields will cause the processor to fail unless ignore_empty_value is enabled.

Examples

Basic

Setting a simple numeric value...	{ "data": {} } - set: field: metrics.packets value: 150
creates a new field with that value:	{ "data": { "metrics": { "packets": 150 } } }

Templates

Values can reference other fields through templates...	{ "checkpoint": { "product": "ExampleProduct" } } - set: field: observer.product value: "{{checkpoint.product}}"
which get resolved at run time:	{ "checkpoint": { "product": "ExampleProduct" }, "observer": { "product": "ExampleProduct" } }

Array Templates

Set arrays with mixed values...	{ "event": { "type": "login", "service": "ssh" } } - set: field: event.category value: - "{{event.service}}" - authentication - "{{event.type}}"
combining static and dynamic values:	{ "event": { "type": "login", "service": "ssh", "category": ["ssh", "authentication", "login"] } }

Map Templates

Set maps with template values...	{ "source": { "service": "webserver", "version": "2.4" } } - set: field: service.details value: name: "{{source.service}}" type: "web" version: "{{source.version}}"
creating structured data:	{ "service": { "details": { "name": "webserver", "type": "web", "version": "2.4" } } }

Copying

Copying a value from one field to another...	{ "source": { "packets": 10 } } - set: field: metrics.packets copy_from: source.packets
duplicates the value:	{ "source": { "packets": 10 }, "metrics": { "packets": 10 } }

Existing Values

When existing values are not overridden...	{ "checkpoint": { "title": "NoTitle" } } - set: field: checkpoint.title value: "NewTitle" override: false
non-null values are preserved:	{ "checkpoint": { "title": "NoTitle" } }