Dot Expander

Transform Elastic Compatible

Schema

dot_expander:
  - field: <ident>
  - path: <string>
  - description: <text>
  - if: <script>
  - ignore_failure: <boolean>
  - on_failure: <processor[]>
  - on_success: <processor[]>
  - tag: <string>

Synopsis

Expands fields containing dots in their names into nested objects.

Configuration

Field	Required	Default	Description
field	Y	-	Field containing dots to be expanded into a nested structure
path	N	-	Target field path for the expanded structure
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	If true, errors are ignored and processing continues
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier

Details

This processor is particularly useful when you need to convert flat field names with dots into hierarchical data structures that can be more easily processed by other processors. For example, foo.bar.baz: 123 becomes foo: { bar: { baz: 123 } }.

note

Use the ignore_failure flag if the field may not contain dots, the field may not exist, or errors may occur during expansion.

warning

The field name must contain at least one dot. The original field is removed after expansion, and all values are preserved as their original types during expansion. If path is specified, the expanded structure is placed at that location.

Examples

Basic Expansion

Expanding a dotted field into nested objects...	{ "foo.bar.baz": 123 } dot_expander: - field: foo.bar.baz
creates a nested structure:	{ "foo": { "bar": { "baz": 123 } } }

Custom Path

Specifying a path...	{ "source.field.value": 123 } dot_expander: - field: source.field.value - path: target
creates the expanded structure at that location:	{ "target": { "source": { "field": { "value": 123 } } } }

Conditionals

Specifying a condition...	{ "foo.bar.baz": 123, "condition": true } dot_expander: - field: foo.bar.baz - if: ctx.condition == true
expands the field only when that condition is met:	{ "condition": true, "foo": { "bar": { "baz": 123 } } }

Error Handling

If the field doesn't contain dots...	{ "foo": 123 } dot_expander: - field: foo - ignore_failure: true
the raised error is ignored:	{ "foo": 123, "error": { "message": "field 'foo' does not contain dots" } }