Move

Transform

Synopsis

Moves fields from one location to another within the document structure.

Schema

move:
  - target_field: <ident>
  - fields: <string[]>
  - exclude: <string[]>
  - move_to_root: <boolean>
  - override: <boolean>
  - ignore_missing: <boolean>
  - description: <text>
  - if: <script>
  - ignore_failure: <boolean>
  - on_failure: <processor[]>
  - on_success: <processor[]>
  - tag: <string>

Configuration

Field	Required	Default	Description
target_field	N*	-	Destination field (required unless move_to_root: true)
fields	N	["*"]	List of patterns to match fields for moving
exclude	N	-	List of patterns to exclude from moving
move_to_root	N	false	Move matched fields to document root
override	N	false	Allow overwriting existing target fields
ignore_missing	N	false	Continue silently if source fields don't exist
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	See Handling Failures
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier

Details

The processor supports moving nested fields, pattern matching, and exclusions. It can move fields to a specific target field or to the root level of the document.

The processor is particularly useful for modifying and tidying document hierarchies, flattening nested objects, and isolating specific fields.

Fields are removed from their original location after moving. When move_to_root is set to true, target_field is ignored.

note

Pattern matching uses filepath.Match syntax, e.g. * for any characters, so patterns ending with .* handle immediate children differently.

warning

Moving fields to root level can overwrite existing fields. Be careful with pattern matching to avoid unintended moves.

Also, when moving nested structures, field conflicts can occur. Consider using exclude patterns to protect critical fields.

Examples

Basic

Moving fields to a target location...	{ "event": { "category": "authentication", "type": "start" }, "other_field": "value" } move: - target_field: metadata - fields: ["event*"]
restructures the document:	{ "metadata": { "event": { "category": "authentication", "type": "start" } }, "other_field": "value" }

Moving to Root

Flattening nested structures...	{ "event": { "category": { "name": "process", "type": "system" } } } move: - move_to_root: true - fields: ["event.category.*"]
brings fields to the top level:	{ "name": "process", "type": "system" }

Exclusions

Moving selected fields while excluding others...	{ "event": { "category": "process", "type": "start", "pid": 1234 }, "device": { "name": "server01" } } move: - target_field: metadata - fields: ["*"] - exclude: ["device*"]
preserves excluded fields:	{ "metadata": { "event": { "category": "process", "type": "start", "pid": 1234 } }, "device": { "name": "server01" } }

Immediate Children

Children fields...	{ "event": { "category": "process", "details": { "pid": 1234 } } } move: - move_to_root: true - fields: ["event.*"]
are moved up one level:	{ "category": "process", "details": { "pid": 1234 } }

Target Fields

Replacing existing fields...	{ "event": { "category": "process" }, "metadata": { "existing": "value" } } move: - target_field: metadata - fields: ["event*"] - override: true
allows for field replacement:	{ "metadata": { "event": { "category": "process" } } }