Object Keys

Mutate

Synopsis

Writes the top-level key names of an object field into a target field, as a sorted array of strings.

Schema

- object_keys:
    field: <ident>
    description: <text>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>
    target_field: <ident>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	Y	-	Object field whose keys are extracted
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	See Handling Failures
ignore_missing	N	false	If true, quietly exit if field doesn't exist
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier
disabled	N	false	When true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration
target_field	N	field	Field to store the key array. Defaults to field, replacing the object with its key names

Details

Only the top level is read. Keys of nested objects are not included, and the values are discarded entirely — the result is an array of names, nothing else.

The keys are sorted alphabetically, which makes the output stable: the same object always produces the same array, regardless of the order the keys arrived in. That is what makes the result safe to compare between events or use as a fingerprint input.

The field must hold an object. An array, a string or a number is an error — use Length if you only need a count.

note

target_field defaults to field, which replaces the object with its key names, discarding the values. Set it explicitly to keep both.

Examples

Listing Keys

Recording which fields an object carries...	{ "labels": { "team": "platform", "env": "prod", "app": "gateway" } } - object_keys: field: labels target_field: label_names
as a sorted array, whatever order they were in:	{ "labels": { "team": "platform", "env": "prod", "app": "gateway" }, "label_names": ["app", "env", "team"] }

Top Level Only

Nested keys are not descended into...	{ "user": { "name": "jsmith", "address": { "city": "Berlin", "country": "DE" } } } - object_keys: field: user target_field: user_fields
so address appears as a name, but its own keys do not:	{ "user": { "name": "jsmith", "address": { "city": "Berlin", "country": "DE" } }, "user_fields": ["address", "name"] }