To Map

Data Manipulation

Synopsis

Writes the fields of an allocated virtual table back into the entry's untyped map, as an overlay.

Schema

- to_map:
    name: <string>
    drop_table: <boolean>
    description: <text>
    if: <script>
    tag: <string>
    disabled: <boolean>
    ignore_failure: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
name	Y	-	Name of the virtual table to copy from. Supports templates
drop_table	N	false	Release the table after copying, as Drop Table would
description	N	-	Explanatory note
if	N	-	Condition to run
tag	N	-	Identifier
disabled	N	false	When true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration
ignore_failure	N	false	See Handling Failures
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success

Details

The copy is an overlay, not a replacement. Only the table's own fields are written; every other key already in the map is left as it is. A map key with the same name as a table field is overwritten.

Only fields the table actually holds are copied. A declared-but-unset column contributes nothing rather than writing a null.

If the named table was the output selection, that selection is cleared — the entry marshals from the untyped map again, exactly as if Use Table had been pointed back at map. This is what makes to_map the way out of typed output: copy the fields down, and shipping reverts to the map that now contains them.

Naming a table that was never allocated, or one that has been dropped, is an error.

drop_table: true folds a Drop Table into the same step, releasing the table once its fields have been copied.

Examples

Copying Fields Down

Writing a typed table's fields back into the map...	- create_table: name: session columns: - name: user type: string - name: duration type: long - use_table: name: session - set: field: user value: jsmith - to_map: name: session
the table's fields join the map, and output reverts to it:	{ "message": "session opened", "user": "jsmith" }

Copying and Releasing

Folding the release into the same step...	- to_map: name: session drop_table: true
which copies the fields and then frees the table:	# equivalent to - to_map: name: session - drop_table: name: session