extend
Appends fields to events.
Synopsis
extend <field=operand>...
Description
The extend
operator appends a specified list of fields to the input. All
existing fields remain intact.
The difference between extend
and put
is that put
drops all
fields not explicitly specified, whereas extend
only appends fields.
The difference between extend
and replace
is that replace
overwrites existing fields, whereas extend
doesn't touch the input.
The difference between extend
and set
is that set
does not
ignore fields that do already exist in the data.
<field=operand>
The assignment consists of field
that describes the new field name and
operand
that defines the field value.
Examples
Add new fields with fixed values:
extend secret="xxx", ints=[1, 2, 3], strs=["a", "b", "c"]
Duplicate a column:
extend source=src_ip