set
Upserts fields in events.
Synopsis
set <field=operand>...
Description
The set
operator sets a list of fields to the given values. It overwrites old
values of fields matching the field
expression, or creates new fields of a
given name otherwise.
<field=operand>
The assignment consists of field
that describes the new field name and
operand
that defines the field value. If the field name already exists, the
operator replaces the value of the field.
Examples
Upsert new fields with fixed values:
set secret="xxx", ints=[1, 2, 3], strs=["a", "b", "c"]
Move a column, replacing the old value with null
.
set source=src_ip, src_ip=null