Free Report! Gartner® Hype Cycle™ for Monitoring and Observability.Read more

Add Field

Description

The Add Fields processor can be used to add attributes, resources, and log record body keys from telemetry in the pipeline.

Use

The Add Fields processor is utilized for enriching telemetry data by appending or modifying attributes, resources, and log record body keys in metrics, logs, and traces based on specified conditions.

Supported Types

MetricsLogsTraces

Configuration

FieldDescription
Telemetry TypesThe types of telemetry to apply the processor to.
Log ConditionAn OTTL condition that must evaluate to true to apply this processor. By default, the processor applies to all logs.
Datapoint ConditionAn OTTL condition that must evaluate to true to apply this processor to metrics. By default, the processor applies to all datapoints.
Span ConditionAn OTTL condition that must evaluate to true to apply this processor. By default, the processor applies to all spans.
Resource KeysOne or more resource attribute names to add to logs.
Resource Actioninsert: Add resource if it does not exist. update: Update existing value. upsert: Insert or update.
Attribute KeysOne or more attribute names to add to logs.
Attribute Actioninsert: Add attribute(s) if it does not exist. update: Update existing value. upsert: Insert or update.
Body KeysOne or more body key names to add to log records.
Body Actioninsert: Add body key(s) if it does not exist. update: Update existing value. upsert: Insert or update.

Example Configuration(s)

Append Resource to Metrics for Categorization by Source

In this configuration, additional resource data is appended to the metrics to categorize and identify them based on their source. This is particularly useful for differentiating and filtering metrics that are generated from various environments or locations.

  • environment: dev
  • location: us-east1-b

Web Interface

observIQ docs - Add Field - image 1

Add Custom Attributes to Logs for Enhanced Searchability Based on Error Status

This configuration will add custom resource (application_name) to logs that have a log level of 'ERROR'. This can help in quickly identifying and tracing critical issues within a specific or part of the application.

our example log body:

JSON
1{
2	-> error: STRING(incorrect username or password)
3	-> level: STRING(error)
4	-> message: STRING(failed to authenticate user: test)
5	-> timestamp: STRING(2023-07-05T13:40:17.549-0400)
6}

The log condition we use to determine what logs to append the resource to:

expr
1body["level"] == error
observIQ docs - Add Field - image 2