Live Workshop: Integrate Google SecOps with Bindplane - Join Us on January 29th at 11 AM ET!Sign Up Now

Add Fields

Description

The Add Fields processor can be used to add attributes, resources, and log record body keys from telemetry in the pipeline.

Use

The Add Fields processor is utilized for enriching telemetry data by appending or modifying attributes, resources, and log record body keys in metrics, logs, and traces based on specified conditions.

Supported Types

MetricsLogsTraces

Configuration

FieldDescription
Telemetry TypesThe types of telemetry to apply the processor to.
ConditionAn OTTL condition that must evaluate to true to apply this processor. By default, the processor applies to all telemetry.
Field TypeIndicates the context in which the processor should operate: Attributes, Body, or Resource. Note: Body fields are applicable only for logs.
ActionInsert: Add field if it does not exist. Update: Update existing value. Upsert: Insert or update.
KeyKey to add or modify to the telemetry.
ValueValue associated with the defined key to add or modify to the telemetry.

Example Configuration

Append Resource to Metrics for Categorization by Source

In this configuration, additional resource data is appended to the metrics to categorize and identify them based on their source. This is particularly useful for differentiating and filtering metrics that are generated from various environments or locations.

  • environment: dev
  • location: us-east1-b

Web Interface

observIQ docs - Add Field - image 1

Add Custom Attributes to Logs for Enhanced Searchability Based on Error Status

This configuration will add custom resource (application_name) to logs that have a log level of 'ERROR'. This can help in quickly identifying and tracing critical issues within a specific part of the application.

Example log body:

JSON
1{
2  "error": "incorrect username or password",
3  "level": "error",
4  "message": "failed to authenticate user: test",
5  "timestamp": "2023-07-05T13:40:17.549-0400"
6}

The log condition we use to determine what logs to append the resource to:

expr
1body["level"] == error
observIQ docs - Add Field - image 2