Map field values - Simple Log Service - Alibaba Cloud Documentation Center

If you use Logtail to collect logs, you can use the processor_dict_map plug-in to map field values. This topic describes the parameters of the processor_dict_map plug-in. This topic also provides examples on how to configure the plug-in.

Important You can use form configuration to add Logtail plug-ins only if you select Kubernetes - Standard Output in the Import Data section.

Entry point

If you want to use a Logtail plug-in to process logs, you can add a Logtail plug-in configuration when you create or modify a Logtail configuration. For more information, see Entry point.

Usage notes

Form configuration

Set the Processor Type parameter to Field Value Mapping. The following table describes the parameters.


Parameter	Description
Original Field	The name of the original field.
New Field	The name of the new field to which the mapped value is assigned.
Mapping Dictionary	The mapping dictionary. You can specify one or more key-value pairs for the dictionary. The specified dictionary key is mapped to the value of the original field. If the dictionary that you want to map is small in size, you can use this parameter to configure the dictionary. You do not need to specify a local CSV-formatted dictionary file. Important If you configure the Local Dictionary parameter, the setting of the Mapping Dictionary parameter does not take effect.
Local Dictionary	The CSV-formatted dictionary file.
Process Missing Original Field	If you select this option and the specified original field does not exist in a raw log, the value of the Value to Fill New Field parameter is used as the value of the new field.
Value to Fill New Field	If the specified original field does not exist in a raw log, the value of this parameter is used as the value of the new field. Default value: `Unknown`.
Maximum Mapping Dictionary Size	The maximum size of the mapping dictionary. Default value: 1000. This value indicates that a maximum of 1,000 mapping rules can be stored. To limit the server memory usage of the plug-in, you can set this parameter to a smaller value.
Method to Process Raw Log	The method that is used to process the existing field in a raw log. Valid values: overwrite: overwrites the existing field. This is the default value. fill: does not overwrite the existing field.

Editor configuration in JSON

The following table describes the parameters that you can configure in the detail parameter if you set the type parameter to processor_dict_map.


Parameter	Type	Required	Description
SourceKey	String	Yes	The name of the original field.
MapDict	Map	No	The mapping dictionary. If the dictionary that you want to map is small in size, you can use this parameter to configure the dictionary. You do not need to specify a local CSV-formatted dictionary file. Important If you configure the DictFilePath parameter, the setting of the MapDict parameter does not take effect.
DictFilePath	String	No	The CSV-formatted dictionary file.
DestKey	String	No	The name of the new field to which the mapped value is assigned.
HandleMissing	Boolean	No	Specifies whether to process a raw log if the specified original field does not exist in the log. Valid values: true: processes the raw log. The system uses the value of the Missing parameter as the value of the new filed. false: does not process the raw log. This is the default value.
Missing	String	No	If the specified original field does not exist in a raw log, the value of this parameter is used as the value of the new field. Default value: `Unknown`. This parameter takes effect only if the HandleMissing parameter is set to true.
MaxDictSize	Int	No	The maximum size of the mapping dictionary. Default value: 1000. This value indicates that a maximum of 1,000 mapping rules can be stored. To limit the server memory usage of the plug-in, you can set this parameter to a smaller value.
Mode	String	No	The method that is used to process the existing field in a raw log. Valid values: overwrite: overwrites the existing field. This is the default value. fill: does not overwrite the existing field.