If you use Logtail to collect logs, you can use the processor_dict_map plug-in to map field values. This topic describes the parameters of the processor_dict_map plug-in and provides examples on how to configure the plug-in.
Limits
The input plug-ins for text logs and container stdout and stderr support only form configuration. Other input plug-ins support only editor configuration in JSON.
Entry point
If you want to use a Logtail plug-in to process logs, you can add a Logtail plug-in configuration when you create or modify a Logtail configuration. For more information, see Overview of Logtail plug-ins for data processing.
Configuration description
Form configuration
Set the Processor Type parameter to Field Value Mapping. Then, configure other parameters based on the following table.
Parameter | Description |
Original Field | The name of the original field. |
New Field | The name of the new field to which the mapped value is assigned. |
Mapping Dictionary | The mapping dictionary. You can specify one or more key-value pairs for the dictionary. The specified dictionary key is mapped to the value of the original field. If the dictionary that you want to map is small in size, you can use this parameter to configure the dictionary. You do not need to specify a local CSV-formatted dictionary file. Important If you configure the Local Dictionary parameter, the setting of the Mapping Dictionary parameter does not take effect. |
Local Dictionary | The CSV-formatted dictionary file. In the file, commas (,) are used as delimiters and fields are enclosed in double quotation marks ("). |
Advanced Parameters > Process Missing Original Field | Specifies whether to process the original field if the original field does not exist in the raw log. If you select this option, the system uses the value of the Value to Fill New Field parameter as the value of the new field. |
Advanced Parameters > Maximum Mapping Dictionary Size | The maximum size of the mapping dictionary. Default value: 1000. The value indicates that up to 1,000 mapping rules can be stored. To limit the server memory usage of the plug-in, you can set this parameter to a smaller value. |
Advanced Parameters > Method to Process Raw Log | The method that is used to process the existing field in the raw log. Valid values:
|
Editor configuration in JSON
Set the type parameter to processor_dict_map. Then, configure other parameters in the detail section based on the following table.
Parameter | Type | Required | Description |
SourceKey | String | Yes | The name of the original field. |
MapDict | Map | No | The mapping dictionary. If the dictionary that you want to map is small in size, you can use this parameter to configure the dictionary. You do not need to specify a local CSV-formatted dictionary file. Important If you configure the DictFilePath parameter, the setting of the MapDict parameter does not take effect. |
DictFilePath | String | No | The CSV-formatted dictionary file. In the file, commas (,) are used as delimiters and fields are enclosed in double quotation marks ("). |
DestKey | String | No | The name of the new field to which the mapped value is assigned. |
HandleMissing | Boolean | No | Specifies whether to process the original field if the original field does not exist in the raw log. Valid values:
|
Missing | String | No | If the original field does not exist in the raw log, the value of this parameter is used as the value of the new field. Default value: This parameter takes effect only when the HandleMissing parameter is set to true. |
MaxDictSize | Int | No | The maximum size of the mapping dictionary. Default value: 1000. The value indicates that up to 1,000 mapping rules can be stored. To limit the server memory usage of the plug-in, you can set this parameter to a smaller value. |
Mode | String | No | The method that is used to process the existing field in the raw log. Valid values:
|