If you use Logtail to collect logs, you can use the processor_dict_map plug-in to map field values. This topic describes the parameters of the processor_dict_map plug-in. This topic also provides examples on how to configure the plug-in.
Limits
The input plug-ins for text logs and container stdout and stderr support only form configuration. Other input plug-ins support only editor configuration in JSON.
Entry point
If you want to use a Logtail plug-in to process logs, you can add a Logtail plug-in configuration when you create or modify a Logtail configuration. For more information, see Overview of Logtail plug-ins for data processing.
Usage notes
Form configuration
Set the Processor Type parameter to Field Value Mapping. The following table describes the parameters.
Parameter | Description |
Original Field | The name of the original field. |
New Field | The name of the new field to which the mapped value is assigned. |
Mapping Dictionary | The mapping dictionary. You can specify one or more key-value pairs for the dictionary. The specified dictionary key is mapped to the value of the original field. If the dictionary that you want to map is small in size, you can use this parameter to configure the dictionary. You do not need to specify a local CSV-formatted dictionary file. Important If you configure the Local Dictionary parameter, the setting of the Mapping Dictionary parameter does not take effect. |
Local Dictionary | The CSV-formatted dictionary file. |
Advanced Parameters > Process Missing Original Field | If you select this option and the specified original field does not exist in a raw log, the value of the Value to Fill New Field parameter is used as the value of the new field. |
Advanced Parameters > Maximum Mapping Dictionary Size | The maximum size of the mapping dictionary. Default value: 1000. This value indicates that a maximum of 1,000 mapping rules can be stored. To limit the server memory usage of the plug-in, you can set this parameter to a smaller value. |
Advanced Parameters > Method to Process Raw Log | The method that is used to process the existing field in a raw log. Valid values:
|
Editor configuration in JSON
The following table describes the parameters that you can configure in the detail parameter if you set the type parameter to processor_dict_map.
Parameter | Type | Required | Description |
SourceKey | String | Yes | The name of the original field. |
MapDict | Map | No | The mapping dictionary. If the dictionary that you want to map is small in size, you can use this parameter to configure the dictionary. You do not need to specify a local CSV-formatted dictionary file. Important If you configure the DictFilePath parameter, the setting of the MapDict parameter does not take effect. |
DictFilePath | String | No | The CSV-formatted dictionary file. |
DestKey | String | No | The name of the new field to which the mapped value is assigned. |
HandleMissing | Boolean | No | Specifies whether to process a raw log if the specified original field does not exist in the log. Valid values:
|
Missing | String | No | If the specified original field does not exist in a raw log, the value of this parameter is used as the value of the new field. Default value: This parameter takes effect only if the HandleMissing parameter is set to true. |
MaxDictSize | Int | No | The maximum size of the mapping dictionary. Default value: 1000. This value indicates that a maximum of 1,000 mapping rules can be stored. To limit the server memory usage of the plug-in, you can set this parameter to a smaller value. |
Mode | String | No | The method that is used to process the existing field in a raw log. Valid values:
|