The flatten subrecord processing rule uses regular expressions to search for key/value pairs inside a JSON object, then either moves or copies any applicable key/value pairs to the top level of the record.Documentation Index
Fetch the complete documentation index at: https://docs.chronosphere.io/llms.txt
Use this file to discover all available pages before exploring further.
Configuration parameters
Use the parameters in this section to configure the . The Telemetry Pipeline web interface uses the items in the Name column to describe these parameters. Pipeline configuration files use the items in the Key column as YAML keys.| Name | Key | Description | Default |
|---|---|---|---|
| Key | key | Required. The key of the object that contains key/value pairs to move or copy. You can also use record accessor syntax to reference keys nested in another nested object. | none |
| Regex | regex | Required. The regular expression that determines which key/value pairs to move or copy. A value of ^.+$ matches all key/value pairs contained by the specified object. | ^.+$ |
| Replacement key | keyReplacement | Required. The regular expression that sets the naming pattern for keys that are moved or copied. A value of %1 preserves all keys’ original names. | %1 |
| Keep original checkbox | keepOrig | If selected, preserves the object specified in Key. If unselected, the flatten subrecord rule moves any applicable key/value pairs to the top level of the record, and then removes the object specified in Key. | Not selected |
| Comment | comment | A custom note or description of the rule’s function. This text is displayed next to the rule’s name in the Actions list in the processing rules interface. | none |
Examples
Using the flatten subrecord rule lets you restructure your telemetry data by pulling key/value pairs out of a nested object and storing them as flat data at the record’s root.Move key/value pairs
For example, given this sample log data:$user.account, the Regex value id,
and the Replacement key value user.%1 returns the following result:
account object,
moved id up into a new key named user.id at the record’s top level,
and then removed account and the key/value pairs it originally contained.
Copy key/value pairs
You can also use the Keep original setting to copy key/value pairs out of an object instead of moving them. For example, given this sample log data:$user.account, the Regex value id, the
Replacement key value user.%1, and the Keep original setting enabled
returns the following result:
account object,
copied id into a new key named user.id at the record’s top level, but
did not remove account and the key/value pairs it originally contained.