github.com/observiq/carbon@v0.9.11-0.20200820160507-1b872e368a5e/docs/types/field.md (about)

     1  ## Fields
     2  
     3  _Fields_ are the primary way to tell carbon which values of an entry to use in its operators.
     4  Most often, these will be things like fields to parse for a parser operator, or the field to write a new value to.
     5  
     6  Fields are `.`-delimited strings which allow you to select labels or records on the entry. Fields can currently be used to select labels or values on a record. To select a label, prefix your field with `$label.` such as with `$label.my_label`. For values on the record, use the prefix `$record.` such as `$record.my_value`.
     7  
     8  Record fields can be nested arbitrarily deeply, such as `$record.my_value.my_nested_value`.
     9  
    10  If a field does not start with either `$label` or `$record`, `$record` is assumed. For example, `my_value` is equivalent to `$record.my_value`.
    11  
    12  ## Examples
    13  
    14  Using fields with the restructure operator.
    15  
    16  Config:
    17  ```yaml
    18  - type: restructure
    19    ops:
    20      - add:
    21          field: "key3"
    22          value: "value3"
    23      - remove: "$record.key2.nested_key1"
    24      - add:
    25          field: "$labels.my_label"
    26          value: "my_label_value"
    27  ```
    28  
    29  <table>
    30  <tr><td> Input entry </td> <td> Output entry </td></tr>
    31  <tr>
    32  <td>
    33  
    34  ```json
    35  {
    36    "timestamp": "",
    37    "labels": {},
    38    "record": {
    39      "key1": "value1",
    40      "key2": {
    41        "nested_key1": "nested_value1",
    42        "nested_key2": "nested_value2"
    43      }
    44    }
    45  }
    46  ```
    47  
    48  </td>
    49  <td>
    50  
    51  ```json
    52  {
    53    "timestamp": "",
    54    "labels": {
    55      "my_label": "my_label_value"
    56    },
    57    "record": {
    58      "key1": "value1",
    59      "key2": {
    60        "nested_key2": "nested_value2"
    61      },
    62      "key3": "value3"
    63    }
    64  }
    65  ```
    66  
    67  </td>
    68  </tr>
    69  </table>