The Coalesce processor can be used to consolidate many field names into a single field name.
The Coalesce processor is utilized for consolidating telemetry fields in metrics, logs, and traces based on specified conditions.
| Metrics | Logs | Traces |
|---|---|---|
| ✓ | ✓ | ✓ |
| Field | Description |
|---|---|
| Telemetry Types | The types of telemetry to apply the processor to. |
| Condition | A condition that determines when this processor is applied. |
| Action | The action to take (insert, update, upsert) when coalescing telemetry |
| Coalesce From | The telemetry fields to coalesce from. |
| Coalesce To | The telemetry field to coalesce to. |
The behavior of this processor is dependent on the selected action.
When insert is selected, the target field only gets coalesced to if it doesn’t exist. Precedence: First item in list. When update is selected, the target field gets coalesced to only if it already exists. Precedence: Last item in list. When upsert it selected, the target field gets coalesces to regardless whether it existed or not. Precedence: Last item in list.
This configuration will coalesce the body fields ts, time, and timestamp to an attribute named time for later parsing. Upsert is used for the action.
This configuration will coalesce the body fields sev, severity, and level to an attribute named severity for later parsing. Upsert is used for the action.
This configuration will coalesce the body fields dc, datacenter, and location to an attribute named datacenter for later parsing. Upsert is used for the action.
