Marshal

Ent+

Note

This feature is available as an add-on for the Honeycomb Enterprise plan. Please contact your Honeycomb account team for details.

Description

The Marshal Processor moves fields onto the body and turns them into a JSON or Key Value string.

{% hint style=“info” %} NOTE

To use this processor, the input body must not be a string; it must contain one or more fields. {% endhint %}

Supported Types

Metrics	Logs	Traces
	✓

Configuration Table

Parameter	Type	Default	Description
format	enum	None	Which format to marshal to. Can be JSON, KV, or None.
log_fields_to_include	ottlFields	[]	Which log fields to include.
log_fields_to_exclude	ottlFields	[]	Which log fields to exclude.
log_selection	enum	Include	Whether to use include or exclude mode for log field selection.
body_fields_to_include	ottlFields	[]	Which body fields to include.
body_fields_to_exclude	ottlFields	[]	Which body fields to exclude.
body_selection	enum	Exclude	Whether to use include or exclude mode for body field selection.
attribute_fields_to_include	ottlFields	[]	Which attribute fields to include.
attribute_fields_to_exclude	ottlFields	[]	Which attribute fields to exclude.
attribute_selection	enum	Exclude	Whether to use include or exclude mode for attribute field selection.
resource_fields_to_include	ottlFields	[]	Which resource fields to include.
resource_fields_to_exclude	ottlFields	[]	Which resource fields to exclude.
resource_selection	enum	Exclude	Whether to use include or exclude mode for resource field selection.
flatten	bool	false	Whether to flatten fields after moving to body.
log_field	string	bp.log	The name of the body field to move log fields into. If empty, moves fields to top level.
attribute_field	string	bp.attrs	The name of the body field to move attribute fields into. If empty, moves fields to top level.
resource_field	string	bp.res	The name of the body field to move resource fields into. If empty, moves fields to top level.
kv_delimiter	string	=	The delimiter to use between key and value.
kv_pair_delimiter	string		The delimiter to use between key value pairs.
sort_by_keys	bool	false	Ensure deterministic ordering of keys before marshaling.

Basic Configuration

Below is an example of configuration using the defaults. It will select all body, attributes, and resource fields but will not flatten or marshal them.

Standalone Processor:

apiVersion: bindplane.observiq.com/v1
kind: Processor
metadata:
  id: marshal-default
  name: marshal-default
spec:
  type: marshal
  parameters:
    - name: format
      value: None
    - name: log_fields_to_exclude
      value: []
    - name: log_fields_to_include
      value: []
    - name: log_selection
      value: Include
    - name: body_fields_to_exclude
      value: []
    - name: body_fields_to_include
      value: []
    - name: body_selection
      value: Exclude
    - name: attribute_fields_to_exclude
      value: []
    - name: attribute_fields_to_include
      value: []
    - name: attribute_selection
      value: Exclude
    - name: resource_fields_to_exclude
      value: []
    - name: resource_fields_to_include
      value: []
    - name: resource_selection
      value: Exclude
    - name: flatten
      value: false
    - name: log_field
      value: bp.log
    - name: attribute_field
      value: bp.attrs
    - name: resource_field
      value: bp.res
    - name: kv_delimiter
      value: =
    - name: kv_pair_delimiter
      value: ' '
    - name: sort_by_keys
      value: false

Key Value Example

The configuration below will flatten and marshal the body into a string like this:

name=test bp.log.severity_number=5 bp.attrs.baba=you bp.res.field1=val1 bp.res.field2=val2

In the advanced section, the KV delimiters can be customized and the bp.log, bp.attrs, and bp.res fields can be renamed or ignored, putting fields directly onto the body.