Skip to main content
Ent+
This feature is available as an add-on for the Honeycomb Enterprise plan. Please contact your Honeycomb account team for details.

​
Description

The Marshal Processor moves fields onto the body and turns them into a JSON or Key Value string.
To use this processor, the input body must not be a string; it must contain one or more fields.

​
Supported Types

MetricsLogsTraces
✓

​
Configuration Table

ParameterTypeDefaultDescription
formatenumNoneWhich format to marshal to. Can be JSON, KV, or None.
log_fields_to_includeottlFields[]Which log fields to include.
log_fields_to_excludeottlFields[]Which log fields to exclude.
log_selectionenumIncludeWhether to use include or exclude mode for log field selection.
body_fields_to_includeottlFields[]Which body fields to include.
body_fields_to_excludeottlFields[]Which body fields to exclude.
body_selectionenumExcludeWhether to use include or exclude mode for body field selection.
attribute_fields_to_includeottlFields[]Which attribute fields to include.
attribute_fields_to_excludeottlFields[]Which attribute fields to exclude.
attribute_selectionenumExcludeWhether to use include or exclude mode for attribute field selection.
resource_fields_to_includeottlFields[]Which resource fields to include.
resource_fields_to_excludeottlFields[]Which resource fields to exclude.
resource_selectionenumExcludeWhether to use include or exclude mode for resource field selection.
flattenboolfalseWhether to flatten fields after moving to body.
log_fieldstringbp.logThe name of the body field to move log fields into. If empty, moves fields to top level.
attribute_fieldstringbp.attrsThe name of the body field to move attribute fields into. If empty, moves fields to top level.
resource_fieldstringbp.resThe name of the body field to move resource fields into. If empty, moves fields to top level.
kv_delimiterstring=The delimiter to use between key and value.
kv_pair_delimiterstringThe delimiter to use between key value pairs.
sort_by_keysboolfalseEnsure deterministic ordering of keys before marshaling.

​
Basic Configuration

Below is an example of configuration using the defaults. It will select all body, attributes, and resource fields but will not flatten or marshal them. Standalone Processor: 
apiVersion: bindplane.observiq.com/v1
kind: Processor
metadata:
  id: marshal-default
  name: marshal-default
spec:
  type: marshal
  parameters:
    - name: format
      value: None
    - name: log_fields_to_exclude
      value: []
    - name: log_fields_to_include
      value: []
    - name: log_selection
      value: Include
    - name: body_fields_to_exclude
      value: []
    - name: body_fields_to_include
      value: []
    - name: body_selection
      value: Exclude
    - name: attribute_fields_to_exclude
      value: []
    - name: attribute_fields_to_include
      value: []
    - name: attribute_selection
      value: Exclude
    - name: resource_fields_to_exclude
      value: []
    - name: resource_fields_to_include
      value: []
    - name: resource_selection
      value: Exclude
    - name: flatten
      value: false
    - name: log_field
      value: bp.log
    - name: attribute_field
      value: bp.attrs
    - name: resource_field
      value: bp.res
    - name: kv_delimiter
      value: =
    - name: kv_pair_delimiter
      value: ' '
    - name: sort_by_keys
      value: false

​
Key Value Example

The configuration below will flatten and marshal the body into a string like this: name=test bp.log.severity_number=5 bp.attrs.baba=you bp.res.field1=val1 bp.res.field2=val2 In the advanced section, the KV delimiters can be customized and the bp.log, bp.attrs, and bp.res fields can be renamed or ignored, putting fields directly onto the body. Standalone Processor: 
apiVersion: bindplane.observiq.com/v1
kind: Processor
metadata:
  id: marshal-kv
  name: marshal-kv
spec:
  type: marshal
  parameters:
    - name: format
      value: KV
    - name: log_fields_to_exclude
      value: []
    - name: log_fields_to_include
      value:
        - severity_number
    - name: log_selection
      value: Include
    - name: body_fields_to_exclude
      value:
        - severity
    - name: body_fields_to_include
      value: []
    - name: body_selection
      value: Exclude
    - name: attribute_fields_to_exclude
      value:
        - host
    - name: attribute_fields_to_include
      value: []
    - name: attribute_selection
      value: Exclude
    - name: resource_fields_to_exclude
      value:
        - field2
        - field1
    - name: resource_fields_to_include
      value:
        - field1
        - field2
    - name: resource_selection
      value: Include
    - name: flatten
      value: true
    - name: log_field
      value: bp.log
    - name: attribute_field
      value: bp.attrs
    - name: resource_field
      value: bp.res
    - name: kv_delimiter
      value: =
    - name: kv_pair_delimiter
      value: ' '
    - name: sort_by_keys
      value: false