Add entries processor

The add_entries processor adds entries to an event.

Configuration

You can configure the add_entries processor with the following options.

Usage

The following examples show how the add_entries processor can be used in different cases.

Example: Add entries with simple values

The following example shows you how to configure the processor to add entries with simple values:

... 
  processor:
    - add_entries:
        entries:
          - key: "name"
            value: "John"
          - key: "age"
            value: 20
...

When the input event contains the following data:

{"message": "hello"}

The processed event will contain the following data:

{"message": "hello", "name": "John", "age": 20}

Example: Add entries using format strings

The following example shows you how to configure the processor to add entries with values from other fields:

... 
  processor:
    - add_entries:
        entries:
          - key: "date"
            format: "${month}-${day}"
...

When the input event contains the following data:

{"month": "Dec", "day": 1}

The processed event will contain the following data:

{"month": "Dec", "day": 1, "date": "Dec-1"}

Example: Add entries using value expressions

The following example shows you how to configure the processor to use the value_expression option:

... 
  processor:
    - add_entries:
        entries:
          - key: "length"
            value_expression: "length(/message)"
...

When the input event contains the following data:

{"message": "hello"}

The processed event will contain the following data:

{"message": "hello", "length": 5}

Example: Add metadata

The following example shows you how to configure the processor to add metadata to events:

... 
  processor:
    - add_entries:
        entries:
          - metadata_key: "length"
            value_expression: "length(/message)"
...

When the input event contains the following data:

{"message": "hello"}

The processed event will have the same data, with the metadata, {"length": 5}, attached. You can subsequently use expressions like getMetadata("length") in the pipeline. For more information, see getMetadata function.

Example: Add a dynamic key

The following example shows you how to configure the processor to add metadata to events using a dynamic key:

... 
  processor:
    - add_entries:
        entries:
          - key: "${/param_name}"
            value_expression: "/param_value"
...

When the input event contains the following data:

{"param_name": "cpu", "param_value": 50}

The processed event will contain the following data:

{"param_name": "cpu", "param_value": 50, "cpu": 50}

Example: Overwrite existing entries

The following example shows you how to configure the processor to overwrite existing entries:

... 
  processor:
    - add_entries:
        entries:
          - key: "message"
            value: "bye"
            overwrite_if_key_exists: true
...

When the input event contains the following data:

{"message": "hello"}

The processed event will contain the following data:

{"message": "bye"}

If overwrite_if_key_exists is not set to true, then the input event will not be changed after processing.

Example: Append values to existing entries

The following example shows you how to configure the processor to append values to existing entries:

... 
  processor:
    - add_entries:
        entries:
          - key: "message"
            value: "world"
            append_if_key_exists: true
...

When the input event contains the following data:

{"message": "hello"}

The processed event will contain the following data:

{"message": ["hello", "world"]}

Example

The following pipeline performs these actions:

1. Adds an app_id field using the format string ${app}-${env}.
2. Adds a message_len field with the value of length(/message).
3. Adds a metadata key msg_len_meta with the value of length(/message).
4. If both /metric/name and /metric/value exist, creates a new field named after /metric/name and sets its value to /metric/value.
5. If /level == "error", adds the field severity: "high".
6. Appends "ingested" to the tags field, ensuring that the tags field is an array.
7. Sets env_normalized: "prod", overwriting the existing value if the field already exists.

example-pipeline:
  source:
    http:
      path: /events
      ssl: false

  processor:
    - add_entries:
        entries:
          - key: app_id
            format: ${app}-${env}

          - key: message_len
            value_expression: length(/message)

          - metadata_key: msg_len_meta
            value_expression: length(/message)

          # dynamic key from the event, only when both metric fields exist
          - key: ${/metric/name}
            value_expression: /metric/value
            add_when: "/metric/name != null and /metric/value != null"

          # set severity ONLY on error level
          - key: severity
            value: high
            add_when: '/level == "error"'

          # append behavior: if tags already exists, it becomes/extends an array
          - key: tags
            value: ingested
            append_if_key_exists: true

          # overwrite behavior
          - key: env_normalized
            value: prod
            overwrite_if_key_exists: true

  sink:
    - opensearch:
        hosts: [https://opensearch:9200]
        insecure: true
        username: admin
        password: admin_password
        index_type: custom
        index: example-%{yyyy.MM.dd}

You can test this pipeline by executing the following command:

curl -sS -X POST "http://localhost:2021/events" \
  -H "Content-Type: application/json" \
  -d '[
        {"app":"shop","env":"dev","message":"hello","level":"info","metric":{"name":"cpu","value":42}},
        {"app":"shop","env":"prod","message":"boom","level":"error"},
        {"app":"api","env":"stage","message":"hi","level":"warn","metric":{"name":"mem","value":2048},"tags":"pretag"}
      ]'

The documents stored in OpenSearch contain the following information:

"hits": [
  {
    "_index": "example-2025.10.10",
    "_id": "BnvWzpkBTMZ443JmHuHI",
    "_score": 1,
    "_source": {
      "app": "shop",
      "env": "dev",
      "message": "hello",
      "level": "info",
      "metric": {
        "name": "cpu",
        "value": 42
      },
      "app_id": "shop-dev",
      "message_len": 5,
      "cpu": 42,
      "tags": "ingested",
      "env_normalized": "prod"
    }
  },
  {
    "_index": "example-2025.10.10",
    "_id": "B3vWzpkBTMZ443JmHuHI",
    "_score": 1,
    "_source": {
      "app": "shop",
      "env": "prod",
      "message": "boom",
      "level": "error",
      "app_id": "shop-prod",
      "message_len": 4,
      "severity": "high",
      "tags": "ingested",
      "env_normalized": "prod"
    }
  },
  {
    "_index": "example-2025.10.10",
    "_id": "CHvWzpkBTMZ443JmHuHI",
    "_score": 1,
    "_source": {
      "app": "api",
      "env": "stage",
      "message": "hi",
      "level": "warn",
      "metric": {
        "name": "mem",
        "value": 2048
      },
      "tags": [
        "pretag",
        "ingested"
      ],
      "app_id": "api-stage",
      "message_len": 2,
      "mem": 2048,
      "env_normalized": "prod"
    }
  }
]