The record_accessor plugin helper provides a unified access to event record. It uses jsonpath like syntax for the target field. With this helper, you can easily access/delete a nested field in the plugin.

Here is an example:

require 'fluent/plugin/filter'
​
module Fluent::Plugin
  class ExampleFilter < Filter
    Fluent::Plugin.register_filter('example', self)
​
    # 1. Load record_accessor helper
    helpers :record_accessor
​
    def configure(conf)
      super
​
      # 2. Call `record_accessor_create` to create object
      @accessor = record_accessor_create('$.user.name')
    end
​
    # Omit `super`, `shutdown` and other plugin APIs
​
    def filter(tag, time, record)
      # 3. Call `call` method to get value
      value = @accessor.call(record) # With `$.user.name`, access to record["user"]["name"]
      # ...
    end
  end
end

Syntax

• dot notation: $. starting parameter. Chain fields with dot ..

For example:

$.event.level for record["event"]["level"]

$.key1[0].key2 for record["key1"][0]["key2"]

• bracket notation: $[ starting parameter. Chain fields with [].

Useful for special characters, ., whitespace, etc.

$['dot.key'][0]['space key'] for record["dot.key"][0]["space key"]

If you set non $. or $[ starting value, e.g. key log, it is same as record["log"]. So, using record_accessor does not break the existing plugin behavior.

Methods

record_accessor_create(param)

This method returns the accessor object of event record. param is a String.

See "Syntax" section for the more details.

record_accessor_create("log")
record_accessor_create("$.key1.key2")
record_accessor_create("$['key1'][0]['key2']")

After create object, call call/delete method with record object.

accessor.call(record)   # get record field
accessor.delete(record) # delete record field

Plugins using record_accessor

• ​filter_grep​

• ​filter_parser​

• ​filter_record_transformer​

If this article is incorrect or outdated, or omits critical information, please let us know. Fluentd is an open-source project under Cloud Native Computing Foundation (CNCF). All components are available under the Apache 2 License.