Run transform conditionally in aggregator model #19380
Unanswered
olivermussell
asked this question in
Q&A
Replies: 1 comment
-
The equivalent of an "if statement" would be to use a |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
We're running Vector as a sidecar in AWS Fargate/ECS to collect logs from containers and then send them via a Vector aggregator to Elasticsearch.
I need to run a transform to amend the log structure from some of our containers and currently do this in the agent/sidecar config.toml. However, its not clear whether this is the correct approach in the aggregator model and if it would instead be better to do this in the aggregator config.
So is it possible to move the transform into the aggregator config with an if statement? We would be sending logs from many containers but only need to run the transform on logs from some specific containers so I wondered if there might be some way to say "if log contains this thing, run this transform". The only place I've seen in the docs is in a filter, but we don't want to drop the logs but run a transform instead.
Or otherwise is it preferred to transform the data in the agent before it is forwarded to the aggregator?
For reference:
Beta Was this translation helpful? Give feedback.
All reactions