Replace Fields

Overview

The Replace Fields processor applies pattern-based replacements to selected log fields. It can be used to rewrite values using regex matches and replacement strings.

Supported types: Logs

Configuration

Parameter	Type	Default	Required	Description
ottl_expression	string	none	No	Optional OTTL expression used to conditionally apply the replacement.

Rules

When building the ottl_expression, the UI exposes rule-based conditions.

Attributes

Parameter	Type	Description
Attribute Key	string	The attribute key to evaluate. Supported values: attribute; resource; log; span; metric (fields: aggregation_temporality; description; is_monotonic; name; type; unit); datapoint (fields: count; negative.offset; positive.offset; scale; sum; value_double; value_int; zero_count)
Operator	string	The operator to use for comparison. Supported values: equals; not equals; starts with; ends with; contains; regex; ==; !=; <; >; >=; <=; is boolean; is integer; is double; is map; is string; exists; not exists
Value	string	The value to compare against

Note: Multiple rules can be combined in the UI using logical operators such as AND or OR, and the resulting rule set is converted into the final ottl_expression.

Fields To Replace

Each item in fields defines one replacement rule.

Parameter	Type	Default	Required	Description
field_type	string	none	Yes	Field container to target. Supported values: body attribute resource.
field	string	none	No	Field key to update when target_scope = field. Leave empty when target_scope = map
target_scope	string	none	Yes	Defines the replacement scope. Whether to replace inside one field value or across an entire map.
match_type	string	none	Yes	Defines how the regex pattern is applied to the target content.Glob is intended for map scope
map_mode	string	none	Yes	Controls how replacement is handled when the target scope contains map-like content.When targeting a map with regex, choose whether to replace matching map keys or values.
pattern	string	none	Yes	Regex pattern or glob pattern to match
replacement	string	none	Yes	Replacement string to apply.

Example Configuration

{
  "ottl_expression": "", // default: none
  "fields": [
    // required
    {
      "field_type": "attribute", // required, default: "attribute"
      "field": "", // default: none
      "target_scope": "field", // default: "field"
      "match_type": "regex", // default: "regex"
      "map_mode": "value", // default: "value"
      "pattern": "", // required, default: none
      "replacement": "", // required, default: none
    },
  ],
}